RFP-33-11-325 USNRC ITISS Security Tools.pdf

Security Operation Functions

General Requirement

The overarching requirement is to protect the NRC information systems environment from all cyber security threats. The functions listed below are the tools used to monitor, detect and respond to cyber security events and incidents. The functions below require adequate staffing of experienced security analyst and security administrators to effectively operate, manage, administer and, most of importantly, analyze the data from all the systems listed in order to detect malicious activity within the agency’s network. Inadequate staffing will result in an inability to provide a true situational awareness view of the NRC environment and respond to events and incidents in a rapid fashion.

Functions

Function Description Provided by

PIX Firewalls

Perimeter firewalls that will be upgraded to CISCO ASA firewalls in June 2009. ISSC Incumbent

Contractor

Mail Security Gateways

E-mail SPAM and anti-virus filtering appliances where all agency ingress and egress mail must pass. Agency

Proxy Server / Reporter

Content filtering and logging of all agency web traffic based on site reputation and characteristics ISSC Incumbent

Contractor/ Agency

Web Filter and Content Scanning Appliances

Operates in conjunction with proxy servers to scan all agency web surfing content for malicious code and viruses.

Agency

Enterprise Vulnerability Scanner

Vulnerability scanning and reporting for all systems on the internal network. Agency

Enterprise Configuration Compliance Management

Hardware and software configuration auditing, change monitoring, validated SCAP tool used for FDCC and server configuration compliance monitoring, and automation of configuration compliance processes.

Agency

Security Intelligence reporting Hub reporting, Component of configuration compliance management and vulnerability scanning systems. Provides centralized reporting and analysis of data for all network devices that profiles their applications, Agency services, vulnerabilities, and compliance status.

Intrusion Detection System (IDS) - Primary

Primary intrusion detection and passive monitoring for network-based attacks and threats.

Current IDS provides additional capabilities to monitor systems on behavior as well as signature matching.

Also provides

ISSC Incumbent Contractor

Intrusion Detection System (IDS) - Secondary

Secondary intrusion detection and network monitoring system at strategic network perimeter points. ISSC Incumbent

Contractor

Enterprise Log Management

Centralized log management, archival, and reporting appliance used in conjunction with SYSLOG server.

Logging includes all security devices, and critical hosts.

Agency

Security Information & Event Management

(SIEM)

Correlation and analysis console for disparate network and security system events, data, and logs.

Agency

Anti-Virus & Anti- Spyware

Windows server and desktop anti-virus, malware, and spyware protection.

ISSC Incumbent Contractor

Host Based Intrusion Prevention (HIPS)

Host based monitoring of critical servers for malicious activity.

Agency

Citrix Security Appliance

Secure remote web access to Citrix Desktop. Load-balancing, SSL-based VPN appliance supporting current and future ‘Work From Anywhere’ initiatives.

ISSC Incumbent Contractor

Network Access Control Centralized monitoring and enforcement of network policies, including Guest computer reassignment, patch and AV policy enforcement and asset classification and inventory.

ISSC Incumbent Contractor