S-86000-00012060_Web Application Security_Penetration Testing_Oregon Public Utility Commission.pdf

S-86000-00012060_ Web Application security & penetration testing _Oregon Public Utility Commission

Level 3 - Restricted

REQUEST FOR QUOTE / Web Application security & penetration testing

Submit a hourly rate and estimated hours to complete the described work in this solicitation. Proposals should be sent via email to:

Rich.Palmer@puc.oregon.gov . Proposals must be received by Wednesday December 4, 2025 @ 3:00 P.M. (PST)

1. ASSESSMENT DESCRIPTION

The Oregon Public Utility Commission (“Agency”) is looking to engage with a contractor for dynamic web application security, and penetration testing of three of its public-facing web applications:

• OUSF – https://ousf.puc.state.or.us

• RSPF – https://rspf.puc.state.or.us

• eDockets Search – https://apps.puc.state.or.us/edocketsSearch/eDocketsSearch/

• OTAP Online Application – https://apps.puc.state.or.us/rspf/otapapp.asp

• Consumer Online Complaint – https://apps.puc.state.or.us/consumer/complaint.asp

Agency wishes to contract with a Contractor for services related to a Comprehensive Application Security Verification and penetration testing (the “Assessment”) against test versions of the production sites. Assessment will be performed remotely by Contactor.

The Assessment will use the latest published version (currently 4.0.3) of the OWASP Application Security Verification (“ASVS”) Level 2 (L2) Standard. The results will help establish a level of confidence in the security of the System being developed by the Agency.

The Assessment requires a degree of rigor that will include the following activities:

• Dynamic vulnerability testing

• Manual and automated penetration testing (both black and white box testing)

Contractor shall determine if the System meets the L2 requirements of the ASVS and provide OPUC with a presentation to Agency Stakeholders, an executive report, and verification of passed and failed tests, recommendations for remediation, and remediation verification.

Contractor shall also provide, in a concise spreadsheet format, a detailed findings and vulnerability matrix. Vulnerability matrix shall include all findings and vulnerabilities found during the assessment and be similar in style and level of detail as the OWASP 4.0.3 Application Security Verification Standard spreadsheet (Available via https://www.owasp.org). The findings and vulnerability matrix are intended to be used as an internal document for remediation efforts and allow for the inclusion of the actions taken in response to specific vulnerabilities.

mailto:Rich.Palmer@puc.oregon.gov https://ousf.puc.state.or.us/ https://rspf.puc.state.or.us/ https://apps.puc.state.or.us/edocketsSearch/eDocketsSearch/ https://apps.puc.state.or.us/rspf/otapapp.asp https://apps.puc.state.or.us/consumer/complaint.asp https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project

Web application details:

• OUSF

o Description: The OUSF Application Website allows Telecommunications companies with intrastate retail revenues to file quarterly OUS2 forms which are they are required to submit along with payment of the 8.5% Oregon Universal Service Fund Surcharge collected from customers on those revenues. It allows for online banking transactions to collect the funds from the companies. It also allows for tracking of the disbursement of the Universal Service Funds to eligible telecommunication providers.

Status: In Production o Test site URL: https://ousft.puc.state.or.us/ o Technologies/Libraries/Frameworks: MS IIS10, ASP.NET MVC, Bootstrap 3, Elmah, Ninject, OWIN, T4MVCExtensions, WebActivatorEx, HTML5, JSON o Interfaces to 3rd parties: US Bank E-Payment Service (Real-Time Payment Confirmation (RTPC)

• RSPF

o Description: Online surcharge collection payment and management system for Telecommunications Providers.

o Status: In Production o Test site URL: https://rspft.puc.state.or.us/ o Technologies/Libraries/Frameworks: MS IIS10, .NET 4.8, MVC/WebForms, HTML5, JQuery ,JSON o Interfaces to 3rd parties: No

• eDockets Search o Description: Simple online search tool.

o Status: In Production o Test site URL:

https://webt.puc.state.or.us/edocketsSearch/eDocketsSearch/ o Technologies/Libraries/Frameworks: MS IIS10, .NET 4.8, MVC/WebForms, HTML5, JQuery ,JSON o Interfaces to 3rd parties: No

• OTAP Online Application o Description: Simple online application submittal form.

o Status: In Production o Test site URL: https://webt.puc.state.or.us/rspf/otapapp.asp o Technologies/Libraries/Frameworks: Classic ASP, VB .NET 7.1

(2003) o Interfaces to 3rd parties: No

• Consumer Online Complaint Form https://ousft.puc.state.or.us/ https://rspft.puc.state.or.us/ https://webt.puc.state.or.us/edocketsSearch/eDocketsSearch/ https://webt.puc.state.or.us/rspf/otapapp.asp o Description: Simple online application submittal form.

o Status: In Production o Test site URL:

https://webt.puc.state.or.us/consumer/complaint.asp o Technologies/Libraries/Frameworks: Classic ASP, VB .NET 7.1

(2003) o Interfaces to 3rd parties: No

Provide a cost quote for the following including a hourly rate and estimated total hours to complete all deliverables for this project :

2. TASKS, DELIVERABLES and SCHEDULE

TASK 1 – Project Management of the Assessment and Kick-off Meeting

Task 1 is continuous throughout the duration of the Assessment. Contractor shall provide services required to administer the Contract, whether those services involve monitoring, coordinating and otherwise administering the performance of the Contractor’s staff.

Contractor shall guide and direct the overall processes in conformance with the Assessments goals and objectives. Contractor shall monitor progress of the Assessment.

Contractor shall provide a dedicated team of specialists to perform the work as described in this Contract. Contractor shall seek contextual feedback from appropriate Agency personnel to ensure the accuracy and thoroughness on all findings.

Task 1.1 – Assessment Kick-Off Meeting

Contractor shall coordinate and facilitate a conference call between Contractor and Agency.

During the conference call Contractor shall:

• Explain Assessment elements and testing methods;

• Review and finalize Assessment Schedule;

• Review personnel assignments (for both Contractor and Agency) for each task;

• Coordinate appropriate communication protocols for Assessment tasks;

• Clarify any testing restrictions, exclusions or concerns, to avoid adverse impacts to

Agency personnel or production systems to ensure meeting all Assessment goals.

Contractor shall provide a meeting summary to the Agency outlining all decisions and key points made during the Assessment Kick-Off Meeting. Contractor shall correct any errors or misinterpretations made in the meeting summary at the request of Agency.

Task 1.1 Deliverables:

• Project Plan due within 14* days of Assessment Kick-Off Meeting;

• Weekly status updates – these can be via email or scheduled conference call;

• Assessment Schedule due within 90* days of Assessment Kick-Off Meeting;

https://webt.puc.state.or.us/consumer/complaint.asp

• Meeting summary due within 14* days of Assessment Kick-Off Meeting.

*Note: actual number of days will be determined by the Agency and Contractor during the initial kick-off meeting

TASK 2 – Comprehensive Application Security Testing Process

Contractor shall execute the Assessment using the Level 2 OWASP ASVS requirements, which will provide a comprehensive baseline assessment of security control effectiveness and determine if the System meets the Level 2 requirements of the ASVS.

Contractor’s Assessment must also evaluate the technical controls and demonstrate the scope and severity of discovered vulnerabilities by probing them with the most up-to-date exploits.

Contractor shall make attempts to leverage vulnerabilities that at first glance may seem unrelated and insignificant into larger exploits of greater severity. Contractor shall take steps that might be taken by a real-world attacker attempting to defeat the controls.

In conjunction with the Assessment, Contractor shall incorporate the following tasks:

Task 2.1 – External Web Services & Servers

Contractor shall examine the following areas as they pertain to web services & severs:

• Do port scans of hosts show security holes created by unnecessary services running on the servers?

• Are commonly documented system security holes identified?

• Are the means of authentication consistent with levels of information sensitivity?

• Can authenticated users gain access to unauthorized information?

• Are high-level logins accessible/visible to the Internet?

• Is web software current?

• Are sensitive web directories protected from unauthorized access?

• Are the most recent patches applied to operating systems?

• Known application vulnerabilities.

• Insecure configuration settings.

• Easily guessed passwords.

• Unauthenticated/unauthorized access to data and services.

Task 2 Deliverables:

There are no tangible task deliverables from Task 2. The information produced from these tasks will be included in Task 3 deliverables.

Contractor shall compile test results and provide them for agency review and contextual feedback to ensure the accuracy of the findings. Contractor shall assess the results and then publish the results in a report and present them in an Executive Summary (see Task 3.3). The report and presentation must be designed to clearly present the findings and provide clear recommendations for remediation and informed decision making.

To provide sufficient assurance evidence in case of dispute, the Contractor shall keep detailed work papers, screenshots or movies, scripts to reliably and repeatedly exploit an issue, and electronic records of testing, such as intercepting proxy logs and associated notes, such as a cleanup list, as proofs of findings.

Task 3 – Reporting and Presentation

Task 3.1 – Weekly Technical Conferences

While performing tests and compiling the findings and vulnerability matrix, Contractor shall coordinate and attend weekly conference calls (or a weekly status update email) with the Agency to preview findings. During the conference, Consultant shall:

• Discuss a line-by-line review of findings to ensure Agency personnel understand the details of the issues found;

• Allow Agency personnel to present additional information that may affect the outcome of the findings;

• Revise findings report documents to include any information found from the review.

During the Technical Conference, Contractor shall ensure that the Agency is in agreement with the findings, their severity, and remediation steps and priorities. Contractor’s primary goals of the Technical Conference are to ensure the accuracy of each finding, and for Agency personnel to have a clear understanding of the finding and the appropriate steps to remediate each finding. As a result of the weekly Technical Conference, Contractor shall produce to the Agency the findings and vulnerability matrix that will show a rollup of all findings and vulnerabilities.

Task 3.1 Deliverables:

• Rollup of findings and vulnerability matrix for Agency review - due within 7* days of each weekly Technical Conference;

• Final weekly findings and vulnerability matrix that incorporates Agency comments -due within 14* days of receiving comments from Agency.

*Note: actual number of days will be determined by the Agency and Contractor during the initial kick-off meeting

Task 3.2 – Final Report and Agency Stakeholder Presentation

Contractor shall prepare a presentation of the report for Agency Stakeholders – consisting of executive, business, and technical staff. Contractor shall present to Agency Stakeholders a high-level overview designed to help them understand the nature of the tests performed, the effectiveness of the existing controls, and the improvements made by Agency personnel in response to the Assessment results. The report and presentation shall provide Agency Stakeholders with the information needed for Agency Stakeholders to make well-informed decisions.

Contractor shall provide an Executive Summary, which will consist of a clear, non-technical overview of the results of the Assessment, to Agency Stakeholders.

Contractor shall provide a Narrative Report which will consist of:

1. Scope of the Assessment (particularly if a key component is out of scope)

2. A detailed verification of findings, including all passed and failed tests, that aligns with the Level 2 OWASP Application Security Verification Standard.

3. Detailed and summarized written findings of vulnerabilities and descriptions of leveraged exploits.

4. Recommendations for remediation and priorities to achieve ASVS L2 Standard verification.

5. Screenshots and other appropriate visual documentation.

Task 3.2 Deliverables:

• Draft presentation of final report for Agency review due XX*;

• Final presentation, incorporating Agency comments, due within XX* days of receiving Agency comments;

• Executive Summary due XX*;

• Narrative Report due XX*;

• The findings and vulnerability matrix due XX*.

• Final Report and Agency Stakeholder presentation due XX*.

*Note: actual number of days will be determined by the Agency and Contractor during the initial kick-off meeting

Task 3.3 – Remediation and verification

Contractor’s assessment must include remediation verification. Contractor shall perform verification for all technical vulnerabilities remediated within sixty days of the Assessment completion and submitted as a complete group for remediation verification. Contractor shall perform remediation verification at least once and update the Assessment findings and vulnerability matrix with the results of the remediation verification (see Task 3.2).

Rich Palmer OPBC Procurement & Contract Specialist Oregon Public Utility Commission 201 High Street SE – Suite 100 Salem, OR 97301 Rich.Palmer@puc.oregon.gov 503-551-8745 (cell) mailto:Rich.Palmer@puc.oregon.gov

Task 3.3 – Remediation and verification