Specs - Network Assemt. Testing Specs 4.24.docx
DOCX document 29 KB Posted
- Solicitation number
- 24-691ISAC-GENCO-B-42825
- Issued by
- Lake County, Illinois
About this file
The document contains specifications and requirements for a Network Security Assessment and Penetration Testing contract opportunity issued by the Illinois Student Assistance Commission (ISAC). ISAC is seeking a qualified IT vendor/consultant to perform the network security assessment, including external and internal network assessments, firewall and IDS/IPS reviews, social engineering testing, and database security assessment, as well as penetration testing on external and web applications. The vendor must have a minimum of 5 years of experience in cybersecurity, a team of at least 6 members with relevant expertise, and documentation of at least 3 similar assignments completed within the past 2 years. The assessment and testing are expected to be completed within a 3-4 week period starting in early May 2024. Detailed network information, such as the number of endpoints, servers, and applications, is provided to help bidders understand the scope of the project.
Regarding pricing terms, the vendor must provide an hourly rate and an estimated number of hours to complete the work. No price increases will be accepted, and the agency reserves the right to reject all offers or portions thereof. The vendor may be required to provide all security tools as part of the service, as ISAC does not have access to commercial security tools.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Taxpayer ID page.docx | DOCX document | |
| standard-terms-and-conditions~12.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Illinois Student Assistance Commission Specs for Network Security Assessment and Penetration Testing
Ref #: GS-2024-251
Submission Deadline: See "Bid Opening Date" in Bidbuy for submission due date
| AGENCY: | Illinois Student Assistance Commission ADDRESS: 1755 Lake Cook Road | |
| CITY: | Deerfield, IL 60015 | |
| CONTACT: | Bianca Morales | |
| PHONE: | 847-831-6748 | |
| EMAIL: | Bianca.Morales@illinois.gov |
Specifications and Requirements
The Illinois Student Assistance Commission (ISAC) is seeking a qualified Information Technology vendor /consultant to perform the following Network Security Assessment and Penetration Tests for a 3-4 week period, beginning in early May 2024. Resume(s) and documentation of IT audit/penetration testing assignments must be attached in BidBuy to bid # 24-691ISAC-GENCO-B-42825.
Network Security Assessment:
· External Network Assessment
· Internal Network Assessment
· Network Architecture and configuration review
· Firewall security review
· IDS/IPS security review
· Social engineering testing
· Database security assessment
· Operating system scanning
· Active directory review
Penetration tests:
· External Penetration tests
· Web application scanning and testing
Risk Assessment:
· Conduct a risk assessment based on National Institute of Standards and Technology (NIST) risk management framework. List of applications will be provided.
The vendor/consultant must have all the following qualifications:
1. An established business with a minimum of 5 years of continuous operation in the field of cyber security, technology implementation, strategic planning, and organizational optimization services.
2. A team of at least 6 members to be assigned to the project, each with experience performing information security reviews, including at least 2 years performing IT network security assessment and external penetration tests. Please attach a resume for each staff member in BidBuy.
3. A Project Director with at least a Bachelor’s degree (Master’s preferred) in Computer Science and a certification in information systems audits such as Certified Information System Auditor (CISA), Certified Ethical Hacker etc. highly preferred. Please attach a resume in BidBuy.
4. Three (3) assignments completed within the past 2 years that include performing the activities listed under Network Security Assessment and Penetration Tests above.
Submit documentation for each assignment, in Bidbuy, containing the following information*:
· Company name
· Dates of assignment
· A detail description of the responsibilities performed during the assignment, including assessments type and test performed.
· Audit findings identified during the assignment.
· A company contact name, email and telephone number.
* If non-disclosure agreements do not allow for divulging specific client information/name, please provide the company’s general industry and description in lieu of the specific name.
Detailed Network Information
| 1) What is the location for this project? Can the work be done remotely? |
| Our main office is in Deerfield. The person does not have to be here for the entire duration. A significant portion of the work can be done remotely (access can be provided thru VPN if required and approved). Some on-site work with the ISAC team |
may be needed to discuss network topography and discovery.
| 2) What is the specific environment/needs for the assessment/testing? |
| Environments to be Penetration tested – All public facing transaction processing platforms (web based). Examples are GAP Access (https://isacportal.isac.org), Student Portal |
(https://studentportal.isac.orgt) , , www.isac.org and more.
| a) How many end points? |
| VM’s - 135 |
VM’s in DMZ – 10 Desktops/Laptops – 275 Web Domains – 58 (mostly static) Web transaction processing domains (all HTTPS) – 8
b) External Network Assessment – number of external IPv4/IPv6 addresses that would need to be tested/scanned?
IPv4 only – Range includes 128 IP’s
| c) | Internal Network Assessment – number of internal IPv4/IPv6 addresses that would need to be tested/scanned? |
| IPv4/IPv6 (enabled by default) - 500 |
| d) How many servers are in the network? |
| Physical servers - 17 |
| e) | Who is the network vendor and what applications are in the landscape of this request? |
| CISCO is the network equipment vendor. |
The applications include mainframe, client/server and web applications.
| f) | Network Architecture and configuration review - Can we get details about Network Infrastructure? |
| Number of locations - 3 Number of devices - 21 |
Make/model of each device - CISCO
g) Firewall security review – how many firewall and model?
Number of firewalls - 5 Make/model – CISCO
| h) IDS/IPS architecture and configuration review – make/model, number of sensors, instances, events per second? |
| Make/model of IPS’s - CISCO Number sensors - 2 |
Number instances 1 Number of events per second -Plan per the configuration specified above.
| i) | Social Engineering Testing – How many users use agency phone or email? |
| Number of users that use agency Phone - 275 Number of users that use agency Email - 325 |
j) Database Security Assessment – Is this centered on Data Discovery or DB Architecture/Connectivity Security?
Centered on Both
| k) What is the type/size of databases? |
| DB2, IMS, SQL server, MySQL (size varies) |
| l) | Operating system scanning – for Vulnerability scanning, please provide details on the number of Internal IPs. |
| See question and answer 2 c, above. |
| m) AD Domain Review – how many domains, OUs, Users, Groups? | ||
| Domains - 1 | ||
| OUs | - | 15 |
| Users - | 500 | |
| Groups - | 3000 |
| n) Penetration tests – how many web applications? |
| External – 15 |
| o) Is code review required? |
| On a very small sample set. If this is going to be manual, it can be excluded. |
| p) Is a scan and manual vulnerability identification sufficient or do you require manual verification/exploitation of vulnerabilities? |
| A scan and manual vulnerability identification are sufficient. |
| 3) | Does ISAC have access to commercial security tools (such as IBM AppScan) or will the vendor be expected to provide all tools as part of the service? |
| The vendor must provide the security tools. |
| 4) | Most penetration testers are constrained by non-disclosure agreements from divulging specific client names, although they can provide general industry and company description is that sufficient? |
| If specific client information/name cannot be disclosed, then please provide the company’s general industry and description in lieu of the specific name. |
| 5) | The areas you outline for scope are broad and would likely involve more than one resource for the engagement. What number of consultants are you looking for? |
| Please refer to item number 2 of vendor/consultant qualifications |
| 6) | How many resumes can we submit? |
| The number of resumes should be equal to the number of consultants assigned to complete the project. |
7) What is the duration of the project?
a) Is this expected to be a 3- or 6-month contract, as the size of the network is not indicated?
b) Is this a full or part time position? Are the hours flexible?
c) When is the expected start date?
It is expected to take approximately 3-4 weeks to complete the project. This is not a full or part time position; it is a contract for completion of the Network Security Assessment and External Penetration Testing. The expected start date is such that the Assessment and Testing Results Report can be completed prior to end of May, 2024.
| 8) Is a range acceptable for an estimate (to be refined through scope clarification and discovery)? |
| No, as the scope has been clarified, an actual hourly rate and an estimated number of hours are required. |
| 9) Database Security Assessment: Count of Databases to be assessed? |
| Under 10. List will be provided at the time of engagement. |
| 10) Social Engineering: Do you want only email phishing to be performed? |
| No, please include other methods like voice and smishing where possible. |
| 11) Web Application VAPT: What type of assessment is required (Credentialed/Non Credentialed)? |
| Both |
| 12) Internal and External VA: What type of scanning is required (Credentialed/Non Credentialed)? |
| Both |
Notes to Vendor: All Quoted prices must be valid for term of contract. All prices must include shipping and handling charges. No price increase will be accepted. In the event of a price decrease, the agency is guaranteed to receive the lowest price. We reserve the right to reject all offers; to reject individual offers for failure to meet any requirement; to award based on lowest price by item, part or portion of an item, group of items, or total; to waive minor defects; and to modify quantities prior to ordering. Vendor may attach separate page describing his proposal for equipment or services.
File details come from the government source that posted it. Updated .