Q and A Log_Tatanka_2020.12.07.pdf

PDF 3 MB Posted Dec 7, 2020

Attached to: Virtual Threat Environment
Solicitation number: W91243-21-Q-JE02
Issued by: Department of the Army Nebraska Army National Guard

View the file

Other files

File	Type	Posted
Q and A Log_Tatanka_2020.12.02.pdf	PDF	Dec 2, 2020
Q and A Log_Tatanka_2020.11.24.pdf	PDF	Nov 24, 2020
Combined Sypnopsis_Final_updated 2020.11.24.pdf	PDF	Nov 24, 2020
WD_2015-5351_2020.06.04.pdf	PDF	Nov 20, 2020
PWS_VTE_2020.11.16.pdf	PDF	Nov 20, 2020
Combined Sypnopsis_Final.pdf	PDF	Nov 20, 2020
52.204-24 Representation.docx	DOCX document	Nov 20, 2020

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

NOVEMBER 24, 2020

NEBRASKA NATIONAL GUARD

of Q&A Log

NEBRASKA NATIONAL GUARD

Contracting Office Joint Forces Headquarters Suite 2200

PROJECT TITLE

CONTRACT NUMBER

POINT OF CONTRACT (POC)

PROJECT TITLE

AWARD DATE

CONTRACT NUMBER

DELIVERY DATE

CONTRACTOR (KTR)

POINT OF CONTRACT (POC)

LOG QUESTION(S)

QUESTION #

Response #

KTR

POC

11.0.0.20130303.1.892433.887364

CurrentPage:

PageCount:

AddQ:

TextField1: Cyber Tatanka

TextField1: Jarod Epp

TextField1: The file “Combined Sypnopsis_Final.pdf” contains more that one effort. Is the last page of the file applicable to the VTE acquisition?

TextField1: The page in question was deleted. It did not pertain to this acquisition.

TextField1: When are proposals due?

TextField1: They are due on date listed in Contract Opportunities. Right now, the due date is 12/11/2020.

TextField1: How are proposals to be submitted? Is email the preferred method?

TextField1: Email is the preferred method.

TextField1: What proposal format (e.g. PDF, Word) is acceptable? Do the volumes have page limits?

TextField1: A common format is acceptable, such as PDF, Word, excel. There are no limits.

TextField1: What is the estimated award date?

TextField1: December 31, 2020

TextField1: Should Price, Technical, and Past Performance be prepared as separate volumes?

TextField1: They do not have to be separate volumes but do need to be labeled/titled.

TextField1: Can Price be built in an excel sheet?

TextField1: Yes.

TextField1: Is there a page limit that we are constraint to for Price, Technical, and Past Performance?

TextField1: No.

TextField1: Will the final response be sent to your email?

TextField1: Email is the best method.

TextField1: Is the vendor responsible for acting as exercise control?

TextField1: No. Exercise control will be headed up by NEARNG and partner institutions. Vendor will integrate Red Team Operations with exercise controllers.

TextField1: Is the vendor responsible for creating the exercise schedule of events?

TextField1: Exercise control will create exercise schedule. Vendor will be involved in the creation from the Red Team stand point and because they will create the vignettes/attacks that will be actioned during the exercise.

TextField1: Will the different locations be fitted with adequate internet service connections?

TextField1: Yes. Venue is upgrading connection to two concurrent 10Gbs connection and they will be available for the exercise.

TextField1: Cloud based environment that includes an IT environment defined by the exercise planners.

Please define the "contractor" and the "exercise planner" and the "vendor"

TextField1: "Contractor and vendor are the same. This would be the organization providing the requested services/products. Exercise Planners are the military personnel building/planning/conducting the exercise. They will be the main points of contact for the vendor throughout the life of the contract."

TextField1: Clients, servers, routers, firewalls, and up to three different “sites”. Are the three "sites" referring to physical sites or logical sites? Technically there can be 3 logical sites/clusters in the same physical site.

TextField1: Referring to logical sites here. We would like to see separate LANS/VLANS that are "physically separated" according to the topology across the WAN.

TextField1: All tools used by the trainees will be included in the range (Kibana, Bro, NMAP, Logstash, etc). What paramaters are expected in the range? Ie., AWS environment or vSphere?

TextField1: This is up to the vendor, but we need vendor to host the VTE in some cloud environment that can be accessed anywhere with internet connectivity. The tools are going to be located on VM's within the team's individual enclave. These VM's (AKA landing zones) will allow the user to interact with thier Enclave's other VM systems, through the tools on those landing zone VM's.

TextField1: VTE must produce enough log data to simulate a realistic enterprise IT environment. What specific log data is being requested?

TextField1: Log data would be akin to normal traffic flow that you would see in an enterprise network. The idea is to replicate traffic flow in scale to obscure Red Team activity during the vingettes.

TextField1: VTE will be accessed through a web based Graphic User Interface (GUI). Who will be providing the GUI front end? What is scope?

TextField1: Vendor will provide the GUI front end. Scope includes separate landing pages for each team's enclave. The Landing pages should provide a means to access the VM's console (Similar to Vsphere Web Client, or actual Vsphere or other Landing Page capability in the cloud environment that the vendor can cusotmize to meet the requirement). Should have permissions/access controls to ensure that Blue Team is Seperate from Red Team, and Blue teams remain in their assigned enclave. (Red Team would have probably need some VM's to access the VTE virtual network in order to conduct attacks within the VTE).

TextField1: "Cloud environment will be accessed from the classrooms by exercise participants via aVirtual Private Network (VPN)." Who is expected to provide the VPN network?

TextField1: VPN should be provided through the Cloud Environment Infrastructure (similar to AWS VPN), such that BYOD devices can connect to the VTE (Cloud Environment) via a VPN client. VPN services will be provided and supported by vendor.

TextField1: Vendor will provide an electronic ticket submission application that will allow the "reporting" of the cyber incidents identified by Blue Teams, to include unloadable artifacts and other miscellaneous files as needed to demonstrate the threat they found. This in turn will be utilized by the Red Team to validate actions on the objectives. Can you define what "reporting" means? Ie., User interaction? Automation? Would automated information gathering (Winlogbeats) meeting this requirement?

TextField1: The reporting will be manually entered by Blue Team participants. But if able, could mapp to MITRE ATT&CK, potentially using the TRAM web-based tool. And teams would manually upload "artifacts" files, and provide comments that the Red Team will use to assess/evaluate on their performance and ability to identify the threats. Any "automation" of this would probably just be notification to Red Team that blue Team has submitted a ticket.

TextField1: Vendor will provide a Common Operational Picture view for the main White Cell that will incorporate all the scenarios and injects real time to ensure Situation Awareness. This should also include technical VTE performance and metrics to ensure situational awareness on infrastructure resources and assist with identifying any issues of the VTE. What is a Common Operational Picture ?

TextField1: A common operational picture depicts real-time/near-real time situational information through dashboards, heads up related display metrics. Should provide higher level overview of critical elements of a mission. In this context, we would like a COP (Common Operational Picture) that provides metrics on VTE current status, performance counters, status for each enclave, current scenario/injects being executed, stages of execution, etc. This COP may require the vendor working with the White Cell Lead to modify/adjust during the design to ensure COP meets the requirements.

TextField1: Vendor will assign one dedicated Red Team player for each Blue Team (11 teams) to provide continuity throughout the exercise. Are there 10 teams or 11 teams? There was a reference to 10 teams in section 4.1.7

TextField1: 11 teams in total.

TextField1: Red Team will initiate all cyber injects and work with assigned blue team to track incidents, validate blue team discovery and actions taken on each inject. Please define the red team and blue team tools that are desired? I.e., passive vs active

TextField1: A Working group has been established to review these tools, but tools can't be fully decided upon until after ability to talk with vendor about what tools they could provide. Support would just be basic installation on either Windows or Linux OS, but would not include support for configuring or using/tuning tools. Training will be identified for tool use and configuration and will be the responsibility of a different team to provide support past the basic install of the tools. Red Team is whatever tools the vendor decides to use to implement/execute injects.

TextField1: "Vendor will build all cyber injects (incident simulations) and provide at least oneperson to act as opposing forces (Red Team) for each VTE. They will supportinjects that are conducive to realistic threats of malware, social engineering, andother methods as dictated by the VTE director." Is it one VTE per blue team?

TextField1: The VTE (Virtual Training Environment, aka Virtual Threat Environment) will consist of multiple "enclaves", each team will have their own enclave, and each enclave can have identical topology/configurations (aka sandbox). The VTE will have "pre-staged/pre-scripted" injects. There should be a collection of injects that meet a scenario objective (there is currently 4 different scenarios in planning). The VTE should support multiple instances of scenarios, but only one scenario per team/enclave at a time.

TextField1: "Red Team will participate in scheduled exercise After Action Review at thecompletion of the exercise." Does this need to be automatic or can it be manually generated?

TextField1: Manual creation is fine. Working group has been established to assist Red Team with developing AAR/Back briefing templates.

TextField1: "Cyber injects will be grouped based on the different types of scenarios (vignettes)that will be coordinated by the white cell and VTE director." Please define white cell.

TextField1: White Cell is the Execution Control Cell of the Exercise. It is the team incharge of all other teams to ensure exercise flow control and quality assurance of the range effects.

TextField1: Do you have a list of preferred tools that should be installed for the blue team (vulnerability tools, scanning tools, logging analysis, etc)

TextField1: Do you have a preferred of networking infrastructure in the VTE- Cisco, etc.

TextField1: Simulated network components preferred would be cisco (cisco router/switch, voip, asa, etc.)

TextField1: Do you have a preferred firewall product?

TextField1: Cisco ASA

TextField1: Are there specific technologies or services you want to have available at the sites, or the DMZ in the VTE?

TextField1: VTE should be hosted in a cloud environment, no specific hardware is specified for the VTE backbone itself. Local site technologies will be BYOD, and anything the vendor needs to bring to support the VTE on-site. DMZ services should all be virtualized, and replicated for each instance of the Blue Teams' Enclave.

TextField1: Do you want a pre blue team budget or total budget for 10 teams?

TextField1: We need a total budget for all supply and services needed to support the VTE for all 11 teams.

TextField1: Will network access be provided at the location for the onsite?

TextField1: Yes.

TextField1: Do we know the location for the onsite (for estimating hotel costs)?

TextField1: Location will be in Lincoln, NE 68521.

TextField1: Are there any specific types of security incidents you want included? Phishing exploit, general scan, downloaded malware with C&C, ransomware, specific server or infrastructure vulnerability, default passwords, credential stuffing.....

TextField1: All types listed within the MITRE ATT&CK Matrix for Enterprise at a minimum, and any type of customization and/or adjustment of the incident as nessessary (e.g. less/more loud of a attack, etc.)

TextField1: Do you want a total project price or some fixed costs (setup, travel) and hourly for the onsite on how many teams, etc.

TextField1: Pricing needs to be in the format of the Combined Synopsis. Two (2) CLINs:

CLIN 0001 - Provide cloud based VTE.

CLIN 0002 - Provide VTE Training.

TextField1: In section 2.0.3 Facilities/Land, it says that the Government will not provide any facilities associated with the performance of this contract.

In section 4.1.9, it says that the Cloud environment will be accessed from the classrooms by exercise participants via a Virtual Private Network (VPN).

Question 1: Will the contractor need to provide the classrooms and/or other facilities in Nebraska? Or will we only need to provide the cloud environment for trainees to access the VTE remotely in classrooms that the trainees already have?

TextField1: 2.0.3 refers to the Government will not provide facilities to create VTE.

4.1.9 refers to the classrooms that the Government will provide to the trainees.

Contractor will NOT need to provide classrooms and/or facilities in Nebraska. Contractor will need to provide the cloud environment for trainees to access the VTE remotely in the classrooms provide by the Government.

TextField8: W91243-21-Q-JE02

DateField1:

TextField7:

DateField2:

TextField5: 1.

TextField5: 2.

TextField5: 3.

TextField5: 4.

TextField5: 5.

TextField5: 6.

TextField5: 7.

TextField5: 8.

TextField5: 9.

TextField5: 10.

TextField5: 11.

TextField5: 12.

TextField5: 13.

TextField5: 14.

TextField5: 15.

TextField5: 16.

TextField5: 17.

TextField5: 18.

TextField5: 19.

TextField5: 20.

TextField5: 21.

TextField5: 22.

TextField5: 23.

TextField5: 24.

TextField5: 25.

TextField5: 26.

TextField5: 27.

TextField5: 28.

TextField5: 29.

TextField5: 30.

TextField5: 31.

TextField5: 32.

TextField5: 33.

TextField5: 34.

TextField5: 35.

TextField6: 1.

DateTimeField1:

POCDATE:

AddR:

File details come from the government source that posted it. Updated Dec 7, 2020.