SOW_-_OCOE_course.docx

STATEMENT OF WORK

FOR

OFFENSIVE CYBER OPERATIONS ESSENTIALS COURSE

DELAWARE AIR NATIONAL GUARD

10 JANUARY 2016

SECTION ONE

General: Offensive Cyberspace Operations Essential (OCOE).

Introduction: Instruction for On-Site OCOE training and assessment, $9,995 per student.

Background. Cyberspace training is imperative to furthering our national and state mission in support of USCYBERCOM and the US Air Force. NMT operators require intensive training for future cyberspace operations in accordance with USCYBERCOM training requirements. The purpose of this course is to prepare future cyberspace operators and mission team members to become experts in our mission space and be more successful in the cyber domain. The OCOE course provides proprietary courseware only available to personnel assigned to the cyberspace domain that includes 4 modules: Windows; Linux; Networking; Tradecraft and Exploitation. At the culmination of the training there is a capstone exercise and performance feedback to the trainee and leadership.

Scope. The course must provide training for 6 ANG Students and allow 2 Auditors to attend; facilitated by expert instructors focusing on student performance in four major topics: Windows, Linux, Networking, and Tradecraft & Exploitation. Every course module will require instruction through the use of numerous hands-on exercises designed to reinforce the practical application and employment of the most fundamental exploitation tactics and techniques used by all cyber operators. Students will need to learn by following along with the instructor and completing complex exercises designed to force students to think outside of the box and act within a dynamic environment. As students learn the most essential exploitation concepts, they will be simultaneously challenged to develop and apply their critical thinking skills to produce innovative solutions to complex problems. Additionally, students will need to be taught advanced techniques and procedures to hide their tracks and remain hidden from the adversary. Students will develop and demonstrate their tradecraft throughout the course by achieving cyber objectives within live virtual environments. The student will require an assessment exam on Day 1 and Day 35 of the course to show retention and learning of information. A report will be generated by the course provider to the Chief of Training (COT), Lt Col Brad E. Sams (166 NWS/IOR, DE ANG) on each students learning progression throughout the course. The report must be provided on a weekly basis and be no more than a paragraph detailing the students’ progress in each module. The report must be emailed to the COT prior to the start of the next module and a final report card must be submitted within 14 days from the end of the course.

The course must follow the specified path.

(U) Module 1 consists of cyberspace operator Window fundamentals and includes Windows Operating Systems; command line interface and batch scripting; drivers and services; file systems and registries; boot process and forensics; logging and cleaning; users and groups; active directory; ports and protocols; and system surveying.

(U) Module 2 focuses on cyberspace operator Linux fundamentals and includes Linux Operating Systems; command line interface; scripting; Daemon environments; boot process; run levels; forensics; log files and cleaning; remote logging; authentication; tradecraft and system surveying.

(U) Module 3 provides the network fundamentals which include network devices; protocol encapsulation; packet capture and analysis; and types of tunneling.

(U) Module 4 applies the advanced concepts learned in previous modules to facilitate the culmination of the training by providing instruction on exploitation; scanning and enumeration; and other exploitation techniques. Additionally, this module provides a culmination exercise where the student will have the opportunity to reinforce their learning through a practical exercise.

SECTION TWO

Place of Performance/Hours of Operation: Contractor will work at our premises, located at 2701 Eastern BLVD Baltimore MD from 7am to 5pm, Monday through Friday.

Period of Performance: This class will be held 7 March – 8 April 2016.

Quality Control: The course must be approved or under review by USCYBERCOM to meet CMF work role requirements. Documentation must be provided to show that USCYBERCOM has reviewed or is in the process of reviewing the courseware. Instructor must be an expert in topics presented, a minimum of 3 years cyberspace operations experience, and must have been certified by DoD or NSA as a cyberspace operator or equivalent as deemed by the customer. The contractor must furnish resumes of the instructors to verify level of expertise. Request the contractor provide up to 5 references in past 3 years from other DoD units they provided the same type of training.

Shipping Instructions: Pre-shipped training materials must be referenced by invoice. Please deliver all items only Tuesday through Friday, 6:30am until 5:00pm. Please provide tracking number to COT. Items must arrive NLT 1 March 2016. If necessary the shipping address is: 2602 Spruance Drive, New Castle, DE 19720.

Contractor Furnished Items: Instruction materials, course-ware, IT Equipment to include laptops, hotspot (internet connection), and all software and hardware required to facilitate the course execution; Day 1/ Day 35 assessment test; weekly report card for each student showing there progression throughout the course.