Digital Forensics G-Cloud Service Definition

Transcription

1 Digital Forensics G-Cloud Service Definition 2013 General Dynamics Information Technology Limited. All rights

2 1 GDIT Team Clients Metropolitan Police Service The General Dynamics Information Technology (GDIT) Limited Team s Digital Forensics services leverage our UK-based, accredited facilities, advanced technologies and court-certified expert witnesses to deliver a rapid IT incident response capability for any organisation. The GDIT Team has extensive experience supporting police, investigative agencies and Public Sector organisations. We continually update our tools, expertise and techniques to adapt to the evolving technological landscape. We can rapidly detect and limit the impacts of security breaches, whilst providing expert analysis and detailed recommendations that assist organisations in assuring systems, applications, information and cloud based operations are more effectively guarded from future theft, loss or misuse. Surrey Police Authority Leicestershire Trading Standards Service Includes The GDIT Team supplies ISO 9001, PRINCE2, ISO and ISO registered companies with experienced, accredited digital forensic staff. We provide a comprehensive range of digital forensic services, including analysis and investigation of computers, smart phones, tablets, satellite navigation units and other digital devices. Our IT forensic services include: Police Service of Northern Ireland US Federal Bureau of Investigation US Department of Homeland Security Seizing evidence in accordance with legal guidelines and in the most effective manner to maintain evidential weight and minimise disruption to the business Deploying specialist equipment to detect and prevent attempted system intrusions, breaches and unauthorised activity Analysing system information for evidence of breaches of security policy or laws Forensic readiness planning and reviews of organisational IT infrastructure to support forensic incident response Analysing software for malicious intent (malware) Reviewing, updating or drafting new incident handling standards or guidance Developing new forensic techniques and finding new applications for existing techniques Acting as an expert witness, where required Producing reports, metrics and dashboards Providing digital forensics and incident response service desk Data handling and validation Digital Forensics Services in conjunction with GDIT s Integrated Security Services provide a 360 view of threats and vulnerabilities through all facets of security. Please see our Integrated Security Services Catalogue entry for additional information.

3 2 Key Features and Benefits 3.9 million annual investment in staff professional development programmes delivers expert knowledge on the latest technological and cyber security trends to permit customers to better defend against attacks Formally trained forensic staff and accredited expert witnesses, certified in the latest tools and techniques for evidence gathering, to assure thorough, court-admissible digital forensic investigative results GDIT s Director of Cyber Security applies over 30 years of comprehensive Government security expertise to assure the quality and proficiency of our cyber security services Fully accredited, UK-based, security vetted (up to IL5-List X) facilities that rely on proven processes and an automated case management system to provide customers with a cost-efficient, completely secure and highly effective digital forensics service delivery model Court-accepted forensic tools and practices, along with our unique ability to develop bespoke tools that adhere to court-accepted processes, assure success even with new and emerging technologies Pricing Computer Forensic Analyst / Technician 700/ day Senior Forensic Analyst 930/ day Principal Forensic Expert 1,400/ day Our Principal Forensic Expert is an industry-recognised leader in their field capable of providing full advisory and consultancy services for the most challenging digital forensics problems. For the vast majority of customer incident response requirements, the services of the Senior Forensic Analyst and/or Computer Forensic Analyst/Technician deliver comprehensive, accurate results meeting all evidentiary requirements. For More information g-cloud@gdit.com +44 (0) General Dynamics is a 20 Billion/year, publicly listed corporation with almost 100,000 employees. We have been nominated to Forbes List of Best Managed Companies every year since the list s inception in We currently provide cyber security support to some of the largest, most sensitive and complex ICT environments in the world. Our status as a leader in the cyber security market allows us to attract and retain the best and brightest professionals in the field.

4 3 The GDIT Team offers a range of suitable pricing options, including: Fixed pricing per media type to be analysed Capped pricing per media type to be analysed Day rates that are pre-authorised using a forensic strategy process that provides an estimate of effort required to achieve the desired goals Our approach to forensic readiness planning is consultant led and includes the development of a forensic readiness plan that meets all the requirements for any organisation operating systems at Impact Level 2 or above. Our forensic readiness planning service prices start at just 2,900 based on our day rates. The GDIT Team also offers on-call digital forensic support that can be arranged with retainers from 290 per month to provide guaranteed service levels and rapid response support based on our day rates. This involves working with a client on a retained basis to provide forensic readiness consultancy as part of an overall approach to IT security incident management. The customer benefits from a guaranteed level of service and guaranteed availability of our expert services to respond to security incidents as they occur. Volume Discount- Volume discounts are available for longer-term engagements, retained services, customers seeking a recurring service on a regular basis, or large-scale efforts involving multiple consultants and will be discussed with potential customers on a case-by-case basis. Service Management The GDIT Team uses a proven service management approach that is specifically designed to fit our digital forensics market space. For each customer, we assign a dedicated Customer Relationship Manager who acts as the principle liaison between clients and our Service Delivery team, acting as the voice of the customer internally and the focal point for service reviews, meetings, and customer inquiries. The Customer Relationship Manager delivers an appropriate level of seniority and expertise for the size and complexity of the contract with the client. The GDIT Team builds customer coordination channels into the service support agreement as part of our on-boarding process and routinely maintains close coordination with our customers to ensure smooth service delivery throughout the term of the contract. These include designated communications and coordination processes for different types of incidents and forensic findings as well as for less specific customer discussions. The GDIT Team uses a comprehensive, integrated digital forensics case management system. This mature, thoroughly tested system enables efficient, comprehensive management of each submission in accordance with our standard operating procedures. We maintain a full record of each case on the system that integrates access to all exhibit details, chain of custody records, contemporaneous activity notes and interactions with exhibits right through to dispatch of exhibits and archiving of materials. The system is fully compliant with ISO and ISO standards and ensures all cases and digital forensic examinations are properly handled and tracked throughout the entire digital forensics service lifecycle.

5 4 Service Constraints The GDIT Service Delivery Model must ensure that proper legal authority exists for all work that we undertake. All services must comply with data protection, privacy, regulatory and statutory constraints within applicable jurisdictions for the incident under investigation. Service Levels The GDIT Team tailors the specifics of each Service Level Agreement (SLA) based on the specifics of each customer engagement. We can provide a range of appropriate service levels depending upon the client s requirements, logistical constraints and the technical feasibility of the requirements. Standard features of our SLAs include: Staffing: We warranty that all services will be performed by appropriately qualified and experienced staff. All staff are supervised by experienced and highly qualified seniors and managers, and all work is reviewed in line with our ISO 9001 standard operating procedures. Staff are tested for competence in each function they perform in line with the requirements for ISO We use only properly trained and certified staff with the proper technical knowledge of the technologies being examined and the tools being used. Service Hours: Our main laboratory operating hours are from 08:00 until 18:00 each weekday. We have the ability to provide 24/7 service using an emergency on-call, fully trained forensic analyst. Service Levels: For volume forensic analysis contracts, we typically provide service completion levels of 7, 14, 21 and 28 days for forensic analysis services, measured from the date of evidence collection. We can also provide more urgent services as required, including a 24 hour and 48 hour turnaround service. Financial Recompense Model for Not Meeting Service Levels The GDIT Team has assisted many organisations with large volumes of case work, operating to the most demanding timescales. We have handled over 3,000 cases, involving many thousands of digital forensic examinations and have never failed to meet our service level targets with any contractual clients. Performance is measured against defined service level warranties which are included in the SLAs. The GDIT Team s sole and exclusive obligation and Customer sole and exclusive remedy for failure to meet the specified service levels shall be limited to the payment of Service Credit(s). The definition and payable amount of a Service Credit is also contained in the SLA. Specific recompense models can be negotiated during the initial customer engagement and formalised as part of our on-boarding process. Ordering and Invoice Process GDIT will require an authorised Call-Off Agreement or work order from the customer covering the full value of the services required. GDIT will invoice as agreed in the Call-Off Agreement. This may be on the achievement of key deliverables, at regular intervals or stages in the service or upon completion of the service to be determined with the customer on a service by service basis. All invoices will be issued in electronic or paper format to the address designated by the customer. Payment of invoices must be made within 30 days of issue and by BACS.

6 5 Termination Terms Termination clauses and terms exist for all of our services and are fully described in the Supplier Terms for Digital Forensics. pdf document. These include termination fees where the customer terminates services for their convenience prior to the end of the complete term of the contract. There is no cost for normal termination of services at the end of the contracted period. Any normal activities associated with termination as part of our standard off-boarding process do not incur any additional fees. Customer Responsibilities Customers are responsible for proper evidence handling and preservation techniques when an incident is first discovered. This is essential in order to permit digital forensics experts to properly gather and extract that evidence in line with ACPO and other guidelines where digital forensics are required to support criminal or civil actions. Optional training is available on proper IT forensic evidence collection and handling techniques that may assist organisations in enhancing their incident handling, investigative and response processes. Data Storage and Processing Locations All our digital forensics facilities are located within the United Kingdom and are court-approved for evidence handling and storage. All evidence processing is done using appropriately vetted and experienced UK citizens.

7 Cottons Centre Cottons Lane London, SE1 2QG Tel. +44 (0)