Introduction and Background

Transcription

1 Request for Bid Network Security Assessment March 28, 2016 Introduction and Background Purpose of the Request for Proposal The Library Network operates a wide area telecommunications network for 70 public library buildings within the Metro Detroit area. Data circuits with port speeds ranging from 10mb to 250mb using AT&T Switched Ethernet fiber are currently provided by AT&T. Merit Network is the ISP. Each library goes direct out to the internet rather come back to TLN for internet access. The current wide-area-network utilizes a fiber backbone for supporting TCP/IP based applications for shared library resources. The telecommunications equipment currently in the libraries includes TLN owned and managed Cisco routers model#isr4331-ax/k9 and Cisco router models 2821 and TLN houses several servers. The servers are Solaris and Windows-based. The virtual server software in use is Hyper-V for some of the servers. These services are maintained by TLN staff. TLN operates a library database system (SirsiDynix Symphony) that provides application software supporting library functions for 51 member libraries. This system houses bibliographic and (legally protected) patron data. Libraries access the SirsiDynix Enterprise online catalog through the cloud. TLN is interested in conducting a security assessment that will allow it to: Gain a better understanding of potential network vulnerabilities that may be visible from the Internet. Determine if the managed network equipment is secure. Evaluate the security associated with public self-service applications that are used by TLN s member libraries and their patrons. TLN is seeking to identify and select an outside independent organization to perform the activities listed above. The remainder of this document provides additional information that will allow a service provider to understand the scope of the effort and develop a proposal in the format desired by The Library Network.

2 Page 2 Administrative Any questions concerning this RFP, technical specifications or request for a site visit must be directed to: Angie Michelini, Technology Services Manager x144, amichelini@tln.lib.mi.us Due Dates Formalized bid due: April 27, 2016 by 4pm, electronic submission preferred. Late entries will not be accepted. Schedule of Events 1. RFP Distribution to Vendors 3/29/ Vendors Bid Meeting to address questions 4/6/ Responses to Vendors questions due 4/11/ Final Call for Questions Due 4/14/ Proposal Due Date 4/27/ Target Date for Final Vendor Selection 5/27/ Anticipated commencement date of work 7/11/2016 Proposal Submission Award of the contract resulting from this RFP will be based upon the most responsive Vendor whose offer will be the most advantageous to TLN in terms of cost, functionality and other factors as specified elsewhere in this RFP. TLN reserves the right to: Reject any or all offers and discontinue this RFP process without obligation or liability to any potential Vendor Accept other than the lowest priced offer Award a contract on the basis of initial offers received, without discussions or requests for best and final offers Award more than one contract Vendor s proposal shall be submitted in several parts as set forth below. The Vendor will confine its submission to those matters sufficient to definite its proposal and to provide an adequate basis for TLN s evaluation of the Vendor s proposal.

3 Page 3 The submitted proposals are suggested to include each of the following sections: 1. Executive Summary 2. Approach and Methodology 3. Project Deliverables 4. Project Management Approach 5. Detailed and Itemized Pricing 6. Appendix A: References 7. Appendix B: Project Team Staffing 8. Appendix C: Company Overview The detailed requirements for each of the above-mentioned sections are outlined below. Detailed Response Requirements Executive Summary This section will present a high-level synopsis of the Vendor s responses to the RFP. The Executive Summary should be a brief overview of the engagement and should identify the main features and benefits of the proposed work. Scope, Approach and Technology Include detailed testing procedures and technical expertise by phase. This section should include a description of each major type of work being requested by the vendor. All information that is provided will be held in strict confidence. The proposal should reflect each of the sections listed below. Assessment Scope Phase I I. Internal Network Vulnerability Assessment a) Examination of the security on Windows servers, Solaris servers and databases of the internal network b) Examination of the security on network devices including the following in target space: Number of routers: 0 Number of managed switches: 13 (Cisco products) Number of firewalls: 2 (1 for redundancy, failover) Number of physical servers for technology services: 6 Number of physical servers for library services: 3 Number of virtual servers: 13 c) Examination of security for VLANs d) Examination of security for VoIP services e) Examination of unencrypted services f) Examination of patching services g) Examination of account controls h) Examination of 2 library routers i) Examination of 2 library firewalls

4 Page 4 II. External Network Vulnerability Assessment a) Examination of the internet-facing hosts and services Number of live hosts: 7 b) Examination of unencrypted services c) Examination of patching services d) Examination of account controls III. Wireless Network Vulnerability Assessment a) Examination of the security of wireless networks Cisco Meraki 1 Access Point b) Examination of network segmentation c) Examination of wireless encryption protocols IV. Web Application Vulnerability Assessment a) Examination of the security of web applications Assessment Scope Phase II Penetration Testing Penetration testing would commence after TLN staff have addressed the recommendations from the vulnerability testing. Approximately 30 days after the report is submitted to TLN. Scope of Work Deliverables At the conclusion of the assessment, TLN requires written documentation of the approach, findings and recommendations associated with this project. A formal presentation of the findings and recommendations to senior management may also be required. The documentation should consist of the following: Detailed Technical Report A document developed for the use of TLN s technical staff which discusses: the methodology employed, positive security aspects identified, detailed technical vulnerability findings, an assignment of a risk rating for each vulnerability, supporting detailed exhibits for vulnerabilities when appropriate and detailed technical remediation steps. Executive Summary Report A document developed to summarize the scope, approach, findings and recommendations in a manner suitable for senior management.

5 Page 5 Deliverables Includes descriptions of the types of reports used to summarize and provide detailed information on security risk, vulnerabilities, and the necessary countermeasures and recommended corrective actions. Include sample reports as attachments to the proposal to provide an example of the types of reports that will be provided for this engagement. A 30 day follow-up visit after Phase I and before Phase II by your company representative will be included as a deliverable of this audit to ensure that all recommended corrective action in the management document has been addressed. Project Management Approach Include the method and approach used to manage the overall project and client correspondence. Briefly describe how the engagement proceeds from beginning to end. Detailed and Itemized Pricing Include a fee breakdown by project phase and estimates of travel expenses. In addition, please include itemized pricing for each part of Phase I and Phase II. It s possible that due to budget constraints, TLN may only be able to do a partial assessment during this fiscal year and during the next fiscal year do another assessment for remaining items that were not approved in this fiscal year. Appendix: References Provide three current references, preferably from education, nonprofit or library sectors for which you have performed similar work. Appendix: Project Team Staffing Include biographies and relevant experience of key staff and management personnel. Describe the qualifications and relevant experience of the types of staff that would be assigned to this project by providing biographies for those staff members. Describe bonding process and coverage levels of employees. Affirm that no employees working on the engagement have ever been convicted of a felony. Appendix: Company Overview Provide the following for your Company: Official registered name (Corporate, D.B.A., Partnership, etc.), Dun & Bradstreet number, Primary and Secondary SIC numbers, address, main telephone number, toll-free number and fax number. Key contact name, title, address (if different from above address), direct telephone and fax numbers. Person authorized to contractually bind the organization for any proposal against this RFP. Brief history, including year established and number of years your company has been offering Information Security Testing.

6 Page 6 Evaluation Factors for Award Criteria Any award to be made pursuant to this RFP will be based upon the proposal with appropriate consideration given to operational, technical, cost and management requirements. Evaluation of offers will be based upon the Vendor s responsiveness to the RFP and the total price quoted for all items covered by the RFP. The following elements will be the primary considerations in evaluating all submitted proposals and in the selection of a Vendor: 1. Completion of all required responses in the correct format. 2. The extent to which the Vendor s proposed solution fulfills TLN s stated requirements as set out in this RFP. 3. An assessment of the Vendor s ability to deliver the indicated service in accordance with the specifications set out in this RFP. 4. The Vendor s stability, experiences, and record of past performance in delivering such services. 5. Availability of sufficient high quality Vendor personnel with the required skills and experience for the specific approach proposed. 6. Overall cost of Vendor s proposal. TLN may, at their discretion and without explanation to the prospective Vendors, at any time choose to discontinue this RFP without obligation to prospective Vendors. Benefit A benefit for the vendor winning the bid award is possible additional business with providing security assessments for the public libraries in the TLN five county region.