Florida Department of Management Services Cyber-Security Assessment, Remediation, and Identity Protection, Monitoring, and Restoration Services RFI

Transcription

1 Florida Department of Management Services Cyber-Security Assessment, Remediation, and Identity Protection, Monitoring, and Restoration Services RFI

2 August 25, 2015 Re: Cyber-Security Assessment, Remediation, and Identity Protection, Monitoring, and Restoration Services Mr. Joel Atkinson: Thank you for the opportunity to submit an RFI response for Cyber-Security Assessment, Remediation, and Identity Protection, Monitoring, and Restoration Services. DH Technologies is pleased to present Florida Department of Management Services with this proposal for a Cyber-Security Assessment, Remediation, and Identity Protection, Monitoring, and Restoration Services. We are prepared to leverage our past performance with several Department of Defense accounts. Our services team includes Justin Henderson who is 1 of 13 people worldwide to achieve Offense and Defense SANS Cyber Guardian certification, and vulnerability specialists to develop a thorough assessment. Why choose DH Technologies as a solution partner for this effort? You can be assured of a fully compliant, best-practice integration methodology Leverage our successful implementation experience with data center and virtualization solutions ranging from 100 to 10,000+ users at federal agencies. Be assured that all work will be completed with 100% satisfaction Employ a team of industry-recognized virtualization experts with numerous certifications from top vendors including GIAC Penetration Tester, Computer Hacking Forensics Investigator, Certified Ethical Hacker certifications. Be assured of a fully compliant solution, our team has deployed multiple DoD and NIST compliant solutions. We are a HUBZone-certified small business, and we can assist with meeting small business set-aside goals for your agency. Our unique ability to analyze business requirements and leverage the right technology to address tactical and strategic goals of an organization has been a key differentiator for DH Technologies, and we have a number of recent accomplishments to substantiate that claim. We re excited to be a part of this effort with Florida Department of Management Services and we are confident that collectively we will deliver the best solution possible. Thank you for your time and consideration. Sincerely, Devin Henderson, CEO / DH Technologies ii

3 Table of Contents 1. Company Background Contact Information Technical (Section IV Response)

4 1. Company Background DH Technologies (DH Tech) is a small business entity that has rapidly established itself as an industry-recognized expert in system integration/virtualization services and cyber security, as validated recently with The Federal Partner of Year 2014 & 2015 award by Nutanix;; The Federal Innovation Partner of the Year 2013 award by Arista Networks;; named to CRN s List of Tech Elite 250 in 2014 & DH Tech is an industry-recognized enterprise data center solution provider with extensive past performance in the Public and Private sectors. We leverage broad exposure gained from our work as a VMware Pre/Post sales Professional Services delivery partner. We focus on proficiency training and customer-facing fieldwork to ensure that we bring the best and brightest team to bear on our projects. We perform services around the globe to include all of the United States, US territories, and military facilities over seas. DH Mission Statement: DH TECHNOLOGIES s mission is to consistently deliver innovative, value-add solutions that effectively address business requirements with proven and repeatable processes. SERVICES and/or PRODUCTS Provided: Complete solution design, implementation and sustainment Datacenter Consolidation/Virtualization Penetration Testing Server Virtualization Application Virtualization Data Center Assessment Virtual Desktop Infrastructure/Mobile Cloud Solutions Continuity of Operations Planning Global Services Delivery for all US States, Territories, and military facilities. CERTIFICATIONS or ACCREDITATIONS or MEMBERSHIPS: VMware Premier Solutions Partner Nutanix Elite Partner & Platform Professional GIAC, EC Council, SANS Institute 1

5 2. Contact Information DH Technologies contact information: Devin Henderson DH Technologies 305 Harrison ST SE, Suite 1B Leesburg, VA

6 3. Technical (Section IV Response) 1) Pre-Incident Services:. a) Incident Response Agreements Terms and conditions in place ahead of time to allow for quicker response in the event of a cyber-security incident. We would develop an incident response agreement based on industry standards. The agreement can be tailored to be specific to state requirements and response time can be agreed upon.. b) Assessments Evaluate a State Agency s current state of information security and cyber-security incident response capability. A gap assessment can be provided based on industry standards methods such as NIST and the SANS 20 Critical Controls. A live assessment can also be performed to evaluate the State Agency s current detect and response capabilities. Depending on the needs, a crosswalk could be provided to base the gap assessment against the State Agency s needs such as DHS CDM, ISO 27002, etc. This would increase the time to report and costs but may be more comprehensive and actionable.. c) Preparation Provide guidance on requirements and best practices. We can work with you to develop policies and procedures based on industry standards. A security awareness program can be developed for both employees and incident response teams.. d) Developing Cyber-Security Incident Response Plans Develop or assist in development of written State Agency plans for incident response in the event of a cyber-security incident. A formal plan for incident response can be created using the industry standard six phase incident management process (PICERL). This will include the establishment of CERT teams and organizational structures so that decisions can be made in a timely matter and reduce damages. Also, a schedule can be established for updating the plan and testing it.. e) Training Provide training for State Agency staff from basic user awareness to technical education. We provide training documentation and custom labs upon request. Also, instructor training can be provided from a SANS instructor who is a qualified GSE and Cyber Guardian. 3

7 2) Post-Incident Services:. a) Breach Services Toll-free Hotline Provide a scalable, resilient call center for incident response information to State Agencies. We can establish an in house hotline to provide telephone response after an incident. This can also include breach notification letters as needed.. b) Investigation/Clean-up Conduct rapid evaluation of incidents, lead investigations and provide remediation services to restore State Agency operations to preincident levels. We provide subject matter experts skilled in incident handling and recovery. These experts can be used for live incident response as well as cleanup activities.. c) Incident response Provide guidance or technical staff to assist State Agencies in response to an incident. We provide subject matter experts to provide guidance and/or provide incident handling abilities during or after an incident. During such events, we can either provide guidance or leadership in handling the incident.. d) Mitigation Plans Assist State Agency staff in development of mitigation plans based on investigation and incident response. Assist State Agency staff with incident mitigation activities. We provide industry experts to provide strategic leadership and strategy in risk mitigation. This can range from identifying products or processes that could mitigate risk or staff augmentation to implement solutions.. e) Identity Monitoring, Protection, and Restoration Provide identity monitoring, protection, and restoration services to any individuals potentially affected by a cyber-security incident. We can establish an identity monitoring, protection, and restoration services for individuals impacted by a cyber-security incident. 4

8 Justin Henderson Résumé Page 1 of 2 IT Professional Systems and Solutions Architect, IT Consultant, and Project Manager 1 of 13 People worldwide to achieve Offense and Defense SANS Cyber Guardian certification. Results-driven leader experienced with designing and maintaining cross-platform systems and network infrastructures for small to large companies. Able to multi-task priorities and keep focus on the core business processes. Continual education through regular training and self-research. Able to resolve complex system and networking issues and train staff to handle ongoing business opportunities. Excellent communication, collaboration, and problem solving skills. Able to wear many hats and exceed well under pressure and time constraints. Aligns business goals and processes using industry standards and able to think outside the box. Projects and Accomplishments Achieved SANS Mentor status Performed migrations from Windows NT environments to Active Directory on 2012 Multiple Exchange migrations starting from Exchange 5.5 to Exchange 2010 Managed security team to design and test disaster recovery plans for multiple sites Managed infrastructure team to support systems with over a 100:1 server to staff ratio Performed internal and external penetration tests using industry standard methodologies Architected and built a fully redundant and scalable web server farms Migrated users from physical desktops to virtual desktops across multiple departments with various external devices Certifications and Training Microsoft IT Professional Enterprise Administrator 2008 Solutions Associate Systems Engineer Systems Administrator: Messaging Technology Specialist Systems Administrator Systems Engineer: Messaging Professional Security GIAC Penetration Tester GIAC Certified Firewall GIAC Windows Security GIAC Security Essentials Analyst Administrator Computer Hacking Security+ Forensics Investigator Systems Engineer: Systems Security Administrators: Security Tenable Nessus Certified Auditor Certified Sonicwall Security Administrator Certified Information Systems Security EC-Council Certified Security Analyst Professional Certified Ethical Hacker Licensed Penetration Tester Governance, Service, and Project Management Certified Information Systems Manager ITIL Foundation Project+ COBIT 5 Foundation Course ITIL Lifecycle: Continual Project Management Certified in Risk and Service Improvement Professional Information Systems Control Virtualization VMware Certified VMware Certified VMware Certified VMware Certified Professional 5 Professional 5 : Desktop Professional 4 Professional 3 Network and Hardware A+ I-Net+ Network+ Cisco Certified Entry Networking Technician Cisco Certified Network Associate

9 Justin Henderson Résumé Page 2 of 2 Database MySQL 5 Database Administrator MySQL 4 Core Education WESTERN GOVERNORS UNIVERSITY, Salt Lake City, UT Bachelors of Science, Network Design and Administration, LAKE LAND COLLEGE, Mattoon, IL Associates of Science, Network Administration, Technology Skills Server-Related Technologies Active Directory Microsoft SQL Apache MySQL Microsoft Exchange Microsoft IIS Clustering Load Balancing Proxy Certificate Authorities Virtualization Platforms / Operating Systems Windows NT Linux Android IOS Networking LAN WAN VPN DHCP DNS WINS TCP/IP SMTP Firewalls IDS VoIP FTP / HTTP Telnet / SSH Radius ISCSI NFS Programming Languages PHP Perl SQL MySQL Bash Scripting AutoIT PowerShell Batch Scripting Professional and Consulting Experience HEARTLAND DENTAL CARE, Effingham, IL 2009-Present Heartland Dental Care is the leading dental service management provider in the United States and is a leader of customer care in dentistry. Modeled around letting dentists practice dentistry and business users manage the business, Heartland has achieved record breaking growth while continuing to give back to the community. Systems and Security Architect Systems and security architect that manages the security, infrastructure, and networking team. Developed and created Heartland s security department and risk management platform. Responsible for the design and maintenance of enterprise systems including VMware, Microsoft, and all networking devices. SARAH BUSH LINCOLN HEALTH SYSTEM, Mattoon, IL 2008 Sarah Bush Lincoln Health Center is a not-for-profit, regional hospital centrally located in East Central Illinois' Coles County. Sarah Bush Lincoln is accredited by The Joint Commission, the nation's oldest and largest standardssetting and accrediting body in healthcare. Systems Engineer Identified and deploy virtual desktop system to lower support and increase agility of IT services. Implemented VMware Infrastructure 3.5 for server infrastructure. LAKE LAND COLLEGE, Mattoon, IL Lake Land College is a public community college offering career programs that lead to immediate employment, transfer programs that lead to baccalaureate degree, liberal arts, adult education, special job training, and retraining programs. Network Security Teacher Taught Network Security Fundamentals to students and fostered future growth opportunities. FIRST MID-ILLINOIS BANK & TRUST, Mattoon, IL First Mid-Illinois Bank and Trust is a locally community focused chain of banks in Illinois. Network Engineer Responsible for secure networking and server access from banks to central office. BONUTTI CLINIC, Effingham, IL Bonutti Clinic is a world-class clinical care and orthopedic surgical expertise facility specializing in minimally invasive surgical techniques and instrumentation. Network Administrator Design and implement company website and Active Directory structure. Responsible for day to day support.