Protective Monitoring as a Service. Lot 4 - Specialist Cloud Services. Version: 2.1, Issue Date: 05/02/201405/02/2014. Classification: Open

Transcription

1 Protective Monitoring as a Service Version: 2.1, Issue Date: 05/02/201405/02/2014 Classification: Open

2 Classification: Open ii MDS Technologies Ltd /12/2014. Other than for the sole purpose of evaluating this Response, no part of this material may be reproduced or transmitted in any form, or by any means, electronic, mechanical, photocopied, recorded or otherwise or stored in any retrieval system of any nature without the written permission of MDS Technologies Ltd. MDS Technologies Ltd, Spring Park, Westwells Road, Corsham, Wiltshire SN13 9GB Telephone: , Fax: Contents Why MDS?... 1 Summary of service benefits... 1 Product Overview... 1 Product Features... 2 Example Use Cases... 3 Technical Features... 3 Overview of the G-Cloud Service... 3 Information Assurance... 3 On-Boarding and Off-Boarding processes... 4 Price Model... 5 Service Management... 6 Service Constraints... 7 Service Levels... 8 Ordering and Invoice Process... 8 Service Lead Time... 8 Termination costs... 8 Consumer Responsibilities... 8 Technical Requirements... 8 Related Services... 8

3 Classification: Open 1 Why MDS? A tailored cloud solution that fits your business needs Full range of cloud hosting options from pure public cloud to hybrid cloud and physical enablement solutions A support team which is based on the same highly secure campus as our cloud platform An assured cloud platform that is independently validated for OFFICIAL and OFFICIAL SENSITIVE data A fully managed platform, supported up to Operating System Over 12 years experience of providing infrastructure services SC cleared operational support staff 24/7 support through our ITIL-aligned Service Desk Additional professional services such as project delivery and technical consultancy ISO 27001, ISO 9001, ISO14001 accredited Over 12 years experience in supporting Public Sector customers A privately owned, UK sovereign company We are an SME - agile with minimal bureaucracy PROFESSIONAL, PERSONALISED SOLUTIONS Summary of service benefits An award winning UK sovereign developed and owned SIEM & Log Management technology CESG CCTM Accredited solution Service delivered by UK company Service proven with UK public sector organisations for projects up to OFFICIAL-SENSITIVE Customisable to meet specific accreditor interpretations of GPG13 Massively scalable (proven collection capability up to 300 million logs per day) Forensically sound log collection and storage (providing log data chain of custody) Collected and secured log data can be exported to external systems or locations Service can be extended to deliver protective monitoring to almost any system or device Product Overview MDS is pleased to partner with Assuria to provide this Protective Monitoring Service. The Protective Monitoring Service is designed to assist your organisation in meeting HMG Security Policy Framework (SPF) requirements and CESG Good Practice Guide Number 13 (GPG13) recommendations for Protective Monitoring. The service is delivered as a managed cloud-based Monitoring and Reporting Service which can be run alongside other MDS services such as Compute as a Service and Managed Server. The service can also be run independently of your IT provider, giving your organisation a completely independent view of any security events occurring on your IT infrastructure. We have created a service based on the Assuria Log Manager (ALM) product providing forensically secure automated log collection from devices within your IT infrastructure. ALM is a CESG Certified Claims Tested Mark (CCTM) accredited SIEM and Log Management Solution. Assuria and MDS offer this Protective Monitoring Service as a managed service, typically running ALM within MDS Pan Government Accredited (PGA) G Cloud IaaS service. In October 2014, the ALM product was awarded Cloud Security Solution of the Year at the Computing Security Awards.

4 Classification: Open 2 We offer a Baseline Service that provides monthly and ad-hoc reports available to view by nominated people within your organisation and is aligned with GPG13 Recording Profile A. The Baseline Service is suitable for clients operating at OFFICIAL. Our Deter Service is aligned with GPG13 Recording Profile B, offering greater levels of reporting and alerting. The Deter Service is typically suited for clients operating at up to OFFICIAL- SENSITIVE. Product Features Our Protective Monitoring Service has been designed to provide the following key benefits: Compliance with HMG Policy, Standards and Legislation All HMG organisations must satisfy certain policies, standards, legislation and regulatory requirements of which effective Protective Monitoring Alerting and Reporting can play a key part; Protective Monitoring is crucial in demonstrating compliance with Cabinet Office Security Policy Framework (SPF) mandatory requirements 2,5,8,9 and 12; HMG Information Standard No 6 Protecting Personal Data and Managing Information Risk (published as a result of the 2008 Hannigan Report) recommends Departments log all user access to Sensitive Personal Data and be able to report on access to it. Reports should be available for inspection by the Information Commissioners Office (ICO) if required; Protective Monitoring is an expected control in the PSN Code of Connection. Enhanced Situational Awareness. Automated reporting and alerting can help organisations to determine: Their overall security posture; Who or what their key Threats are (internal or external) and what vulnerabilities they may be exploiting; Threat trend and analysis to build a picture of past and likely future activity; Fully Managed Third Party Solution All logs are collected and securely stored in our assured hosting environment; Each customer gets a view of activity across their entire estate, based on a rolling monthly service cost; The following optional service features are available at an additional charge: Extended and Long Term Storage and Retention longer term retention periods are available at additional cost depending on retention period and volume of data collected. Additional Reporting and Alerting - Reports and alerts can be generated in addition to the ones generated as part of the GPG13 Recording Profiles at Baseline and Deter. The cost will depend on the types of devices and volume of logs generated which dictates any additional storage and time required to setup and configure the Service. Our resource costs are based on our SFIA rates. Enhanced Service and Support Levels - Assuria and MDS are happy to discuss any requirement for enhanced levels of Service and Support. Investigation Service - Assuria are able to offer a log analysis and investigation capability using our team of experienced Security Analysts. Log Data Export - The service allows export of collected log data to a third party in the event that the data is required for other uses, such as for further forensic analysis.

5 Classification: Open 3 Example Use Cases Organisations using this Protective Monitoring service would expect to gain benefits in the following scenarios: Alignment with the Government policies, standards and legislation, including the Security Policy Framework and Good Practise Guide 13. Forensic log capture, ensuring that events can be investigated should an incident occur Proactive monitoring of external and internal threats to Information Security and IT systems Technical Features The service has the following technical features: Baseline Service aligned with GPG13 Recording Profile A Deter Service aligned with GPG13 Recording Profile B Uses the Assuria Log Management (ALM) product (a CESG Certified Claims Tested Mark (CCTM) accredited SIEM and Log Management Solution) Monthly standard reporting and ad-hoc (on request) reporting Overview of the G-Cloud Service The Protective Monitoring Service is capable of receiving and analysing log information. The Service is hosted within the MDS Pan Government Accredited Cloud platform. The ALM Software is a CESG CCTM certified product. Our service encompasses the following scope: Agreement of specific logging and compliance requirements based on your business and security requirements Implementation and configuration of the ALM software Daily monitoring of the service and review of log outputs and reports through our Service Desk Provision of reports within a secure customer portal Alerting of security incidents in line with your Security Incident Management process OR Standard, template implementation of GPG-13, based on industry best practice. (as implemented elsewhere) Outline of template is available on request Within virtual data centre within an assured cloud environment Information Assurance Suitable for OFFICIAL and OFFICIAL-SENSITIVE data. Assuria are ISO aligned for the Baseline Protective Monitoring Service. MDS are ISO27001 accredited. The service can be hosted within Skyscape s assured Cloud platform, which is aligned to the CESG Cloud Security Principles and Pan Government Accredited at IL2 and IL3. The platform is also accredited at PSN- Assured and PSN-Protected.

6 Classification: Open 4 On-Boarding and Off-Boarding processes As part of on-boarding we will: Implement the log collection software, and work with your organisation to set up and configure the service. This includes the installation of ALM software agents on devices within your IT infrastructure from which logs will have to be collected in order to meet the GPG13 recommendations; Work with your organisation to determine your specific logging and compliance requirements. If required, Assuria can be engaged to help define audit, configuration and logging requirements; Test the service to ensure log collection is correctly configured and that reports and alerts are working as expected. We offer two methods of on-boarding, based on your needs: A standard, templated implementation, based on fixed application of GPG-13 monitoring, suitable for an existing, assured hosting platform (such as that provided by MDS) A bespoke implementation of GPG-13 monitoring, tailored to your specific risk profile Standard Implementation Our standard implementation is suitable for customers with a straightforward security monitoring requirement, covering an existing assured hosting platform subject to its own protective monitoring within the underlying physical infrastructure (such as MDS cloud platform). This implementation is based upon a standardised PMC Monitoring Template, a summary of which we can provide to potential customers upon application. The standard implementation process is outlined in Figure 1. Figure 1 - Standard Protective Monitoring Implementation Process This process is based upon Customer completion of a standard Survey Template, which defines how our standard PMC Monitoring will be applied within the Customer s environment. This is then used as the basis for the implementation, documented within the GPG-13 Scoping Document, which is signed off by the Customer before being implemented. Post-implementation, an Implementation Report and Certificate is provided to the Customer, documenting the installation. Bespoke Implementation Our bespoke implementation is suitable for customers with a more complex security monitoring requirement, where there may be specific or unique threats that require mitigation or tailored integration with application

7 Classification: Open 5 components is required. This implementation is based upon a consultative understanding of the Customer s risk profile and a collaborative approach to the application of specific PMC controls. It also includes further tuning and configuration following the initial implementation. The bespoke implementation process is outlined in Figure 2. Figure 2 - Bespoke Standard Protective Monitoring Implementation Process The bespoke process is initiated by an initial scoping meeting, attended by MDS, Assuria and the Customer, to collaboratively understand the Customer s risk profile and an appropriate approach to Protective Monitoring within the Customer s environment. This feeds into the Solution Design activity which outputs the formal GPG-13 Scoping Document and Installation Plan. These are then reviewed and agreed at a formal Design Review Meeting with the Customer before being implemented. Around a month after initial implementation, a Solution Review Meeting is scheduled with the Customer to review the initial implementation, agree and document any changes. Once implemented, these changes are documented within a revised Implementation Report and Certificate handed over to the Customer. Off-boarding As part of off-boarding we will: Decommission the ALM software and recover any licensed software Provide you with access to the logs held within the service at the point of decommissioning, if required. Price Model Pricing for the Protective Monitoring Service depends on the Service chosen and is priced on the number of devices logged. Any additional logging or retention can be added on as options to the Baseline or Deter Services.

8 Classification: Open 6 On-Boarding On-boarding of the Protective Monitoring service is priced based on the size of the environment to be monitored, as follows: Standard Implementation Environment Size Implementation Charge Micro (Up to 10 log sources) 2,585 Mini (up to 25 log sources) 3,060 Compact (Up to 50 log sources) 3,535 Small (up to 100 log sources) 4,485 Medium (up to 250 log sources) 5,435 Large (up to 500 log sources) 6,385 Enterprise (up to 1000 log sources) 6,860 NB: A log source equates to an operating system instance (e.g. a server, workstation, router, firewall) Bespoke Implementation Environment Size Implementation Charge Micro (Up to 10 log sources) 9,080 Mini (up to 25 log sources) 9,555 Compact (Up to 50 log sources) 10,030 Small (up to 100 log sources) 10,980 Medium (up to 250 log sources) 11,930 Large (up to 500 log sources) 12,880 Enterprise (up to 1000 log sources) 13,355 NB: A log source equates to an operating system instance (e.g. a server, workstation, router, firewall) On-going Service Provision On-going provision of the service is priced as follows: Service Element Baseline Deter Core Monitoring Service (per month) includes monitoring of up to 10 log sources 2, , Additional log sources (per month) Pricing excludes costs associated with the provision of compute and storage infrastructure required to host the Protective Monitoring log output. This will vary depending on the volume and location of log data required as part of a customer s specific solution. This may be purchased using MDS Compute as a Service Production service or another similar Cloud solution. Service Management The Protective Monitoring Service includes full management and maintenance, through our Service Desk, which is available between 8am and 6pm, Monday to Friday (excluding Public Holidays), with 24/7 cover provided for critical Security Incidents.

9 Classification: Open 7 Core service tasks, included within our price, are as follows: Description Frequency Run agreed reports and provide to the Customer Monthly (or ad-hoc, as requested) Generate alerts as required for GPG13 compliance As required Check agent health status and notify the Client of any recommended resolution actions required Daily Check log collection statistics and confirm collection is occurring as per the Client s requirements. Daily Archiving of log data in accordance with agreed archiving policy (standard is retention of 3 months of log data) Monthly Capacity Monitoring on log store On-going Deployment of additional agents (as long as they utilise an existing configuration and do not represent and expansion over 10% of the originally deployed estate) On request Additional ad-hoc tasks (as identified in the table below) will be carried out in response to a specific customer request and will be subject to additional charge using the SFIA Rate Card associated with this service, based on a minimum of 1 hours labour. Description Frequency Additional ALM agent configuration above and beyond the agreed initial configuration and deployment activity Adding an additional SIEM Changing or creating customer reports Creation and configuration of additional reports Export of event logs Investigation and analysis of collected logs and events beyond the agreed reports and alerts In the event the standardised support, maintenance or Service Levels do not meet all of your requirements, we will work with you to create a customised support model, at additional cost. Service Constraints None.

10 Classification: Open 8 Service Levels At Baseline, agreed Alerts will be delivered to the nominated contact within 2 hours (during core service hours) of the alert being generated. At Deter, alerts will be delivered to the same Service Level 24/7. Agreed Monthly Reports will be provided within 10 working days of the month end. Should we fail to deliver reports or alerts within the defined timescales we will credit 1 days worth of charges. Ordering and Invoice Process Ordering can be carried out using the Framework Agreement Schedule 2 Order Form. Invoicing is monthly in arrears. Payment can be via the following methods: BACS or Cheque. Service Lead Time We will initiate on-boarding on receipt of purchase order. Timescales for implementation of the service will vary, depending on the size and complexity of the environment to be monitored. Termination costs Exporting data from the service is charged using our SFIA labour rates. The exporting of log data may incur a data transfer charge from your hosting provider. Consumer Responsibilities The consumer is responsible for: completion of the ALM Survey Template approval of the Implementation Plan and GPG-13 Scoping Document engaging with, and specifying requirements for, the detailed configuration of the log capture and reports that are required providing appropriate and empowered attendees for scoping and review meetings providing access to customer servers to enable monitoring to take place the control and management of access and responsibilities for end users ensuring that only appropriate data (e.g. OFFICIAL or OFFICIAL-SENSITIVE) is accessible within the platform. Technical Requirements None. Related Services This service may be bought in conjunction with the following other G-Cloud services: Managed Server Application Management Compute as a Service - Production