7.5.1 Satisfying the Service Requirements (L (c))

Transcription

1 7.5 MANAGED E-AUTHENTICATION SERVICE (MEAS) (L ; C ) The offeror shall describe each of the optional Security Services offered. Table L shows the Security Services that shall be optional to offer. Tables J (b) Technical Stipulated Requirements for Optional IP-Based Services and J (b) Technical Narrative Requirements for Optional IP-Based Services identify the stipulated and narrative requirements, respectively, that shall apply exclusively to optional services. The offeror shall describe all optional Transport/IP/Optical Services offered to include: Satisfying the Service Requirements (L (c)) A technical description of how the service requirements (e.g., capabilities, features, interfaces) are satisfied for all proposed optional services. Managed E-Authentication Service (MEAS) provides Agencies with electronic authentication services in order to seamlessly conduct electronic transactions and implement E-Government initiatives via the Internet. The service enables an individual to remotely authenticate his or her identity to an Agency Information Technology (IT) system. Sprint will comply with the service requirements as detailed in the following sections Capabilities Sprint Security Consulting Services will provide the required design and engineering services. The following steps provide a high level overview of the steps involved in designing a Sprint MEAS for a Federal Agency: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX X X XXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Page 943 March 5, 2007

2 XXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXX Sprint Managed Token Authentication Service provides a managed service for strong two-factor authentication. XXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX X XXXXXXXXXXXXXXXXXXXXXXXXXXX Figure Sprint SecurID Product Portfolio X XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Page 944 March 5, 2007

3 X XXXXX XXXX XXX XXXXXXXXXXXXXXXXXXXXXXXX X XXXXX XX XXXXXXXXXXXXXXXXXXXXXXXXXXXXX XX XX XXXX XXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XX XX XXXXXXXXXXXXXXXXXXXXXXXX X X XXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Page 945 March 5, 2007

4 XXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXX XXXXXXXXXXXXXXXX X XXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXX Sprint Managed PKI service provides a higher level of security than Radius authentication via two-factor authentication. Users must possess a digital certificate as well as know a password. Furthermore, certificates can be revoked immediately by the Agency designated Point-of-contact to prevent access by a user should that user be terminated or there is uncertainty about the possession of the certificate is in question Features Sprint Managed E-Authentication Services will provide and support the following MEAS features: Page 946 March 5, 2007

5 1. All industry standards 2. Biometric characteristics 3. Encryption/digital signature client software for the Agency-designated POCs 4. E-Authentication training to Agency personnel for user authentication, PKI, and CAs 5. Directory/repository functions for PKI and/or other e-authentication mechanism chosen by the Agency. Sprint MEAS can support single sign-on architectures to allow Agencies to validate multiple levels of authentication. Sprint MEAS can also support fingerprint-based authentication as needed by an Agency. Sprint MEAS will provide a database of users who have subscribed to the PKI Service. Only the user, however, knows the industry standard PKI passwords and, thus, the Sprint MEAS will have no access to these passwords to maintain a database Interfaces Sprint Managed E-Authentication Services supports UNIs for IPS, PBIP- VPNS, NBIP-VPNS, and FRS. The Sprint Managed E-Authentication Services proposed in this section will support all secure networking environments including DMZs, secure LANs, and public networks such as the Internet and Extranet Quality of Services (L (d)) A description of the quality of the services with respect to the performance metrics specified in Section C.2 Technical Requirements for each proposed optional service, and other performance metrics used by the offeror. When the Sprint XXXXX identifies a problem or event, it notifies the Agency according to the methods and service levels (KPIs and AQLs). Communication methods include , telephone, fax, and pager. Sprint Page 947 March 5, 2007

6 XXXXX personnel notify only the designated Federal Agency POC. If Sprint cannot reach the POCs for any reason, a voic followed by electronic mail will serve as default notification. Sprint will provide quality managed services to Agencies that need to satisfy individual operational requirements. Sprint will meet the performance metrics required by the Networx RFP by applying best practice program management processes for all managed Agency networks. Sprint will follow the formula described in RFP Section C for Availability and will track and total all outages during each month Exceeding the Specified Service Requirements (L (e)) If the offeror proposes to exceed the specified service requirements (e.g., capabilities, features, interfaces), a description of the attributes and value of the proposed service enhancements. Sprint is committed to offering a secure, robust and comprehensive portfolio of MEAS offerings. As detailed in Section 7.5.2, Sprint guarantees to deliver the service and to ensure that it meets Agency requirements Experience Delivering Services (L (f)) A description of the offeror s experience (including major subcontractors) with delivering each proposed optional service. Sprint, through its development and deployment of industry-leading security vendor technologies, offers a full array of U.S. and global security services with the highest level of security expertise available today. Sprint has the building blocks to provide Federal Agencies with a suite of core offerings, including: More than 20 years of government security experience: Sprint has been a leader in network security starting 20 years ago with SprintNet (previously TelNet) and is committed to helping Federal Agencies. Page 948 March 5, 2007

7 Combined firewall and token authentication from Sprint: Sprint has collaborated with the industry leaders in security, giving Federal Agencies the assurance that Agency information is handled by the latest technology and the best support. XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Wide range of products and services: Sprint provides firewalls, intrusion detection, security, user authentication, and security consulting, and protection services. Managed services that fit your needs: Sprint offers industry-leading security management. The multilevel management options from Sprint provide the greatest flexibility for meeting different business needs. Dedicated security experts: The Sprint solution includes a team XXXXXX XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXX XXXXXXXXX developing security XXXXXXXXXXXXX XXXXXXXXXXXXXXXXX solutions based upon your unique XXXXXXXXXXXXXXX business needs and security policy XXXXXXXXX XXXXXXXXXXXXXXXXX requirements, delivering either a standard, XXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXX modified standard, or customized solution. XXXXXXXXX XXXXXXX XXXXXXXXXXXXX The Sprint IP Security design is a XXXXXXXXXXXXXXXXXX XXXXXXXXXXXXX comprehensive service that ensures the XXXXXXXXXXXX security server is properly implemented, XXXXXXX and that the network and security server design provide the best possible implementation of your security policy. Certified professionals: XXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXX The CISSP certification identifies a security professional who has met an industry-recognized Page 949 March 5, 2007

8 standard of knowledge and experience and who continues to keep their knowledge current and relevant to what is happening in the practice of information security. The CISSP program certifies IT professionals responsible for developing the information security policies, standards and procedures, and managing their implementation across an organization. Sprint people and commitment to innovation make these accomplishments possible. Cost-effectiveness: Federal Agencies can significantly lower costs by outsourcing the management of security devices. The Government can rely on Sprint, rather than having to be concerned with the acquisition of management tools and IT staffing expenses (i.e., hiring, training, and retaining) to manage the security solution effectively. Increased focus on core business: By outsourcing and cutting costs, Agency staffing and/or financial resources can concentrate on the Agency mission and goals Testing and Verifying Services (L (g)) A description of the offeror s approach to perform verification of individual services delivered under the contract, in particular the testing procedures to verify acceptable performance and Key Performance Indicator (KPI)/Acceptable Quality Level (AQL) compliance. Sprint will create an MEAS implementation plan for an Agency requesting a remote E-Authentication service as the first step to verifying MEAS. Sprint will install and test the appropriate equipment, conduct performance testing, and verify that the tokens or certifications can be effectively used, managed, and monitored by the Agency and by Sprint. After an Agency has been set up to provide Sprint MEAS to its remote users, Sprint will verify that the Agency s security process and procedures are used and meet the Agency s policy guidelines. Sprint works closely with the Agencies to implement training materials. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Page 950 March 5, 2007

9 XX X XXXXXXXXXXXXXXXXXXXXX Impact of Delivery of Optional Services on the Network Architecture (L (h)) A description of how the delivery of any optional services would impact the network architecture (e.g., security, quality and reliability, performance). Sprint offers Managed E-Authentication as a commercial service. Based on the current requirements, Sprint does not foresee any impact of delivery of the optional services on the Network Architecture as it relates to security, quality, reliability and performance Satisfying NS/EP Basic Functional Requirements (L (i)) A description of the offeror s approach to satisfy each NS/EP basic functional requirement listed in Section C XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XX XXXXX XXXXXXXXXXXXXXXXXXXX Sprint continues to evolve its network to a next generation packet based environment with converged services (voice, data and, video on the same network) to find feasible application of the 14 functional requirements. XX XXX Page 951 March 5, 2007

10 X XXX XXXXXXXXXXXXXXXX Assuring Service to the National Capital Region (L (j)) A description of how the network architecture will satisfy the requirements in Section C for assured service in the National Capital Region, if applicable. Sprint has provided assured service features within our network since the original FTS2000 contract. Today, the following conditions are met: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX X XXXXXXXXXXXXX X XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX X XXXXXXXXXXXXXXXXXXX Assured service involves an end-to-end management and design process. Components include customer premises equipment, access and egress arrangements, inter-exchange network, and network management and control. These components, i.e., access, network and egress, which Sprint can control to achieve the stated requirements, will be discussed in detail in Part B of our NS/EP FRIP and will constitute the Sprint Assured Service Plan. Page 952 March 5, 2007

11 7.5.9 Meeting Section 508 Provisions (L (k)) A description of the offeror s approach for providing the capabilities needed to meet Section 508 provisions identified in Section C.6.4 for the proposed optional services. Sprint provides the capabilities for supporting Section 508 requirements related to Electronic Information Technology (EIT) from a technical operations perspective as noted in the ancillary Voluntary Product Accessibility Templates (VPAT) documentation. Sprint strives for compliance by meeting the standards criteria or equivalent facilitation. VPATs cover all aspects of the Sprint product and services capabilities ranging from software to hardware, web information, functional capability and documentation. The completed supporting VPAT documentation is noted in Volume 1, Appendix A Incorporating Future Technological Enhancements and Improvements (L (l)) A description of the approach for incorporating into the proposed optional services, technological enhancements and improvements that the offeror believes are likely to become commercially available in the timeframe covered by this acquisition, including a discussion of potential problems and solutions. Future Technological Enhancements and Improvements Sprint is constantly monitoring commercial offerings and updating service offerings with new features and functionality as technological improvements and enhancements become commercially available. When new features and capabilities are made available, Sprint will work with Government to understand what specific requirements should be added or subtracted from the commercial offerings to make these new features and capabilities beneficial to the Government sector. Sprint is consistently researching and identifying new E-Authentication services and leading industry partners. Sprint can work with Federal Agencies to further test new services and build a strong network layer of secure remote access services. While everyone is eager to take advantage of new features, standards and capabilities, sometimes, even though they are Page 953 March 5, 2007

12 commercially available, they may not be ready to stand the rigors of day-today conferencing within the Federal Government user community. As technological enhancements and improvements become commercially available, Sprint will work with the Government to incorporate and stabilize new product offerings with the Government s best interest in mind. Sprint will offer access to the newest technologies, features, and functionalities giving the Government the opportunity to stay on the cutting edge of technology XXXXXXXXX Potential Problems and Solutions Since an application is only as good as the transport it rides on, the Government could experience problems with MEAS if there are problems with the underlying data transport. The Sprint MEAS solution can be used with any commercial Internet Protocol (IP) backbone, however, the historical evidence of the combined availability of SMEMS and the Sprint IP network will reassure any Federal Agency of the strong performance of the two services. As with any other internet service, the quality of user experience depends on the Quality of Service (QoS) of the Internet Service Provider (ISP) provider and the network bandwidth available. Sprint offers the Government a unique situation in that it provides both the management and application service of E-Authentication and unites with the necessary transport via the Sprint IP Backbone. The combined service provides the Government with the best experience in reliable E-Authentication services. Summary Sprint MEAS offers a wide portfolio of industry leading E-Authentication products and services. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX The Page 954 March 5, 2007

13 authentication services offered by Sprint MEAS serve as a critical preventative measure against security breaches. Sprint MEAS offers a custom design and engineering service to meet each Federal Agencies needs and will provide an important consulting role in designing, developing, implementing and managing the services. Each Agency can be assured that the services are supported on a secure network which serves as the critical backbone for the entire service. Sprint MEAS is a robust, cost saving user authentication service managed by a trained and certified team of security professionals. Page 955 March 5, 2007