Annex to the Service Schedule for BTNet (also marketed as Internet Connect UK) - BT Assure DoS

Transcription

1 1. The following terms and conditions will apply where the Customer is contracting for BT Assure DoS. They apply in addition to: Conditions and Service Schedule for BTnet (also marketed as Internet Connect UK) The Order Form. Where this Annex varies any clause in the Conditions and the Service Schedule, the variation applies to the services in this Annex only, unless expressly stated. References to BTnet apply to Internet Connect UK. 2. Service Description 2.1 BT Assure DoS monitors the Customer s internet traffic to mitigate and detect: DDos attacks; DDoS floods, protocol misuse, and behaviour anomaly based attacks. The BT Assure DoS service profiles normal behaviour and identifies malicious attacks based on anomalous behaviour patterns and filters out the attack traffic 2.2 The Service will be (d) provided over BT s network as a cloud; provided on BT provided services only; unavailable on internet connectivity from other ISPs; only available in the UK. 2.3 All options provide automated detection of DDoS attacks and automated mitigation on Managed Object(s). The Customer can choose from the following options: Bronze, Silver and Gold and will receive the services set out in the table below; Service Options Bronze Silver Gold Managed Object(s) the Customer will provide BT with details of the Managed Object(s) via the Mitigation Template 1 Managed Object 3 Managed Objects 5 Managed Objects The Service will provide access to the following for each Managed Object Alerting Service Weekly Report Portal Limited basic traffic reports and alert options available via the Portal. Yes Yes Yes British Telecommunications plc Page 1 of 6

2 Standard self-service monitoring reports available via the Portal No Yes Yes Security Centre support - Admin only No Mon-Fri 9-5 (excluding 24/7 (including Security Centre technical advice and support Limited to initial set up 24/7 (including 24/7 (including Automated mitigation (and alerts) as set out in paragraph 2.3 above. In addition to the automated mitigation (and alerts) as set out in paragraph 2.3 above, BT will, monitor the traffic on the Customer s Managed Objects; and investigate any unexpected traffic patterns; take any additional mitigation action required; and (d)advise the Customer of any action to take. The following options are available at an additional charge as detailed in the Order Form Flexible self-service monitoring reports (as agreed between BT and the Customer) Manual detection of DDoS attacks and manual mitigation (as agreed between BT and the Customer). No Yes Yes No Yes Yes British Telecommunications plc Page 2 of 6

3 3. Software Faults 3.1 BT will not warrant that Software supplied under the Contract will be free of faults or that its use will be uninterrupted, but BT will remedy those defects which significantly impair performance (where necessary by arrangement with the Customer) within a reasonable time 4. Moves 4.1 At any time, the Customer may request a move from one option to another: Upgrade to a higher option i) no Termination Charges will be payable for the option that the Customer is moving from; ii) BT will re-calculate the charges for the upgraded option; and iii) a new Minimum Period will apply to the upgraded option as advised to the Customer by BT at the time of upgrading. Downgrade to a lower option i) the Customer will pay the Termination Charges for the option that the Customer is moving from set out in clause 10 of this Annex; ii) BT will recalculate the charges for the downgraded option; and iii) a new Minimum Period will apply to the downgraded option, as advised to the Customer by BT at the time of downgrading. 5. Customer s Responsibilities 5.1 In addition to the Customer s responsibilities set out in the Service Schedule, the Customer will: (d) (e) provide BT with full details of the Managed Object(s); complete and agree the Mitigation Template; provide BT with addresses and telephone numbers for nominated customer contacts advise BT immediately of any changes to the Managed Objects, authorised traffic and addresses/telephone numbers take any steps advised by BT in the event of prolonged and frequent attacks. 5.2 The Customer agrees and accepts that: BT will not be able to successfully detect and mitigate all attacks; in some instances, the mitigation may also filter legitimate traffic; BT will not be liable for any failure to detect and mitigate any attack or for filtering legitimate traffic. 6. BT s Responsibilities 6.1 Subject to the service option chosen and in accordance with the service option chosen (as detailed in clause 2.3), in addition to BT s responsibilities set out in the Service Schedule, BT will: in the event of a DDoS attack being detected or advised to BT: i) provide automatic alerts or advice by telephone(depending on the service option chosen by the Customer), including advice as appropriate on tests and checks to be carried out by the Customer; British Telecommunications plc Page 3 of 6

4 ii) carry out diagnostic checks from BT premises; Mitigate the DDoS attack by: 7. Charges i) automatic intervention; or ii) manual intervention (if agreed between BT and the Customer) 7.1 Clauses 12.1 and 12.2 of the Conditions are replaced as follows: 12.1 The Charges for the Service will begin on the OSD and subject to clause 12 of the Annex are fixed for the Committed Term. All Charges will be calculated in accordance with the charging information attached to the Order Form and the details recorded by, or on behalf of, BT. BT will add all applicable taxes to BT's invoices as appropriate The Customer will pay: (d) (e) the Rental Charges other than those applicable to BT Assure DoS, quarterly in advance; the Standard Connection Charge where the Committed Term is for one (1) year, or as pursuant to clause 15.3, within twenty eight (28) days of the date of BT s invoice; the Rental Charges for BT Assure DoS set out in the Order Form monthly in advance; the Set up Fee and any additional charges for BT Assure DoS set out in the Order Form, within twenty eight (28) days of the date of BT s invoice; and Any Additional Charges, within twenty eight (28) days of the date of BT s invoice. 8. Service Level Agreement 8.1 The Service Level Agreement for BTnet does not apply to the BT Assure DoS Service. Limits of Liability 8.2 If a Party is in breach of any obligations under this Annex (or any part of it) to the other Party or if any other liability is arising (including liability for negligence or breach of statutory duty) then, subject to clauses 13.1, 13.2, 13.3 of the Conditions and Service Schedule for BTNet, such Party s liability to the other Party will be limited to 125% of the amount paid under this Annex for the BT Assure DDoS service. 9 Suspension and Termination 9.1 Where, BT believes that an attack or frequent attacks threaten BT s network or has a significant impact on BT s other customers BT may (without notice); prevent incoming traffic coming to the target of the attack; deny traffic to that target to all areas of the BT network; which may mean in some instances, the target under attack may lose some or all internet service. British Telecommunications plc Page 4 of 6

5 9.2 BT will make all reasonable efforts to keep customers informed and to resume service as soon as possible. 9.3 Where the BTnet service provided under this Contract is terminated the BT Assure DoS service will automatically terminate and the Customer will pay the Termination Charges set out in clause 10 of this Annex, unless BT has terminated the BTnet service under clauses 16.1 of the Conditions 9.4 Either party may terminate the BT Assure Dos Service on 6 months notice to the other. 10 Termination Charges 10.1 If the Customer terminates the BT Assure DoS service prior to the end of the Minimum Period, the Customer will pay a charge equivalent to 3 months rental charges. 11 Cancellation Charges 11.1 Clause 8.1 of the Service Schedule is replaced as follows: 8.1 The Customer may cancel the Service at any time prior to the OSD, subject to the payment of: any Delay Charges due under clause 12.5 of the Conditions; the Additional Charges set out in the table below, for costs incurred in preparation by BT: Cancellation Request Received by BT At any time after the Customer has received confirmation of the order being placed, up until BT confirms the CCD to the Customer At any time after BT has confirmed the CCD to the Customer % of Standard Connection Charge Payable 0% 100% BT s reasonable costs including the costs of any equipment provided by or ordered from third parties (including BT s supplier) where the Customer cancels BT Assure Dos. 12. Changes to the contract (including the Charges) 12.1 Clause 17.1 of the Conditions is replaced as follows: 17.1 Subject to clauses to 17.2, 17.3 and 17.4, this Contract or any part of it, will not be amended, modified or supplemented except by a document in writing signed by authorised representatives of both Parties BT can change the Annex (including the charges) at any time and will notify the Customer of changes in line with Clause 17.3 below. British Telecommunications plc Page 5 of 6

6 17.3 BT will publish any changes to the Annex (including the charges) online at (or any other online address that BT may advise the Customer) or, at its discretion, notify Customers in writing (including by ), as follows: for changes that are to the Customer s significant detriment, at least one month before the change is to take effect; and for all other changes at least one day before the change is to take effect Where the change to the Annex is to the Customer s significant detriment the Customer may give BT notice in accordance with Clause 15.1 of the Service Schedule to end the BT Assure DoS service within one month of the date of notification if notice is given individually or 3 months if the notice is given on bt.com. 13. Definitions 13.1 The following definitions apply to the terms in this Annex: Charges DDoS Intelligence Reports ISP Managed Objects Minimum Period Mitigation Template Portal the periodic rental charges, Set Up Fee payable by the Customer for the Service set out in the Order Form. Distributed Denial of Service. reports provided by BT which give details of intel information obtained by BT on current types of attacks, mitigation and industry information. Internet Service Provider(s). a range of IP addresses which BT will monitor and thresholds that will be used to trigger an alert and subsequently automated mitigation. a period of 12 months unless otherwise specified on the Order Form, that will be automatically renewed at the end of the Minimum Period for a further Minimum Period(s) of the same duration unless the Customer give BT at least 30 days notice before the end of the Minimum Period.to end the Service under this Annex in accordance with Clause 20 of the Conditions and Service Schedule for BTNet. the form which sets out the section of countermeasures that will be applied when the system goes into automatic or manual mitigation, and will be agreed by BT and the Customer. a secure shared BT website that enables Customers to view service information, request changes and download service reports` British Telecommunications plc Page 6 of 6