ADVANCED THREAT DETECTION G-CLOUD SERVICE DEFINITION

Transcription

1 ADVANCED THREAT DETECTION G-CLOUD SERVICE DEFINITION 14

2 Table of contents 1 Introduction Service Overview Advanced Threat Detection Service Service Description Scenario: Basis for price Technical Requirements Customer Requirements Optional Additional Services Associated BAE Systems Managed Security Services Service Delivery Service management Service constraints Service Levels Information assurance Backup/Restore & Disaster Recovery Data restoration / service migration Trial Services On-boarding Training Commercial Arrangements Pricing Ordering and invoicing process Customer responsibilities BAE Systems Managed Security Advanced Threat Detection Terms and Conditions Termination terms Financial recompense model for not meeting service levels Intellectual Property Integrated G-Cloud Service Delivery Applied Intelligence: Information Intelligence Advanced Threat Detection Service Page 1 of 13

3 1 Introduction BAE Systems Applied Intelligence (formerly known as Detica) Cyber Security capabilities within G-Cloud are drawn from our portfolio of services and solutions which are designed to assist organisations in making cyber space safe for business and governments. Our capabilities are organised into the four principal areas of Prepare, Protect, Monitor and Respond as shown in Figure 1 below. Business and technical services that help our customers understand and manage their cyber risk, make informed investment decisions and drive through improvements. Repeatable products and solution integration to protect business critical information from cyber attack and enable secure collaboration with partners, clients and employees Products and services that monitor networks to identify malicious behaviour, understand its intent and prevent it from achieving its goal. Consulting services which minimise the business impact of a successful cyber security attack through remediation and crisis management Figure 1 - BAE Systems Cyber Security Services BAE Systems Cyber Security offering to G-Cloud is based on elements from the Prepare and Monitor capability areas as described in the following Service Description documents: BAE Systems Managed Security - Protective Monitoring BAE Systems Managed Security - Advanced Threat Detection (this document) BAE Systems Managed Security Security Device Management BAE Systems Managed Information Assurance Services BAE Systems Security and Information Risk Services Advanced Threat Detection Service Page 2 of 13

4 2 Service Overview 2.1 Advanced Threat Detection Service The Advanced Threat Detection service provides customers with protection against under-the-radar targeted threats which may be deep rooted and have lain dormant for many years, and are often of a complexity that is possible only through organised criminal teams and nation states. Although the number of such threats are lower than day-to-day operational security incidents, the damage of such attacks often results in irreparable reputational damage or irreversible loss of IPR causing business closure. BAE Systems service is underpinned by UK-built CyberReveal TM technology which provides unique defence against both common-place attacks and targeted attacks, also known as Advanced Targeted Threats (ATTs) and Advanced Persistent Threats (APTs) perpetrated by sophisticated and well-resourced attackers. BAE Systems Advanced Threat Detection service is depicted in the figure below and comprises the Protective Monitoring service in addition to a number of supporting services which enable this service, such as, Service Desk, Service Management, Threat Co-ordination and Technology Support Data is collected from clients networks using devices which cannot be detected by attackers located at the Internet gateways, which capture meta-data from traffic flows without impacting network performance. The device which is not easily detected by attackers also supports full packet capture to enable more data for attack investigation. The BAE Systems Host Agent software is installed on endpoint devices within the network (e.g. laptops and other thick client devices) and supports various forms of tasking. Advanced Threat Detection Service Page 3 of 13

5 Security alerts are triaged by our analysts and on detection of a security incident, analysts have access to threat information and empirical knowledge to prioritise incidents and reduce false positive rates. 2.2 Service Description In the delivery of this Service BAE Systems shall: Advanced Threat Detection Collect Security Data from CyberReveal TM Probes and/or CyberReveal TM Host Agents (where applicable) deployed as BAE Systems Customer Premises Equipment (CPE) on the Customer environment. The details of deployment are provided within the Deployment Plan; Transfer collected Security Data by batch transfer from the Customer monitoring environment to the storage Solution in compliance with an agreed Code of Connection (CoCo); Generate Security Alerts by processing Security Data using CyberReveal TM behavioural analytics on the CyberReveal TM Analytics Platform. Deploy new or modified behavioural analytics that have been confirmed by BAE Systems to accurately identify cyber threats, to continually improve the generation of Security Alerts; Security Incident Triage, Investigation and Diagnosis Analyse the Security Alerts raised by the Security Monitoring Devices, to identify potential cyber attacks. Identify potential Security Incidents based on Security Alerts, and create a suspected Security Incident; Prioritise and categorise each Security Incident raised by the Service according to a Prioritisation Schema. The Prioritisation Schema shall be agreed during the Service Transition phase; Conduct an initial investigation into a suspected Security Incident where the Priority is 1 or 2; Check for any existing incidents raised by the Protective Monitoring Service. If an existing Security Incident record exists, the new record shall be internally linked to provide enriched intelligence; The Security Incident, for example where it is a repeat incident. Where known remediation instructions are identified these shall be attached to the incident to aid the Customer in Incident Resolution. Make a recommendation where root cause is not known as to the subsequent investigation required. This may require a request for further information in order to determine if the Incident is genuine, during which time the Security Incident shall be placed On Hold. Access the BAE Systems knowledge base to check for any known remediation instructions related to Client Service Desk Communicate to the Customer the details of Security Incidents that conform to the reporting criteria (according to the timescales defined in the agreed Service Levels); Advanced Threat Detection Service Page 4 of 13

6 The communication will be via with a confirmatory phone call for P1 level incidents; Where further information is identified by the Service which relates to an existing Security Incident, BAE Systems shall communicate, to a single destination within the Customer an update to the Security Incident. 2.3 Scenario: Basis for price Security data relating to the following devices will be monitored: o 10Mb/s utilised Internet connection at a single UK data centre o Assumption of approximately 95 user laptops/workstations in the estate 2.4 Technical Requirements BAE Systems will deploy a collection probe within the customer s data centre. This probe should be deployed at the edge of the network, ideally adjacent to customer s proxy devices, and must be remotely accessible to BAE Systems staff via a VPN connection connecting the BAE Systems data centre environments to the customer estate. 2.5 Customer Requirements The Customer shall: Manage all remediation activity associated with a notified Security Incident; Provide an appropriately secure single point of channel for receiving notification of Security Incidents; Provide a single point of contact and suitably secure communication channel for notification of Priority 1 Security Incidents Provision of connectivity to Customer site for transfer of Security Data. 2.6 Optional Additional Services BAE Systems have not scoped the following services into the above scenario. If these services are required, BAE Systems will discuss your requirements and propose a suitable service and associated prices. Response services: BAE Systems Cyber Response services are one of only four CESG Cyber Incident Response Scheme providers and we have responded to many varied and complex targeted attacks, insider attacks and more over several years and have a proven methodology. Services include forensics (including s, servers, network data and logs) and incident management services. These services are available as per-incident services or on an annual retention basis. Threat Intelligence: BAE Systems Managed Security services are built upon and continuously improved by our Threat Intelligence research and collaboration. Elements of this service are also available as an advisory service to further help UK Government customers prepare for and response to cyber security incidents. Protective Monitoring Service: see below for more information Advanced Threat Detection Service Page 5 of 13

7 2.7 Associated BAE Systems Managed Security Services The Advanced Threat Detection Service is part of the wider BAE Systems Managed Security service portfolio, and compliments the Protective Monitoring service. Advanced Threat Detection compliments and extends your security monitoring by focussing on network and application behaviour from collected data, providing deep insight into sophisticated threats using metadata gathered from network traffic, s, web traffic and DNS lookups. Protective Monitoring provides holistic protection through the ingest and analysis of live log data, and delivers real time alert of security incidents leveraged from data available from existing security infrastructure and known threat signatures and likely indicators of compromise. Our Protective Monitoring service provides real time protection against all day-to-day security threats, which are often overlooked as irrelevant compared to the complex targeted threats that are prevalent in the media. However, without ensuring that the estate security posture is understood and controlled, the impact of seemingly lower priority issues will cause catastrophic business and reputational damage, especially as the likelihood of such security incidents is very high for all IT environments. Together, the BAE Systems Managed Security monitoring services offer unparalleled confidence in security posture and on-going protection against the full spectrum of cyber security threats. When taken together, there are also operational benefits and overlaps that lead to operational cost reductions please contact BAE Systems for more information on procuring a combined service as opposed to individual lots. Advanced Threat Detection Service Page 6 of 13

8 3 Service Delivery 3.1 Service management BAE Systems manages the delivery of Services to the Customer using ITIL v3 aligned Service Management practices. This includes Service governance, escalation and continual Service improvement. Standard Service Reports will be provided as part of the Operational Services. Standard Service Reports are flexible and the format, the structure and the content of these reports can be amended, all changes shall be subject to Change Control. Name Format Recipient/Participant Due Service Delivery Management Report Monthly/Quarterly Service Review Annual Service Review PDF report via (encrypted) Slide deck for discussion at Customer or BAE Systems offices Slide deck for discussion at Customer or BAE Systems offices Customer Cyber Security Delivery Manager, Customer Account Manager BAE Systems Service Delivery Manager, Customer Cyber Security Delivery Manager, Account Manager, Customer Account Manager BAE Systems Service Delivery Manager, Customer Cyber Security Delivery Manager, Account Manager, Customer Account Manager, Head of Service Delivery, Customer Director Monthly Monthly / Quarterly Annually The pricing assumes customer site visits within the M25 or BAE Systems Guildford office. 3.2 Service constraints The service and corresponding pricing has been sized to the scenario contained in section 2.3 in order to offer a representative price for comparison purposes. BAE Systems can however operate the Protective Monitoring Service for larger estates, monitoring many thousands of devices and a wide variety of devices and applications. 3.3 Service Levels The scenario and corresponding pricing has been based on the scenario contained in section 2.3 and on the following indicative service levels: Service Measure Channel Threshold P1 Security Incident Notification P2 Security Incident Notification sent to Customer Report sent to Customer 75 minutes (95% within Target Incident Notification Time if 20 or more incidents or no more than one failure if less than 20 incidents) Included within the Monthly Security Incident Report Advanced Threat Detection Service Page 7 of 13

9 P3 Security Incident Notification P4 Security Incident Notification Availability of Protective Monitoring Report sent to Customer Report sent to Customer P1 Service Incident duration Included within the Monthly Security Incident Report Included within the Monthly Security Incident Report 97% Availability The service Levels above a subset of the standard set of measures. 3.4 Information assurance This service must be able to connect to the Internet and as such is only available for customer estates assured to IL3 and below. 3.5 Backup/Restore & Disaster Recovery Disaster Recovery is out of scope of this proposed solution but is available upon request. 3.6 Data restoration / service migration Not applicable. 3.7 Trial Services Trial options are possible with this service, upon request to BAE Systems, under a service called Active Attack Assessment. 3.8 On-boarding During the Transition phase BAE Systems will work closely with the Customer to align the processes delivered by BAE Systems with the Customer business processes required to deliver the Operational Service. BAE Systems will deliver the following deliverables as part of transition phase: Protective Monitoring Policy; Deployment Plan; Operational Service Pack, During the transition phase there will be two key delivery milestones: Interim Operational Capability (IOC): The point at which there is an operational service executing and service charges become effective. Full Operational Capability (FOC): The point at which the service is fully operational and has completed Operational Acceptance Test (OAT) and all SLAs become effective. The Customer shall: Make available suitable security and network architects to work with BAE Systems and attend workshops and to work with BAE Systems to define and agree the Operating Policy. Advanced Threat Detection Service Page 8 of 13

10 Provide required Customer IP addresses to enable BAE Systems to pre-configure all CPE prior to deployment on the Customer estate; Deploy the BAE Systems provided CPE; Establish, maintain and support routing and connectivity to transfer Security Data from the Customer estate to BAE Systems site; Deploy, if specified with the Deployment Plan, Advanced Threat Detection Host Agents onto the endpoints on their estate; Allow site access to BAE Systems engineers as required to carry out break fix processes;; 3.9 Training Transition is dependent on individual customer requirements; it is estimated that the transition will be approximately 2-4 weeks duration. Not applicable. Advanced Threat Detection Service Page 9 of 13

11 4 Commercial Arrangements 4.1 Pricing Price to Operate The price (excluding VAT) for the service as scoped in section 2 is 219/day with a minimum 1 year term, this equates to approximately 80,000 per annum. For a price which meets your specific requirements please contact BAE Systems. Exit costs are not included in this price. 4.2 Ordering and invoicing process The Customer shall pay Supplier for the G-Cloud Services in the amount or at the rates set out in section 4.1 together with all reasonable travel and subsistence expenses and any other direct, non-labour charges as may be applicable. Supplier will invoice the Customer quarterly in advance i.e. for the depicted scenario 12.5k on the contract start date, and each quarter thereafter. All sums payable by the Customer to Supplier shall be paid, without discount, set-off, counterclaim or other deduction within 30 days from the date of Supplier s invoice. Applicable taxes (including value added tax) shall be payable additionally by the Customer at the prescribed rate at the time of invoicing. The Customer shall notify Supplier in writing within 7 days of receipt of an invoice if the Customer considers all or part of such invoice incorrect or invalid for any reason and the reasons for disputing payment failing which the Customer will raise no objection to any such invoice and will make full payment in accordance with it. 4.3 Customer responsibilities The Customer shall provide to Supplier at no charge and in a timely manner, all such documents information, materials, facilities, support, services and co-operation relating to the G-Cloud Services including (without limitation) computer programs, data, reports and specifications and other information (together Customer Material ) as Supplier may reasonably require for the proper performance of the G-Cloud Services and within sufficient time to enable Supplier to perform those G-Cloud Services and the Customer shall ensure that such are accurate and complete, and Supplier shall be entitled to rely upon such as being accurate and complete without seeking to verify or check it. The Customer shall provide Supplier, its agents, subcontractors, consultants and employees, in a timely manner and at no charge, with access to any of the Customer's premises, office accommodation, equipment, systems, networks, software, data and other facilities as reasonably required by Supplier. 4.4 BAE Systems Managed Security Advanced Threat Detection Terms and Conditions The full terms and conditions for this service can be found in BAE Systems Applied Intelligence MSS MSA. 4.5 Termination terms Not Applicable Advanced Threat Detection Service Page 10 of 13

12 4.6 Financial recompense model for not meeting service levels Not Applicable 4.7 Intellectual Property Details of the terms and conditions of the foreground IPR, please see the BAE SYSTEMS BAE Systems Cyber MSA v1. The proposed service in this document encompasses some elements of the Threat Intelligence service; in addition to the standard IPR terms and conditions please be aware of the following additional IPR restrictions: Ownership of copyright and all other intellectual property in the Threat Intelligence Deliverables and Services shall remain with BAE Systems at all times. Subject to payment in full of each instalment of the fees for the Services Customer is granted a nonexclusive, non sub-licensable, non-transferable, non-assignable, limited royalty free license to use and copy the Threat Intelligence Deliverables solely for the Customer s internal business purposes. The Customer shall expressly not: (i) sublicense, distribute, publicly perform or display, or otherwise share or make accessible any Threat Intelligence Deliverables, data-feed, signatures, metadata, analysis, tools or results from the Services or portions thereof to a third party; (ii) export the Threat Intelligence Deliverables, data-feed, signatures, metadata, analysis, tools or results from the Services, in whole or in part, in violation of applicable laws or regulations or; (iii) use the Services to offer products and services competitive with those of BAE Systems, as reasonably determined by BAE Systems. All rights pertaining to Threat Intelligence, in all materials created by BAE Systems during its performance of the Services shall vest in and be the sole property of BAE Systems. 4.8 Integrated G-Cloud Service Delivery We have many G-Cloud Service offerings. As required by the Customer, we will integrate, manage and deliver complimentary G-Cloud Service offerings to form part of this G-Cloud Service to meet Customer service requirements. Advanced Threat Detection Service Page 11 of 13

13 5 Applied Intelligence: Information Intelligence BAE Systems Applied Intelligence is an information intelligence specialist. We help government and commercial organisations exploit information to deliver critical business services more effectively and economically. We also develop solutions to strengthen national security and resilience, enabling citizens to go about their lives freely and with confidence. By combining technical innovation and domain knowledge, we integrate and deliver world-class solutions often based on our own unique intellectual property to our customers most complex operational problems. We recognise the importance of Cloud services to the realisation of HMG s IT Strategy and have optimised many of our most compelling IT service offerings for Government on G-Cloud. Through these offerings we are at the forefront of realising the full benefits of Information Technology for our customers. Below is a summary of our G-Cloud services. G-Cloud Service Consultancy Service Integration and Management (SIAM) Information Security Agile Design and Delivery Architecture Data Services Service Description Providing Business and IT strategy and transformation consultancy services, including requirements management, organisational change, and business case & benefits management. Covering all aspects of SIAM services, from target operating model design, to service integration, supplier management, architecture and transition and transformation management. Cyber security assessments, architecture and testing services; Threat detection, protective monitoring and security management services; Cyber incident response, and Industrial Protection, Secure Web Gateway and Cross domain services. Services delivered using the Agile method for design and development, including Secure-by-Design services. The design of end-to-end architecture solutions, including infrastructure, operations, applications and service, as well as enterprise architecture. Data management, protection and exploitation services covering people, process, data and technologies. Includes maturity assessments, organisation design and provision of data analytics services. Programme Management Digital Media Secure Mobility & MobileProtect Provision of programme management and support experts to provide delivery and/or assurance of internal and external programmes. Digital transformation, media development, including user experience, social business and mobile media. From mobile strategy, through to development of your secure mobile proposition for your user base; Cloud based protection for your user base portfolio of mobile devices. NetReveal OnDemand Cl Cloud based delivery of the global leader in counter fraud software. For more details on our G-Cloud services for G-Cloud, visit or send us an at gcloud@baesystems.com. Applied Intelligence is part of BAE Systems, the premier global defence, security and aerospace company. BAE Systems delivers a full range of products and services for air, land and naval forces, as well as advanced electronics, security, information technology solutions and customer support services. Advanced Threat Detection Service Page 12 of 13

14 Applied intelligence Limited is a BAE Systems company, trading as BAE Systems Applied Intelligence. Applied Intelligence Limited is registered in England (No ) with its registered office at Surrey Research Park, Guildford, England, GU2 7YP. Copyright BAE Systems plc All Rights Reserved. BAE SYSTEMS, APPLIED INTELLIGENCE and the names of the BAE Systems Applied Intelligence products referenced herein are trademarks of BAE Systems plc and are registered in certain jurisdictions. Advanced Threat Detection Service Page 13 of 13