W /A REQUEST FOR INFORMATION (RFI) REGARDING. A Solution for Web Application Firewalls and Databse Application Monitoring and Protection FOR

Transcription

1 Public Works and Government Services Canada Travaux publics et Services gouvernementaux Canada 1 1 RETURN BIDS TO: RETOURNER LES SOUMISSIONS À: Bid Receiving - PWGSC / Réception des soumissions - TPSGC 11 Laurier St. / 11, rue Laurier Place du Portage, Phase III Core 0B2 / Noyau 0B2 Gatineau Québec K1A 0S5 Bid Fax: (819) LETTER OF INTEREST LETTRE D'INTÉRÊT Title - Sujet RFI Solicitation No. - N de l'invitation Client Reference No. - N de référence du client W File No. - N de dossier.w Date CCC No./N CCC - FMS No./N VME Solicitation Closes - L'invitation prend fin GETS Ref. No. - N de réf. de SEAG PW-$$QE Time Zone Fuseau horaire at - à 02:00 PM Eastern Standard Time on - le EST F.O.B. - F.A.B. Plant-Usine: Destination: Other-Autre: Address Enquiries to: - Adresser toutes questions à: Buyer Id - Id de l'acheteur Wight, Patti Telephone No. - N de téléphone FAX No. - N de FAX (819) ( ) (819) Destination - of Goods, Services, and Construction: Destination - des biens, services et construction: National Capital Area Comments - Commentaires Instructions: See Herein Vendor/Firm Name and Address Raison sociale et adresse du fournisseur/de l'entrepreneur Instructions: Voir aux présentes Delivery Required - Livraison exigée See Herein Delivery Offered - Livraison proposée Vendor/Firm Name and Address Raison sociale et adresse du fournisseur/de l'entrepreneur Issuing Office - Bureau de distribution Security and Information Operations Division/Division de la securite et des operations d'information 11 Laurier St. / 11, rue Laurier 8C2, Place du Portage Gatineau Québec K1A 0S5 Telephone No. - N de téléphone Facsimile No. - N de télécopieur Name and title of person authorized to sign on behalf of Vendor/Firm (type or print) Nom et titre de la personne autorisée à signer au nom du fournisseur/ de l'entrepreneur (taper ou écrire en caractères d'imprimerie) Signature Date Canada Page 1 of - de 6

2 W W REQUEST FOR INFORMATION (RFI) REGARDING A Solution for Web Application Firewalls and Databse Application Monitoring and Protection FOR DEPARTMENT OF NATIONAL DEFENCE Page 2 of - de 6

3 W W Purpose and Nature of the Request for Information (RFI) Public Works and Government Services Canada (PWGSC) is requesting Industry feedback regarding a combined solution for Web Application Firewalls (WAF) and Database Application Monitoring and Protection (DAM) for the Department of National Defence. The objective of this RFI is to solicit information on the availability of commercial solution capable of meeting DNDs needs. This RFI is neither a call for tender nor a Request for Proposal (RFP). No agreement or contract will be entered into based on this RFI. The issuance of this RFI is not to be considered in any way a commitment by the Government of Canada, nor as authority to potential respondents to undertake any work that could be charged to Canada. This RFI is not to be considered as a commitment to issue a subsequent solicitation or award contract(s) for the work described herein. Although the information collected may be provided as commercial-in-confidence (and, if identified as such, will be treated accordingly by Canada), Canada may use the information to assist in drafting performance specifications (which are subject to change) and for budgetary purposes. Respondents are encouraged to identify, in the information they share with Canada, any information that they feel is proprietary, third party or personal information. Please note that Canada may be obligated by law (e.g. in response to a request under the Access of Information and Privacy Act) to disclose proprietary or commercially-sensitive information concerning a respondent (for more information: lois.justice.gc.ca/eng/acts/a-1/). Respondents are asked to identify if their response, or any part of their response, is subject to the Controlled Goods Regulations. Participation in this RFI is encouraged, but is not mandatory. Participation in this RFI is not a condition or prerequisite for the participation in any potential subsequent solicitation. Respondents will not be reimbursed for any cost incurred by participating in this RFI. The RFI closing date published herein is not the deadline for comments or input. Comments and input will be accepted any time up to the time when/if a follow-on solicitation is published. 2. Background Information Please refer to Annex A Statement of Requirements / Questions. 3. Work Scope and Constraints Please refer to Annex A Statement of Requirements / Questions. Page 3 of - de 6

4 W W Legislation, Trade Agreements, and Government Policies The following is indicative of some of the legislation, trade agreements and government policies that could impact any follow-on solicitation(s): a) Agreement on Internal Trade (AIT) does apply. b) North American Free Trade Agreement (NAFTA) does not apply. c) World Trade Organization Agreements on Government Procurement (WTO-AGP) does not apply d) Federal Contractors Program for Employment Equity (FCP-EE) does apply e) Comprehensive Land Claim Agreements (CLCAs) does not apply 5. Important Notes to Respondents Interested Respondents may submit their responses to the PWGSC Contracting Authority, identified below, preferably via Patti Wight Supply Specialist Public Works and Government Services Canada Acquisitions Branch Information Security Electronic Warfare Division QE 11 Laurier, Gatineau, Quebec K1A 0S5 T: F: E: A point of contact for the Respondent should be included in the package. Changes to this RFI may occur and will be advertised on the Government Electronic Tendering System. Canada asks Respondents to visit Buyandsell.gc.ca regularly to check for changes, if any. 6. Closing date for the RFI Responses to this RFI are to be submitted to the PWGSC Contracting Authority identified above, on or before the closing date indicated on the front page. 7. Questions to Industry Please provide an overview of your product offering(s) that are in line with the products that we have identified in Annex A and your responses to the questions therein. Page 4 of - de 6

5 W W Annex A - Statement of Requirements / Questions Overview: DND has a requirement for an integrated solution to provide a combined solution for Web Application Firewalls (WAF) and Database Application Monitoring and Protection (DAM). The solution is required to provide end to end visibility of user traffic from the desktop to the web server and ultimately to the database server. While this system is required to protect the web applications, increasing the visibility of user sessions and actions for forensic evaluation is also of high priority. Note: For the solution provided please include model numbers and expected hardware requirements for cost analysis. Objectives of the RFI include: 1. Confirm availability of products or solutions for implementing WAF and DAM technology. 2. Receive responses from the vendor community about available solutions, new techniques and technologies concerning WAF and DAM. 3. Vendors who establish via their response to the RFI how their product(s) / solution(s) meet the detailed solution requirements may be invited to provide an interactive demonstration and discuss in detail how their product(s) / solution(s) meet the listed requirements. 4. Identify challenges foreseen in this requirement. 5. Identify other important technical aspects that must be considered. 6. Estimation of the cost and the development time frame required for the proposal you would offer in consideration of the preliminary background information. DND Environment: DND are asking vendors to provide answers to the following questions in regards to how their product would integrate into an environment with the following characteristics: Windows Servers (version 2003 R2 and later) Active Directory Windows Clients (version XP, 7, 8.1) High and low latency links 10,000+ clients 10,000+ clients Backend Databases that include MS SQL, MYSQL, ORACLE Questions: Architecture: 1. Is the solution from a single vendor for procurement/support or multiple vendors? 2. Does the solution require vendor assistance to create/edit WAF or DAM rules? 3. Are there restrictions in place on any virtual appliance compared to a physical device? 4. Is the offering available as physical devices? 5. Can the solution be made up of a mixture of virtual and physical devices? 6. Is the solution available as virtual devices? 7. Can all the components of the solution be virtual (including management / WAF / DAM etc)? 8. Can the solution run inline? 9. Can the solution run as a reverse proxy? 10. Can the solution run out of band? 11. Can the solution, if running out of band, still interrupt traffic? 12. Does the system, if physical, fail open or closed? 13. Does DAM require WAF components to function or can it be standalone? Page 5 of - de 6

6 W W Can the solution function completely internal to a data center with no internet connection? 15. Are the agents required for either the WAF or DAM functionality? 16. Can the DAM work with encrypted database connections? 17. Does the solution include any tools for Web Application vulnerability testing or Database vulnerability testing? 18. Can the DAM function when the database is co-located on the web server? a. If so does this require agents of any type? 19. Can the solution send real-time data using syslog? If so: a. Can the syslog port be configurable? b. Does the solution support ArcSight CEF format event strings? c. Can the solution filter unwanted events at source? 20. When was your WAF product line last updated (Last New Hardware release date and Major Software Version release date)? 21. When was your DAM product line last updated (Last New Hardware release date and Major Software Version release date)? Management: 22. Does your solution use a single console interface for WAF, DAM and reporting? 23. Does your solution use a centralized management console for multiple deployments? a. Ie. Is there a central console for multiple instances of WAFs and DAMs 24. Does the solution integrate into any SIEM products natively? b. If so which ones? 25. Does the solution offer an alert only capability for monitoring in both WAF and DAM? 26. Does the solutions management allow for administrative least privileging through roles? Functionality: 27. Does the solution provide DAM protection as well as monitoring? 28. Does the solution provide user end to end tracking from desktop to web server to the database? a. If so what mechanisms are used to track users/sessions from desktop to DB? 29. Of the Open Web Application Security Projects (OWASP) top 10 what can the solution mitigate out of the box? 30. Does the solution include behavioural monitoring of WAF and DAM traffic? b. Ie. Over time will it identify that a specific user is accessing tables/data at times that they normally do not? 31. Does the solution allow for application learning for the automated creation of WAF and DAM rules? 32. Can the solution act as an SSL endpoint for the web application traffic removing the need to have the web server perform the SSL decryption? 33. Can the solution perform SSL decryption and re-encryption of web traffic? 34. Can the solution provide SSL encapsulation of non SSL applications? 35. Does the solution provide an updateable exploit database? c. Are the updates available in an offline package for non-internet facing solutions? d. Are there extra costs associated with the updating of the exploits database? 36. Can the solution import rules from third party scanners? e. If so which scanners are supported? Reporting: 37. Are there built in reporting capabilities for both WAF and DAM? 38. Can the solution accommodate the manual creation of reports on any captured data? 39. Is the reporting separated between WAF and DAM or can a single report encompass traffic for both so that a user's desktop to database activity can be correlated without manual interpretation of the data? Page 6 of - de 6