PROTECTIVE MONITORING SERVICE G-CLOUD SERVICE DEFINITION 15
Table of contents 1 Introduction...2 2 Service Overview...3 2.1 Protective Monitoring...3 2.2 Service Description...4 2.3 Scenario: Basis for price...5 2.4 Technical Requirements...5 2.5 Customer Requirements...5 2.6 Optional Additional Services...5 2.7 Associated BAE Systems Managed Security Services...6 3 Service Delivery...8 3.1 Service management...8 3.2 Service constraints...8 3.3 Service Levels...8 3.4 Information assurance...9 3.5 Backup/Restore & Disaster Recovery...9 3.6 Data restoration / service migration...9 3.7 Trial Services...9 3.8 On-boarding...9 3.9 Training... 10 4 Commercial Arrangements... 11 4.1 Pricing... 11 4.2 Ordering and invoicing process... 11 4.3 Customer responsibilities... 11 4.4 BAE Systems Managed Security Protective Monitoring Terms and Conditions... 12 4.5 Termination terms... 12 4.6 Financial recompense model for not meeting service levels... 12 4.7 Intellectual Property... 12 5 Applied Intelligence: Information Intelligence... 13 Protective Monitoring Service Page 1 of 14
1 Introduction BAE Systems Applied Intelligence (formerly known as Detica) Cyber Security capabilities within G-Cloud are drawn from our portfolio of services and solutions which are designed to assist organisations in making cyber space safe for business and governments. Our capabilities are organised into the four principal areas of Prepare, Protect, Monitor and Respond as shown in Figure 1 below. Business and technical services that help our customers understand and manage their cyber risk, make informed investment decisions and drive through improvements. Repeatable products and solution integration to protect business critical information from cyber attack and enable secure collaboration with partners, clients and employees Products and services that monitor networks to identify malicious behaviour, understand its intent and prevent it from achieving its goal. Consulting services which minimise the business impact of a successful cyber security attack through remediation and crisis management Figure 1 - BAE Systems Cyber Security Services BAE Systems Cyber Security offering to G-Cloud is based on elements from the Prepare and Monitor capability areas as described in the following Service Description documents: BAE Systems Managed Security Protective Monitoring Service (this document) BAE Systems Managed Security Advanced Threat Detection Service BAE Systems Managed Information Assurance Services BAE Systems Security and Information Risk Services Protective Monitoring Service Page 2 of 14
2 Service Overview 2.1 Protective Monitoring The BAE Systems Managed Security Protective Monitoring Service is a real time security monitoring service that detects and notifies the Customer of Security Incidents on the monitored network, as supporting compliance for standards such as GPG13. The Security Incident Notification and regular Security Incident reporting processes provide visibility of Security Incidents and malicious behaviour impacting the Customer s business. In addition BAE Systems continually develops rules and content for the Protective Monitoring platform using information derived from our Threat Intelligence and Advanced Threat Detection Services to develop new Indicators of Compromise (IOCs). BAE Systems Operational service is depicted in the figure below and comprises the Protective Monitoring service in addition to a number of supporting services which enable this service, such as, Service Desk, Service Management, Threat Co-ordination and Technology Support. Security alerts are triaged by our analysts and on detection of a security incident, analysts have access to threat information and empirical knowledge to prioritise incidents and reduce false positive rates. Security incident reports contain recommended remedial actions and the necessary contextual information to allow the security incident to be resolved. Clients and third parties can interact directly through our Service Management portal or through sending an email to the Service Desk, allowing customers to create and update Incidents and Service Requests with pertinent information. The Service Management portal provides a secure fully audited environment which also provides access to service performance information and reports. Protective Monitoring Service Page 3 of 14
2.2 Service Description In the delivery of this Service BAE Systems shall: Protective Monitoring Collect Security Data from collectors deployed as BAE Systems CPE on the Customer environment. The details of deployment are provided within the Deployment Plan; Transfer collected Security Data in near real time 24/7/365 according to the SLAs from the Customer monitoring environment to the storage Solution in compliance with an agreed Code of Connection (CoCo); Generate Security Alerts by processing Security Data using detection rulesets and compliance rulesets (such as GPG13, depending on requirements); Deploy new or modified Rulesets that have been confirmed by BAE Systems to accurately identify cyber threats, to continually improve the generation of Security Alerts; Process and analyse the Security Alerts generated by the SIEM throughout the agreed Service Hours; Raise a Security Incident once a threat has been identified by a BAE Systems security analyst; Security Incident Investigation and Remediation Advice Prioritise Security Incidents against an agreed Prioritisation Schema and log as a Security Incident within the BAE Systems ITIL v3 aligned Service Management Tool; Conduct a triage of each Security Incident prior to it being issued to the Customer; Access the BAE Systems knowledge base to check for any known remediation instructions related to the Security Incident, for example where it is a repeat incident. Attach known remediation instructions to the incident where these are identified to aid the Customer in incident remediation Generate remediation instructions in response to previous Security Incidents; Accept known remediation instructions provided by the Customer to BAE Systems through the BAE Systems Service Desk, for subsequent inclusion in future Security Incident reports; Client Service Desk Communicate to a single destination within the Customer the details of Security Incidents that conform to the agreed reporting criteria and according to the timescales defined in the agreed Service Levels; The communication will be via email over an appropriately secure channel as specified within the Deployment Plan, with a confirmatory phone call for P1 level incidents; Where further information is identified by the Service which relates to an existing Security Incident, BAE Systems shall communicate, to a single destination within the Customer an update to the Security Incident. Protective Monitoring Service Page 4 of 14
2.3 Scenario: Basis for price The price provided has been generated using the following scenario: Maximum events per second of 20 Protective Monitoring to a maximum of GPG13 DETECT Security data relating to the following devices will be monitored: o o o o o o 95 user laptops/workstations 5 low volume additional devices (printers, wireless etc.) (by agreement) 20 servers 2 routers 2 firewalls 2 business applications 2.4 Technical Requirements BAE Systems shall deploy log collection applications on a virtual machine infrastructure provided by the customer in their own data centre. This virtual machine should be deployed in a management VLAN that is remotely accessible to BAE Systems staff via a VPN connection connecting the BAE Systems data centre environments to the customer estate. The customer will provide BAE Systems with access and credentials to install the collection applications. Network connectivity between the customer and the BAE Systems Security Operations Centre (SOC) will be achieved through an Internet VPN link that will be supplied by the customer. BAE Systems compress all data traffic that is extracted from the client environment to reduce the required bandwidth utilisation. With respect to the maximum events-persecond (EPS) of the environment being 20 the required bandwidth will be around 0.3 Mbps. 2.5 Customer Requirements The Customer shall: Manage all remediation activity associated with a notified Security Incident; Provide an appropriately secure single point of email channel for receiving notification of Security Incidents; Provide connectivity to the Customer site for transfer of Security Data. 2.6 Optional Additional Services BAE Systems have not scoped the following services into the above scenario as they are not core to Protective Monitoring or associated compliance monitoring. If these services are required, BAE Systems will discuss your requirements and propose a suitable service and associated prices. Protective Monitoring Service Page 5 of 14
Security Log Retention: Collected security data, and historical correlation/analysis (as well as associated alerts) for any duration from months to years, both online, near-line and offline as required. Security Device Management: BAE Systems will manage your network security devices, including (but not exclusively) firewalls, IDS/IPS, web proxies and vulnerability management services. Response services: BAE Systems Cyber Response services are one of only four CESG Cyber Incident Response Scheme providers and we have responded to many varied and complex targeted attacks, insider attacks and more over several years and have a proven methodology. Services include forensics (including emails, servers, network data and logs) and incident management services. These services are available as per-incident services or on an annual retention basis. Threat Intelligence: BAE Systems Managed Security services are built upon and continuously improved by our Threat Intelligence research and collaboration. Elements of this service are also available as an advisory service to further help UK Government customers prepare for and response to cyber security incidents. BAE Systems Managed Security Advanced Threat Detection (as detailed below) 2.7 Associated BAE Systems Managed Security Services Protective Monitoring provides holistic protection through the ingest and analysis of live log data, and delivers real time alert of security incidents leveraged from data available from existing security infrastructure and known threat signatures and likely indicators of compromise. The Protective Monitoring Service is part of the wider BAE Systems Managed Security service portfolio, and compliments the Advanced Threat Detection service. Advanced Threat Detection compliments and extends your security monitoring by focussing on network and application behaviour from collected data, providing deep insight into sophisticated threats using metadata gathered from network traffic, emails, web traffic and DNS lookups. Our monitoring for advanced threats identifies deep rooted and complex threats which may lay dormant for many years, slowly gathering IPR or sensitive confidential data in preparation for future exfiltration. These threats are rarely identifiable using traditional security tooling and are designed to not be detected through monitoring of gateways and firewalls. Together, the BAE Systems Managed Security monitoring services offer unparalleled confidence in security posture and on-going protection against the full spectrum of cyber security threats. Protective Monitoring Service Page 6 of 14
When taken together, there are also operational benefits and overlaps that lead to operational cost reductions please contact BAE Systems for more information on procuring a combined service as opposed to individual lots. Protective Monitoring Service Page 7 of 14
3 Service Delivery 3.1 Service management BAE Systems manages the delivery of Services to the Customer using ITIL v3 aligned Service Management practices. This includes Service governance, escalation and continual Service improvement. Standard Service Reports will be provided as part of the Operational Services. Name Description Format Due Service Delivery Management Report Monthly/Quarterly Service Review Annual Service Review A report delivered to the Customer detailing the Incidents detected, as well as performance against all Customer Service Levels Face to face review of Service Delivery with the BAE Systems Service Delivery Manager and the Customer Account Manager Face to face review of Service Delivery with the BAE Systems Service Delivery Manager, the Customer Account Manager and the Customer Director(s) PDF report via (encrypted) email Slide deck for discussion at Customer or BAE Systems offices Slide deck for discussion at Customer or BAE Systems offices Monthly Quarterly Annually The pricing assumes customer site visits within the M25 or BAE Systems Guildford office 3.2 Service constraints The service and corresponding pricing has been sized to the scenario contained in section 2.3 in order to offer a representative price for comparison purposes. BAE Systems can however operate the Protective Monitoring Service for larger estates, monitoring many thousands of devices and a wide variety of devices and applications. 3.3 Service Levels The scenario and corresponding pricing has been based on the scenario contained in section 2.3 and on the following indicative service levels Service Measure Channel Threshold P1 Security Incident Notification P2 Security Incident Notification P3 Security Incident Notification Email sent to Customer Report sent to Customer Report sent to Customer 75 minutes (95% within Target Incident Notification Time if 20 or more incidents or no more than one failure if less than 20 incidents) Included within the Monthly Security Incident Report Included within the Monthly Security Incident Report Protective Monitoring Service Page 8 of 14
P4 Security Incident Notification Availability of Protective Monitoring Report sent to Customer P1 Service Incident duration Included within the Monthly Security Incident Report 97% Availability The service Levels above a subset of the standard set of measures. 3.4 Information assurance The service as described above is only available for customer estates assured to IL3 and below. For IL4 and above (where the security meta-data is of the same impact level), or GPG13 compliance levels above detect please contact BAE Systems to discuss your requirements further. 3.5 Backup/Restore & Disaster Recovery Disaster Recovery is included in the scope of this proposed scenario, the RPO for the scenario in this proposal is 4 hours and the RTO for the scenario in this proposal is 48 hours. BAE Systems maintain a Business Continuity Plan should a scenario arise that affects the ability of our analysts to operate from the Security Operations Centre, at which point the operation of the service shall be from an alternate BAE Systems site. 3.6 Data restoration / service migration Not applicable. 3.7 Trial Services Trial options are not possible with this service. 3.8 On-boarding During the Transition phase BAE Systems will work closely with the Customer to align the processes delivered by BAE Systems with the Customer business processes required to deliver the Operational Service. BAE Systems will deliver the following deliverables as part of transition phase: Protective Monitoring Policy; Deployment Plan; Operational Service Pack, During the transition phase there will be two key delivery milestones: Interim Operational Capability (IOC): The point at which there is an operational service executing and service charges become effective. Full Operational Capability (FOC): The point at which the service is fully operational and has completed Operational Acceptance Test (OAT) and all SLAs become effective. Protective Monitoring Service Page 9 of 14
The Customer shall: Make available suitable security and network architects to work with BAE Systems and attend workshops and to work with BAE Systems to define and agree the Operating Policy. Provide an Event Source list, providing the IP address of each asset from which Security Event data will be collected on the Customer estate; Allow site access to BAE Systems engineers as required to carry out break fix processes; 3.9 Training Transition is dependent on individual customer requirements; It is estimated that the transition will be approximately 4-6 weeks duration. Not applicable. Protective Monitoring Service Page 10 of 14
4 Commercial Arrangements 4.1 Pricing 4.1.1 Price to operate The price (excluding VAT) for the service is 137 per day, which equates to approximately 50,000 per annum, for a one year commitment. For a price which meets your specific requirements please contact BAE Systems. 4.1.2 Scenario restrictions A single geographic UK data centre and a single UK based office location IL0-IL3 accreditation, where IL3 metadata may be monitored from an IL2 platform. Protective Monitoring to a maximum of GPG13 DETECT Operation: UK business hours (8x5) service Monitoring by exception: the platform will be tuned to high severity issues such as IPS alarms, firewall denies and login failures. Low existing threat level in the monitored estate o If, through due diligence, BAE Systems believe there to be a greater existing threat this will be addressed through the transition phase No customer requirement for log retention: this will be defined at contract negotiation depending on customer requirements. Service operation only: See the On-Boarding section above for an indicative timescale for transition. Exit costs are not included in this price. 4.2 Ordering and invoicing process The Customer shall pay Supplier for the G-Cloud Services in the amount or at the rates set out in section 4.1 together with all reasonable travel and subsistence expenses and any other direct, non-labour charges as may be applicable. Supplier will invoice the Customer quarterly in advance i.e. for the depicted scenario 12.5k on the contract start date, and each quarter thereafter. All sums payable by the Customer to Supplier shall be paid, without discount, set-off, counterclaim or other deduction within 30 days from the date of Supplier s invoice. Applicable taxes (including value added tax) shall be payable additionally by the Customer at the prescribed rate at the time of invoicing. The Customer shall notify Supplier in writing within 7 days of receipt of an invoice if the Customer considers all or part of such invoice incorrect or invalid for any reason and the reasons for disputing payment failing which the Customer will raise no objection to any such invoice and will make full payment in accordance with it. 4.3 Customer responsibilities The Customer shall provide to Supplier at no charge and in a timely manner, all such documents information, materials, facilities, support, services and co-operation relating to the G-Cloud Services including (without limitation) computer programs, data, reports and specifications and other information (together Customer Material ) as Supplier may reasonably require for the proper performance of the G-Cloud Services and within sufficient time to enable Supplier to perform those G-Cloud Services and the Customer Protective Monitoring Service Page 11 of 14
shall ensure that such are accurate and complete, and Supplier shall be entitled to rely upon such as being accurate and complete without seeking to verify or check it. The Customer shall provide Supplier, its agents, subcontractors, consultants and employees, in a timely manner and at no charge, with access to any of the Customer's premises, office accommodation, equipment, systems, networks, software, data and other facilities as reasonably required by Supplier. 4.4 BAE Systems Managed Security Protective Monitoring Terms and Conditions The full terms and conditions for this service can be found in BAE Systems Applied Intelligence MSS MSA. 4.5 Termination terms Not Applicable 4.6 Financial recompense model for not meeting service levels Not applicable. 4.7 Intellectual Property Details of the terms and conditions of the foreground IPR, please see the BAE Systems Applied Intelligence MSS MSA. The proposed service in this document encompasses some elements of the Threat Intelligence service; in addition to the standard IPR terms and conditions please be aware of the following additional IPR restrictions: Ownership of copyright and all other intellectual property in the Threat Intelligence Deliverables and Services shall remain with BAE Systems at all times. Subject to payment in full of each instalment of the fees for the Services Customer is granted a nonexclusive, non sub-licensable, non-transferable, non-assignable, limited royalty free license to use and copy the Threat Intelligence Deliverables solely for the Customer s internal business purposes. The Customer shall expressly not: (i) sublicense, distribute, publicly perform or display, or otherwise share or make accessible any Threat Intelligence Deliverables, data-feed, signatures, metadata, analysis, tools or results from the Services or portions thereof to a third party; (ii) export the Threat Intelligence Deliverables, data-feed, signatures, metadata, analysis, tools or results from the Services, in whole or in part, in violation of applicable laws or regulations or; (iii) use the Services to offer products and services competitive with those of BAE Systems, as reasonably determined by BAE Systems. All rights pertaining to Threat Intelligence, in all materials created by BAE Systems during its performance of the Services shall vest in and be the sole property of BAE Systems. Protective Monitoring Service Page 12 of 14
5 Applied Intelligence: Information Intelligence BAE Systems Applied Intelligence is an information intelligence specialist. We help government and commercial organisations exploit information to deliver critical business services more effectively and economically. We also develop solutions to strengthen national security and resilience, enabling citizens to go about their lives freely and with confidence. By combining technical innovation and domain knowledge, we integrate and deliver world-class solutions often based on our own unique intellectual property to our customers most complex operational problems. We recognise the importance of Cloud services to the realisation of HMG s IT Strategy and have optimised many of our most compelling IT service offerings for Government on G-Cloud. Through these offerings we are at the forefront of realising the full benefits of Information Technology for our customers. Below is a summary of our G-Cloud services. G-Cloud Service Consultancy Service Integration and Management (SIAM) Information Security Agile Design and Delivery Architecture Data Services Service Description Providing Business and IT strategy and transformation consultancy services, including requirements management, organisational change, and business case & benefits management. Covering all aspects of SIAM services, from target operating model design, to service integration, supplier management, architecture and transition and transformation management. Cyber security assessments, architecture and testing services; Threat detection, protective monitoring and security management services; Cyber incident response, and Industrial Protection, Secure Web Gateway and Cross domain services. Services delivered using the Agile method for design and development, including Secure-by-Design services. The design of end-to-end architecture solutions, including infrastructure, operations, applications and service, as well as enterprise architecture. Data management, protection and exploitation services covering people, process, data and technologies. Includes maturity assessments, organisation design and provision of data analytics services. Programme Management Digital Media Secure Mobility & MobileProtect Provision of programme management and support experts to provide delivery and/or assurance of internal and external programmes. Digital transformation, media development, including user experience, social business and mobile media. From mobile strategy, through to development of your secure mobile proposition for your user base; Cloud based protection for your user base portfolio of mobile devices. NetReveal OnDemand Cl Cloud based delivery of the global leader in counter fraud software. For more details on our G-Cloud services for G-Cloud, visit www.baesystemsdetica.com/g-cloud or send us an email at gcloud@baesystems.com. Applied Intelligence is part of BAE Systems, the premier global defence, security and aerospace company. BAE Systems delivers a full range of products and services for air, land and naval forces, as well as advanced electronics, security, information technology solutions and customer support services. Protective Monitoring Service Page 13 of 14
Applied intelligence Limited is a BAE Systems company, trading as BAE Systems Applied Intelligence. Applied Intelligence Limited is registered in England (No.1337451) with its registered office at Surrey Research Park, Guildford, England, GU2 7YP. Copyright BAE Systems plc 2014. All Rights Reserved. BAE SYSTEMS, APPLIED INTELLIGENCE and the names of the BAE Systems Applied Intelligence products referenced herein are trademarks of BAE Systems plc and are registered in certain jurisdictions. Protective Monitoring Service Page 14 of 14