TERM OF REFERENCE PROVISION FOR DEVELOPMENT OF MyEMAS SYSTEM, CYBERSECURITY MALAYSIA

Transcription

1 1.0 BACKGROUND 1.1 ycert proposed to develop an appliance system to enhance the LebahNet v2 (Phase I Data Collection) system for Cyber Threat Research Centre research activities relating to HoneyNet project. Currently LebahNet v2 system is able to detect and generate raw report of live malware incident attacks. 1.2 In order to enhance the project, we are taking further step into Phase II Data Analysis; namely yeas: Enhanced ulti Analyzer Service is a part of current LebahNet v2 project. 1.3 The provision is to develop an enhanced system is to integrate, analyse, correlate, and perform research analysis concerning malware threats.with the system enhancement, yeas will be able to perform analysis and display a better interactive system with an improved dashboard. 1.4 The upgrade of the yeas system will have an advanced technology and capability for stronger utilization and provide better research analysis. 2.0 OBJECTIVE The objective of the yeas appliance system enhancement are as below: i) To upgrade capacity and improve the functionality of the Cyber Threat Research Centre projects. ii) A central malware analysis platform with multiple sandboxes & multiple antivirus engines. iii) Through correlation with multiple analysis results will help comprehensive threat intelligence searching. iv) To assist in processing and analyzing of malware and data collected in the appliance system. Page 1 of 9

2 3.0 SCOPE OF WORK Proposal shall comply with all the provisions of this RFP. Any proposal not complying therewith may be disregarded. The Bidder is required to submit a proposal that shall include the following: 's SCOPE OF WORK, 1.0 yeas SYSTE ATTRIBUTE 1.1 To Develop yeas which includes the following (but not limited to): i) Should have robust API to submit sample and retrieve the result to and from ulti Sandbox and ulti Antivirus Scanner. ii) Have centralized repository to save the sandbox result. iii) Have centralized repository to save the binary sample. iv) Have web user interface for user to submit multiple files, or compressed file v) Have API for submit sample. vi) Sandbox analysis integration with Bluecoat AA, Last line Enterprise On Premise & Cuckoo Sandbox. Page 2 of 9

3 s SCOPE OF WORK, The System will have capability: i) To visualize all sandboxes& ulti AV results. ii) To have API for external access. iii) To produce report based on sample analysis. iv) To provide search capability. Please refer to yeas Overall diagram in Appendix To provide Windows Sandbox which include the following features below (but not limited to): i) To develop Windows based on Cuckoo Sandbox. ii) Analysis support for Documents (PDF, Word, Excel, PowerPoint, etc). iii) Analysis support for Executable binaries (PE, NET, Java Archive, Windows Script, etc.). iv) Analysis support for Browser components (Flash, Java Web, etc.). Please refer to yeas Sandbox diagram in Appendix 2. Page 3 of 9

4 s SCOPE OF WORK, 1.3 To provide Linux Sandbox which include the following features below (but not limited to): i) To develop Linux based on Cuckoo Sandbox. ii) Analysis support for executable binary ELF. iii) ulti Architecture support as below: x86. x86_64. AR. IPS. Please refer to yeas Sandbox diagram in Appendix To provide Android Sandbox which include the following features below (but not limited to): To develop Android Sandbox based on Cuckoo Sandbox. Please refer to yeas Sandbox diagram in Appendix 2. Page 4 of 9

5 s SCOPE OF WORK, 1.5 To provide ulti Antivirus which include the following features below (but not limited to): To develop ulti AV Scanner platform with at least 20 Antivirus support and compulsory to support AV as below: 1) 2) 3) 4) 5) 6) 7) 8) 9) 10) Noted: icrosoft Windows Defender. Trend icro. F-Secure. Kaspersky. Symantec. alware Bytes. AVG. ESET NOD32. Bit Defender. Sophos. 11) 12) 13) 14) 15) 16) 17) 18) 19) 20) Avast. Avira. Intel cafee Panda Security. Comodo Internet Security. Threat Track VIPRE Antivirus. Trend icro. Panda Security. Ikarus. ClamAV. The ulti AV will provide information such as detection and latest engine/signature update. Each AV must have engine & signature auto update capability. Each antivirus must have console based tools to scan binary file. Real time protection is not needed. Please refer to yeas Antivirus diagram in Appendix 3. Page 5 of 9

6 s SCOPE OF WORK, 2.0 To produce the user profiles creation & configuration and deployment guides for the person-in-charge in CyberSecurity alaysia which will include the complete roles and responsibilities that defined in the system. 3.0 The Bidder to restrict data sharing only with CyberSecurity alaysia. 4.0 To conduct full testing, commissioning and submission of test report TRAINING Provision of training session for10pax: i) The yeas user (CyberSecurity alaysia s personnel); and ii) The system administrator on system maintenance. The Bidder is required to provide user manual for the YEAS System during the training session. Training will be conducted at CyberSecurity alaysia. Page 6 of 9

7 s SCOPE OF WORK, TECHNICAL SUPPORT,WARRANTY AND AINTENANCE The warranty period of the deployed YEAS system would be 3 months without any charges if deployed in a hardware designated by CyberSecurity alaysia. Upon elapse of the three months warranty period, a warranty of one year would be applied. 6.2 One (1) year warranty for support and maintenance services from the date of commissioning and acceptance by CyberSecurity alaysia. Bidder must provide detail of services on the above warranty in their proposal. 6.3 Provision of three (3) years support and maintenance services from the expiry date of warranty. Service Level Agreement of 3 hours of respond and 3 working days of resolution. 6.4 The Bidder is required to have an established technical support set-up in locally. 7.0 EXPERIENCES G 7.1 Bidder must submit company profile together with at least 2 years of experience in similar service and list of client reference Page 7 of 9

8 s SCOPE OF WORK, BIDDER RESPONSIBILITY The Bidder is subjected to all existing government guidelines, procedures and regulations pertaining to the procurement and conduct of the professional services. 8.2 Bidder shall confirm that their proposal is based on the entire provision of the above scope of works/terms of reference. Bidder s partial compliance to the said scope of works/terms of reference shall be disqualified. 8.3 The bidder shall review this document and take full responsibility for obtaining the necessary information from CyberSecurity alaysia as may be required to meet the specifications and requirements. 8.4 The bidder shall review and fulfil all specifications and requirements before committing to sign the purchase agreement. 8.5 CyberSecurity alaysia reserves the right to reproduce all or part of the document submitted by the bidder for internal use. Note 1 : Cybersecurity alaysia s Requirement Level:- andatory Requirement: These are ESSENTIAL/CRITICAL requirements that UST be fully complied by Bidder. Bidder to provide document (s) to support the above said requirement. Note 2: A blank (ie. No tick in this column) shall be taken as Bidder being non-compliance for that particular line item unless otherwise specified. Page 8 of 9

9 4.0 PROJECT DELIVERABLES & TIELINE The Project should be successfully delivered not later than six (6) months from the date the Project is awarded to the successful bidder with the following details: Activity 1 Letter of Acceptance (LOA) is issued by CyberSecurity alaysia. 2 Commission of YEAS System 3 Training 4 Technical Support *Timeline(T) T1 T2 =T1+8 During T2 AfterT2 * Timeline by which activities shall be completed ( T1 is the date of the LoA issuance. means time period of a month). 5.0 POINT OF CONTACT The Bidder shall nominate personnel within its organization, whom shall be a fulltime employee of the organization to be the working together with Project Owner from CyberSecurity alaysia. The appointed person shall be the single point of contact between the Bidder and CyberSecurity alaysia Page 9 of 9