Request for Proposal (RFP) for setting up a Security Operations Centre (SOC), SIEM and Security Tools Implementation

Transcription

1 BANK OF INDIA HEAD OFFICE INFOSEC CELL RFP for setting up a SOC, SIEM and Security Tools Implementation CORRIGENDUM 8 Request for Proposal (RFP) for setting up a Security Operations Centre (SOC), SIEM and Security Tools Implementation Ref: HO: BOI/HO/RMD/INFOSEC/2015/88 dated The following table contains the revised RFP terms. Document Name /Annexure Section No./ Page no' Point in RFP Bidder Query Bank Of India Response Main RFP SLA /Page 32 Annexure 11 Page 23 / Clause & Page 18 / Clause th percentile query response time of the solution proposed by the bidder has to be within 30 seconds. Need clarification for time period under Termination by convenience clause Main RFP. Page Query Response - 90th percentile query response time of the solution proposed by the bidder has to be within 30 seconds. Please clarify, the requirement. Annexure 11 - Page : States "Bank deserves right for termination of contract after 2years of contract has been completed." Annexure 11 - Page : States "the bank reserve the right to terminate the contract at any point of time" SIEM Solution should provide 90th percentile query response time within 30 seconds. Bank reserves right for termination of contract after 2 years of contract has been completed. Please clarify that in case of Termination For Convenience, the period is at least 2 years for the date contract is signed. Also request bank to extend the period before which the bank cannot terminate by Convenience to 4 years as we are exposed to extended

2 Main RFP Page 38 / Point 6 Need clarification on Payments & Warranty start date for SIEM Annexure 2 NBAD Clarification for NBAD Solution Annexure 12 Annexure 12: Format 6 & 12 Annexure 12 Formats :- Format 6 and 12 product payments for phase 1 & 2. In the last clarification bank had stated that 90 applications need to be integrated in Phase 1 and there is no dependency on Phase 2. But as per annexure 8 page 4 there are 65 applications in Phase 1 & 25 applications in Phase 2. Please clarify that the SIEM payments on Integration & Warranty will start after integration of 65 applications of Phase 1 and there is no dependency on Phase How many monitoring points are there at each location (DC and DR)?2. What is the method of capturing the traffic by NBA? (TAP or SPAN port of the switch?)3. What is the type of interface for each monitoring point? (GigE Copper/Fiber, 10G SR/LR)4. What is the effective number of hours per day for both weekdays and weekends?5. Is there specific requirement of monitoring encrypted traffic such as incoming encrypted traffic to Bank's servers or outgoing encrypted traffic to the servers located at outside of Bank? Format 6 and 12 is same. In Phase 1, SIEM solution should be deployed. Phase I having total Three Parts. Kindly refer Main RFP Document (Page 38) 6. Project Timelines for Details. Please refer Annexure 8 as revised on for Applications. 1. DMZ, Core Segment etc. The Monitoring is Flow base. 2. SPAN and TAP base on feasibilities at NW Device Side.3. GigE Copper, Minimum 10 G.4. 24*7*365. At present not needed but it should support have compatibility to Inspect Encrypted traffic. Bidder should use Format 12 for EMD. Format 6 stands cancelled Annexure 5 Annexure 5 VM Please confirm number of devices for vulnerability management. RFP mentions 1200 whereas Technical BOM mentions 800 Main RFP Clause / Page 15 SOC RFP Please confirm total number of years for tape storage (9 years or 10 years) 1200 Devices 10 years (9years of new SOC storage and 1year of current SOC data)

3 Main RFP Clarification SOC RFP Please confirm how we should size for RSA envision logs that should be imported Sizing to be performed by selected vendor Main RFP Clarification SOC RFP Please confirm that LAN network and power will be available in SOC room and only power cables are needed for connection of LEDs and Desktops. Please confirm any other requirements. Main RFP Clarification SOC RFP Please suggest what licenses are needed for the desktops in the SOC. The corrigendum suggests that no licenses will be provided. While we can provide OS licenses, there would be a minimum configuration that the bank may support as a part of its Information Security Policy and it is necessary to understand the same. For example, bidders may not quote any antivirus solution. It is therefore advisable that the bank extends existing licenses. Main RFP Clarification SOC RFP Please confirm if HP Data Protector is to be used as the backup solution or we can chose one of our own. It would be best if the bank can extend existing backup solution license to ensure that only one software is used. Main RFP Clarification SOC RFP Please clarify total duration of the project to allow us to ensure that products do not go EOS/EOL. Out understanding is LAN and power will be provided by the bank. Power cables, specialized cords / cables to be procured by the vendor Desktop + OS licenses to be provided by the vendor, only antivirus will be provided by the bank. As mentioned in RFP, Bidder may tie-up with existing Bank s Core Banking Solution partner for said services / activity for smooth operation or Bidder may quote their own solution for Backup. 6 years of support + 1 Year Extended Support( if required) 6 months to contracting + 3 months for SIEM Implementation for Part 1 Devices + 6 years of support + 1 Year Extended Support, if needed. There is a requirement for 6 months of transition at the end. Is this included in the 1 Year of Extended Support or excluded.

4 Main RFP Clarification SOC RFP For the 2 LEDs in the SOC Room, what is the connectivity and CPU planned. Are they going to be connected to 2 desktops out of the 6 desktops in case of need or are additional systems needed? Main RFP Clarification SOC RFP For products apart from SIEM and NBAD, what are individual log retention periods that should be considered. Annexure 2 Clarification Anti APT- Point 15 & Corrigendum 3, page 10, point 43 Annexure 2 Clarification Anti APT- Point 2 & Corrigendum 3, page 10, point 44 conduct forensic analysis on historical data & A network forensics solution needs to be provided which can capture and store upto 1 month of data/100tb. Storage should be quoted as part of the solution. protect against Advanced Malware, zero-day web exploits and targeted threats without relying on signature database. Also solution must provide real-time analysis over advanced malware to provide the protection. Annexure 2 Clarification Anti APT- Point 4 identify malware present in file types and web objects such as (QuickTime, MP3 and ZIP/RAR/7ZIP/TNEF archives, 3gp, asf, chm, com, dll,ico, jar, jpeg, jpg, mov.) and be able to quarantine them. 24 solution shall perform analysis on-premise and no information shall be sent outside the Bank's Desktops to be procured of dual VGA hence connectivity with LEDs shall not be an issue Log retention period for API and APT to be minimum 3 Months. "The solution should have capability of integrating with a network forensic analysis solution if the Bank decides to implement one in the future" and solution should store all malware related events/incidents logs for analysis for period of 1 month. "The analysis must be performed real time or runtime in order to detect all the malware actions." "The solution should be able to identify malware present in file types and web objects such as (MP3 and ZIP/RAR/7ZIP/TNEF archives, asf, chm, com, dll,ico, jar, jpeg, jpg) and be able to quarantine them." If any features file types are released by OEM then same shoulde be provided to Bank without any additonal cost. " The solution shall perform analysis onpremise and no Bank data

5 Annexure 2 Clarification Other General Requirements : Security Point No 2 to 9 network where the same is deployed proposed solution should have the option to notify both the recipient and the administrator when s are quarantined. proposed solution should have the ability to either release or delete the quarantined s after detailed investigations. Clarification on clause - Solution should be able to do dynamic analysis on the s carrying URL / links and identify the malicious object. Clarification - Other General Requirements : Security Point No 2 to 9 shall be sent outside the Bank's network without consent of Bank and Only Hash value can be sent for analysis." "The proposed solution should have the option to notify administrator when malware is detected in the " This clause is changed to preferable. This clause is changed to preferable. These points would be considered/evaluated separately for the appropriate solutions where applicable. Annexure 2 Revised changes Please consider Annexure 2 as revised on Note : There is no change in any other terms or conditions except as mentioned above. In case of any further changes, corrigendum would be published.