Request for Proposal

Size: px

Start display at page:

Download "Request for Proposal"

Blanche Anthony
6 years ago
Views:

Request for Proposal F-Secure Cloud Email security and end to end security solution for Quality Council of India QUALITY COUNCIL OF INDIA 2nd Floor,

1 Request for Proposal F-Secure Cloud security and end to end security solution for Quality Council of India QUALITY COUNCIL OF INDIA 2nd Floor, Institution of Engineers Building 2, Bahadur Shah Zafar Marg, New Delhi T: / 57; F: W: E: info@qcin.org

2 Introduction Quality Council of India is looking for a F-Secure Cloud security and end to end security solution to be implemented for all the users at the Quality Council of India. Quotations are invited from F-Secure authorized dealers to provide the solution as per the below mentioned specifications. Scope of Work: The Scope of Work for the same shall include: 1. Cloud security S.No. Technical Specifications/ Features Make/ Model Offered: Proposed solution should be an enterprise class solution from an OEM in the 1 Leader quadrant (Year 2015, 2014 and 2013) of Gartner's Magic quadrant for Secure Gateways and OEM/ alliance should have presence in India. 2 The Cloud Security Solution offering should be a purpose for managing multiple domains upto 600 Users 3 Solution must include Virus protection and Spam detection which help to protects computers and data against external threats Solution must offer complete defense against threats with 99%+ anti-spam 4 accuracy and anti-virus protection from an OEM in Leader quadrant of Gartner s Magic Quadrant. 5 Solution should have false positive efficacy of 1 in 1 million 6 Solution should prevent leaks of confidential data 7 8 Solution should be able to provide multilayer spam protection and threat detection by reviewing senders reputation, Examining the complete context of a message, not just the content, performing deep content analysis, Filtering the URL within a message body, scanning URLs and processing them in real time - as the user opens them - to block malicious sites, providing anti-spam URL reputation check/ URL re-writes, protecting against attack heuristics. Solution should perform deep content analysis that should look for and malicious web content and that indicate malicious intent. block Solution should be able to examine the structure of the content looking for potential 9 risks by using multiple scanning engines that should run in parallel to ensure high performance Solution should be able to examine dynamic content such as scripts by running the scripts within the box or in the OEMs cloud infrastructure and thus monitoring of 10 malicious like hidden redirect or drive-by downloads. If malicious behaviour is detected, the script should not be allowed to pass to the end user and should be blocked. Solution should be able to detect different types of attack scams including but not limited to Phish, Charity, Robbed Abroad, Seminar, Inheritance, Financial URL, 11 Fake Deal, Bank Transfer, Fake Cashier s Check, Money Mule, Loan, Financial Phone etc. This list should be able to change dynamically keeping up with the current trends that attackers use in their attempts to get users to open URLs and/or attachments. Solution should be able to provide customized notifications as part of the 12 disclaimer template by using information such as threat category, threat type, threat description and threat level 13 Solution Should offer full support for double-byte languages 14 Solution should identify image based spam

3 15 Solution should support the end user digest facility to release the seamlessly. Solution must have the defense by testing numerous connection-level data 16 points, including DNS, MX record verification, Sender-Policy Framework (SPF)/ SenderID Framework (SDIF) verification, and recipient verification, DKIM, DMARC Solution should protect organization s reputation when filtering the outbound mail 17 stream for spam in the event an internal system is compromised by malware and becomes a source of spam Solution should support the latest BATV (Bounce Address Tag Validation) 18 specification to tag outbound messages and to validate incoming NDRs against those tags to block backscatter Solution should Protect against the most advanced forms of spam, phishing, and 19 zombie attacks, as well as addresses the newest forms of blended threats where malware is being delivered through an innocuous URL contained with a spam message 20 Solution must have Advanced anti-phishing techniques to protect end users from scams, fraud, identity theft and malicious code 21 Solution should check for personal safe and blocked lists for valid and invalid senders Solution should provide various options for end user controls including web, 22 and plug-ins. End user control features should include language selection, individualized spam threshold settings, and safelist/blocked list management 23 Solution should provide LDAP/ Active-Directory integration for Authentication and Sender Verification 24 Policies shall be configurable at a global, group, or user level w ith full integration to LDAP or Active Directory to simplify on-going administration Solution should offer outstanding accuracy against spam in any language, 25 including hard-to-analyse, multi-byte character languages such as Japanese and Chinese 26 Solution should include Zero-hour threat detection, message tracing w ith ability to find phishing messages. 27 Solution should have Bi-directional filtering 28 Solution should efficiently scan messages and attachments for potentially malicious code Solution should run virus scanning with other forms of message analysis (such as 29 spam and other message filtering actions) parallel to minimizes latency and improves the system s overall scalability System should able to support to analyse the all languages in the world including 30 Arabic, Urdu, so that mails written in supported language can be content analysed before delivering to mail server. Limit on attachment can be customizable per user basis, Ex: Separate group may 31 be created so that higher privilege users have higher quota limit say 15MB attachment whereas normal users may be restricted to 5MB. 32 Solution should offer Flexible policies w hich allow administrators to customize the handling of messages based on the results of virus analysis. Solution should accurately detect and quarantine only those messages associated 33 with an emerging virus, without stopping legitimate . Instead of quarantining all with attachment types deemed to be dangerous 34 Solution should offer a convenient graphical user interface to customize Zero-Hour Anti-Virus policies 35 Solution provide a complete view into the operation of your Zero-Hour defences and virus activity in general Solution should be able to identify and prevent a wide variety of inbound and 36 outbound policy violations, including offensive language, harassment, file sharing and many more Page 3 of 6

4 4 37 Solution must Monitor inbound/ outbound message flow, including attachments, for compliance throughout the enterprise. Solution should be able compare message content with dictionaries in order to 38 protect businesses from the use of inappropriate or offensive content and other issues that can surface through usage Solution should include Attachment scanning and support for custom or proprietary 39 document types Solution should offer configuration of the Custom policies through a graphical user 40 interface, which allows messages to be analysed and processed, based on a comprehensive list of message attributes Solution must support 40,000 mailboxes from day one and should be scalable to 41 2,00,000 in future 42 Solution should include a feature for Troubleshooting the logs management interface (the delay must not exceed the 5 min) 43 Solution must be IPv6 compatible Solution should be able to distinguish between spam and marketing mail from a legitimate source and should also allow users to safely un-subscribe. Solution should allow before an upgrade if box can handle the upgrade and alert admins if utilization exceeds thresholds Solution should allow to generate reports that depict separate entries showing the number of Marketing, Social Media, and Bulk messages caught / identified Solution should also show a sender profile report that shows the number of 47 Marketing, Social, and Bulk messages received from that domain for the designated reporting period Solution should have Web or URL Tracking where it should allow administrators to track the end users who click on URLs that have been rewritten by the Security solution OR 48 Solution should have Web or URL reputation check mechanism where it should provide real time lookups for rapidly changing spam content such as URLs, and block the in real time. Solution should have multiple on-box reports (PDF, Excel, HTML formats) showing the following (but not limited to). Also, the solution should support report scheduling. 49 Summary Dashboard/ Executive Summary Global Message trends/ Mail Summary Attachment Volume/Size trends/ Outbreaks Virus Classification trends/ Virus Details Solution should support automatic scanning and the use of proven and up-to-date policy filters where s with sensitive content are encrypted without user action. Solution should support to encrypt and automatically decrypt if recipients use the same encryption platform, while for others who don't use the same platform, recipients should still be able to receive the message using trusted delivery method. Solution should be able to support convenient mobile delivery of messages for smartphone and tablet users encrypted Solution should support secure, cost-efficient, highly available and fully redundant key storage facilities Solution should support expiration of encrypted messages and the ability to revoke any individual message to any one specific individual Solution should support One-step encrypted delivery for mobile, laptop, and desktop users 56 Solution should support reading of encrypted message on mobile device with a mobile interface for a better user experience 57 Solution should support the identifiers-algorithmic checks for structured data

5 Solution should support DLP which offers Dashboard that provides a single, 58 consolidated view of all compliance activity across an organization with real-time statistics, the ability to drill into any specific incident and take immediate action 59 Solution should support the self-remediation for outbound spam and DLP violations 60 Solution should support secure documents that need to be kept confidential 61 Solution should cover privacy and data security regulations including HIPAA, GLBA, PCI, SEC rules, and many more. 62 Solution should include description of the activities (predictive + tag-based) 63 Solution should include Separate processing of unauthorized advertising (the user can choose what to do, to prevent, to subscribe for, reporting) Solution should have separate treatment for Phishing messages (prevention, 64 subscribe, reporting) 65 Solution should have User summary of the scheduled Message by company 66 Solution should check the reputation of the links in real time 67 Solution shoul d include force TLS encry pti o n 68 Solution should support feature to delete encryption key after sending 69 Solution should support the push policy based encryption as well along with the traditional pull policy based encryption Solution should support security and encryption should be able to satisfy encryption regulatory requirements without being a burden on the senders, recipients, or administrators. These requirements should include: PCI, 70 Health Insurance Portability and Accountability Act (HIPAA), Sarbanes -Oxley (SOX), Gramm-Leach-Bliley Act (GLBA) that trigger for metadata content extracted from Microsoft Office document attachments and PDF file attachments Solution should support encryption feature should work without installing a 71 program 72 Solution should support Simplified encryption key management 73 Solution should support a feature of automatic applying of encryption based on your organization s policies 74 Solution should support Native, integrated, and strong encryption technology 75 Solution should include automatic reporting tool, 76 Solution should include multiple ways to publish reports 77 Solution should include customized reporting for each customer 78 Solution should include Branded guidelines reportsaccording to your company s visual 79 Solution should include easy to portal. manage through a web-based administration 80 Solution should include quarantine management 81 Solution must include Alert monitoring 82 A single solution should support O365 & Google for work mailboxes. 83 System should seamlessly be integrated with third party SIEM tools 84 Solution should allow administrator to setup Sub-organizations with the Delegated Administration feature Solution should be configurable to work as both Active-Active and Failover Cluster and manageable through a common web based management console. Solution Should include the support for 3 years

6 F-Secure Anti-Virus Specifications Sr. No. Features 1 Solution must provide Complete security solution to protects all levels of IT infrastructure 2 Solution must include Protection.(Pop3,Smtp,Imap) 3 Solution must have Browsing & web traffic protection and Category wise blocking of websites and content Filtering 4 Solution should have Signature based & Heuristic scan engine 5 Solution must do the Vulnererability Scanning and Patches Installation (OS & 3rd Party) 6 Solution should Patch Management for 3rd party patch installation for clients & server machines 7 Solution should have the Application Control 8 Solution must support Device Control (USB,CD/DVD,Infrared,Bluetooth etc) 9 Solution should have the inbuilt Intrusion Prevention System 10 Solution should have the inbuilt Firewall with Intrusion Prevention detection 11 Solution must have Centralised Network Quarantine with option to release the quarantined 12 Solution should support Schedule Scanning 13 Solution should support Remote Installation 14 Solution should have Endpoint security self-protection (Centrally) policy 15 Solution should have Endpoint Security unload option control (Centrally) Policy 16 Solution must be Robust with multi-layer security & multiple scan engines 17 Solution must have Web based reporting 18 Solution must have the centralised management visa dedicated Console application access to avoid the browser based attacks that can compromise the AV server if accessed via web browser 19 Superior security for business-critical assets with Connection Control, an extra layer of protection to hide business-critical connections, such as banking connections, for the outside world Solution must have the Advanced protection for web traffic scanning to block e.g. Java 20 applications from unknown or suspicious sources 21 Deep Guard notices malicious behaviour (Like: -Ransomware, batch, script etc) 22 INSTALLATION PACKAGE (32 bit / 64 Bit) 23 Solution should have the Hidden File Scan Solution should support Neighbour cast as option for Antivirus update distribution for efficient 24 use of LAN bandwidth 25 Offline Activation 26 Solution should support Virus alert through 27 Solution should support central management for Linux machines 28 Solution must have Integrity check for Linux 29 Solution must have Firewall for Linux endpoints 30 Window Host File Protect

7 31 Centralised Antivirus Server must have the flexibility to be hosted upon Windows and Linux as an Operating system 32 Solution must have support the Security for Virtualised infrastructure (VMware, Hyper V & cirtix) Solution for virtualised must support offloading of scanning to a scanning server (For 33 VmWare,Hyer V & Citrix) 34 Solution must have the option to install management server on windows & Linux servers 35 Solution should have Botnet Blocker 36 Http Proxy Server 37 Host and Server communication over HTTPS 38 Remotely collecting Diagnostic information of host 39 Financial transaction control through browser 40 Asset Management for IP, Hostname, Windows, Mac Add 41 Solution should have Cloud Security Network 42 Five Layers of Protection Other Terms and Conditions: 1. The Service provider must be an authorized F-Secure dealer. 2. The Service Provider must be a legal entity registered anywhere in India. 3. The Service Provider must have a valid GST Registration Certificate in India. 4. The quotation must include the prices for a one year and a three-year license. 5. The number of users shall be approximately 650 which can be increased/decreased as per the requirements. Financial Proposal The financial proposal should contain the quotation for a one and three-year license having the abovementioned specifications. Submission Details Interested parties may send their Financial Proposals along with other details in a sealed envelope super-scribing QCI-Anti Virus Solution to Assistant Director(Accounts), Quality Council of India, Institution of Engineers Building, 2nd Floor, 2, Bahadur Shah Zafar Marg, New Delhi latest by October 9, 2017, 12 PM.

MESSAGING SECURITY GATEWAY. Solution overview

MESSAGING SECURITY GATEWAY. Solution overview MESSAGING SECURITY GATEWAY Solution overview April 2017 CONTENTS Executive Summary...3 The case for email protection and privacy... 3 Privacy in email communication... 3 LinkedIn Phishing Sample...4 Messaging