Pen testing

Tender description

Summary of the work Build Reviews - 4 days: Firewall Review - 2 days: Wireless Testing - 1 day: VPN - 1 day: Netscaler – 1 day: External Infrastructure - 2 days: Internal Infrastructure - 3 days: Infrastructure level scanning of the PSN domain Internal Infrastructure authenticated vulnerability analysis – 8 days: Blackberry UEM Latest start date Saturday 1 June 2019 Why the Work is Being Done Provide an independent programme of penetration and security assessment to focus on the vulnerabilities and security risks present in the infrastructure consistent with the requirements for a PSN ITHC. It is a requirement for connection with the PSN that regular CHECK ITHC’s are undergone. GCC are already connected to PSN and this is the second reconnection assessment. It is critical to GCC to demonstrate that their security controls are consistent with the requirements set out in the Cabinet Office ‘IT Health Check Supporting Guidance’ document available on the Internet from the Cabinet Office website and published June 2013. Problem to Be Solved Pen testing for PSN compliance Who Are the Users It is critical to GCC to demonstrate that their security controls are consistent with the requirements set out in the Cabinet Office ‘IT Health Check Supporting Guidance’ document available on the Internet from the Cabinet Office website and published June 2013. Existing Team GCC ICT Team Current Phase Not applicable Skills & Experience • Relevant Certifications • Share their findings with relevant parties Nice to Haves Provide evidence that they have worked with other local government companies Work Location Onsite in Gloucestershire and remotely Working Arrangments Work to take place over period of up-to 1 month No. of Suppliers to Evaluate 3 Proposal Criteria • Technical solution • Time frames • Methodology • Compliance Cultural Fit Criteria • Take responsiblity for their work • Share knowledge and experience with other members of the team Payment Approach Fixed price Evaluation Weighting Technical competence 40% Cultural fit 20% Price 40% Questions from Suppliers 1. Would you allow the work to be done from offshore if we provide enough evidence for data privacy and data protection? No. Unfortunately not. 2. Would you accept applications from CREST and CBEST certified testers? We will consider them but they will not score as highly when ranking proposals. 3. How many servers and workstations do you have? Do you use a Mobile Device Management Solution?How many firewalls and rules are there in each PSN firewall? How many different server and workstation builds do you have? How many servers and workstations do you have? Servers:DMZ2012 R2 292016 72008 R2 132008 2Main GCC estate OS Version Count2008 122008 R2 1142012 32012 R2 1732016 27+ Citrix 193 serversPNOS Version Count2008 R2 32012 8Workstations: 6391Do you use Mobile Device Management Solution? Yes - BlackberryHow many firewalls and rules are there in each PSN firewall?1 firewall, 10 rules.How many different server and workstation builds do you have? Workstations: Windows 7 Enterprise (note: Thin Clients are 32 bit). Servers: as above.