Penetration testing

Tender description

Summary of the work This is a high level overview of the requirement for Penetration testing the QUB network - details will be scoped with supplier. External testing Probing of public facing entities and scanning of the firewall for exploits. Internal Testing Scanning of 8 data centre subnets Infrastructure testing of the QUB network Specialist role Cyber security consultant Expected Contract Length 6 days Latest start date Monday 22 July 2019 Maximum Day Rate Maximum daily rate of £1000 to include travel and subsistence costs. Who Speclialist Work With Data Security Manager and IT Systems team What Specialists Work On Penetration Test of QUB Infrastructure Black box – external White box – internal (on-premises) Skills & Experience CHECK or Crest certified Nice to Haves Crest Infrastructure qualified Work Location Queens University Belfast McClay Library 10 College Park Belfast BT7 1LP Working Arrangments Expect onsite attendance for 3 days of the testing exercise Additional T&Cs Tester must be CHECK or Crest certified. Preference will be given to supplier with Crest Infrastructure qualification. No. of Specialists to Evaluate 6 Cultural Fit Criteria be able to communicate well with senior management Evaluation Weighting Technical competence 10% Cultural fit 5% Price 85% Questions from Suppliers 1. is there a preference to use an enterprise grade cloud solution e.g Veracode or is an open source solution that is required ? To be clear the requirement is for a pen tester (person) to complete testing, that individual can decide what software thy require to use to complete testing - providing the software is licensed and approved for security testing and the individual is CHECK or Crest certified. 2. have you chosen a tool yet, or is this part of the initial 6-day exercise ? To be clear the requirement is for a pen tester (person) to complete testing, that individual can decide what software thy require to use to complete testing - providing the software is licensed and approved for security testing and the individual is CHECK or Crest certified. 3. Will the 6 days be dotted across a certain amount of time? There is no requirement to complete the task in 6 consecutive days but i would imagine that the onsite work would be carried out on consecutive days. 4. Can the Authority confirm if they are already working with an incumbent supplier ? I can confirm that we are not working with an incumbent supplier.