Penetration testing - ORR Network

Tender description

Summary of the work Penetration testing required. ORR requires penetration testing of its network. The work will involve all areas of ORR's network including cloud applications. Specialist role Cyber security consultant Expected Contract Length No longer than a month? Latest start date Monday 13 January 2020 Who Speclialist Work With Working for the Security manager and with the Service delivery manager and Technical services manager What Specialists Work On Carry out Penetration testing across ORR's network including cloud applications. Skills & Experience • Excellent understanding of mixed cloud and on-premise networks • Good Knowledge of NCSC security principles and best practice Nice to Haves • Knowledge of HMG baseline cyber security standards • Experience of working with small government or public sector organisations Work Location ORR HQ is in London but we also have 5 other locations. Working Arrangments A period of time working with the team on-site at HQ. Drafting the report (offsite) and then presentation of the findings at on-site at HQ. May include a check from one of the Regional locations. Security Clearance At least government baseline. Additional T&Cs Organisation bidding for the work will need to be Check accredited. No. of Specialists to Evaluate 3 Cultural Fit Criteria • Ability to work with our technical team (2 members) against a background of daily operational priorities. • Confident and with good communications skills. Evaluation Weighting Technical competence 40% Cultural fit 20% Price 40% Questions from Suppliers 1. Is there an incumbent supplier. There is no incumbent supplier. 2. Does this role sit inside or outside of IR35. We envisage that this service is provide by a company, possibly a lead contractor and would be outside of IR35. 3. Will government help the specialist to acquire baseline minimum security clearance. No, The contractor involved should have the requisite clearance. Baseline clearance is through a DBS check. 4. Questions regarding External and external infrastructure (combined) External Infrastructure• Number of active Internet facing IP addresses? We have 4 external facing IP’s• Types of publicly accessible services (e.g. FTP, SFTP, SMTP)? Just SMTPInternal Infrastructure• Number of workstations? We have 350 workstations on the network• Number of servers? We have 7 Physical server and a number of VM’s• Which operating systems are in use? Windows 10, Windows Server 2008, 2012, 2016• Is the network segmented or flat? It is Segmentedo Can all networks/VLANs in scope be accessed from one network point? Yes this is possible 5. Further information regarding Internal infrastructure - 2; o Number of networks/VLANs in scope? We have 10• Is there any Wireless capability? Yes there iso Number of Access Points? There are around 30 AP’so Number of SSIDs broadcasted? There are 4 availableo What types of authentication are in use, if any? WPA2, Captive Webportal back to Radius server• Where is geographical location of the internal environment? Around the UKo If there are multiple sites, where are the locations for each? London, Manchester, Birmingham, York, Bristol, York o Can all locations be accessed from one main site? Yes they can be accesses 6. Information on firewalls etc (from question). Firewall Review/Rulebase Review• Number of Firewalls including brands? There are 9 firewalls in total• Is the requirement for a full firewall configuration review and/or a rulebase review? It is for both• Number of rules per rulebase/firewall? 30 7. Answers to questions around external architecture - Azure Azure InfrastructureNetworking• Number of Virtual Networks There are 2• Number of Network Security Groups (Azure FWs) There are 5• Number of User Security Groups 0• Network Diagrams Not at this stage• Can this network be access from an on-premise environment? Yes it Can be accessed 8. Questions about external architecture - Azure and Networking. Compute• Number of VMs within the Azure Tenancy around 40 VM’so Are they custom built or deployed from within the Azure VM Pool (eg Palo Alto VMs etc) Mostly customer builtAWS InfrastructureNetworking• Number of VPCs Not applicable • Number of Security Groups Not applicable• Number of Network ACLS Not applicable• Network Diagrams Not applicable• Can this network be access from an on-premise environment? Not applicableCompute• Number of EC2/Lightsail servers Not applicable 9. You mention that 'ORR HQ is in London but we also have 5 other locations'. Could you please advise where the other 5 locations are? Are they all UK based? We have offices in the City centres of the following locations in addition to our London HQBristolBirminghamYorkManchesterGlasgowThese are all between 15 and 25 people. No non-UK offices.