Prototype for Automated Network Defence Actions (PANDA)

Tender description

Why the Work is Being Done The UK MOD along with the commercial sector is heavily reliant on strategic and enterprise systems in both fixed and deployable contexts. Such systems can contain hundreds or thousands of endpoints across multiple locations, potentially in different countries and with varying levels of communication bandwidth and stability. These systems of systems are becoming highly dynamic and complex, which requires highly skilled operators to respond and recover from an ever increasing variety (in terms of sophistication and methods of operation) of threats. Problem to Be Solved Currently response and recovery processes that are predominately mandraulic, with the ever increasing complexity placing a larger cognitive burden on a limited resource. Moreover, in increasingly federated/coalition mission environments, boundaries of system ownership and management authority are more porous. In these environments, response and recovery actions must be coordinated across operating authorities. Existing security orchestration products are ill suited to these situations. Who Are the Users To address these challenges, Dstl is currently conducting research to raise the technological readiness level of automated network defence capabilities. To support this research, Dstl has developed the Prototype for Automated Network Defence Actions (PANDA). PANDA, which is written in Python 3, provides a proof of concept implementation that is capable of responding to incidents on networks automatically. It has also been designed to allow new components and concepts to be integrated quickly. This SOR is for software development resources to support continued development of PANDA. Early Market Engagement Work Already Done During FY 14/15, Dstl ran an industry call through the Defence and Security Accelerator (DASA) to research and develop techniques to support the planning and orchestration of automated responses to protect networks facing complex multi vector attacks. Follow-on work in 2015/16 specifically examined automated Course of Action (CoA) analysis. In FY18/19, Dstl selected one of these concepts to form the basis of PANDA. Through two phases of development activity, PANDA has been matured from a high level conceptual design into a proof of concept software implementation. Existing Team The supplier will be working with a dedicated technical partner from Dstl for day to day interaction. Alongside this will be a small team from the project, who will contribute new concepts and components to PANDA. This team will act as hosts, when or should the need to work on the software on our site arises. This team operates out of their own laboratory space which is equipped to support software integration and development. Current Phase Alpha Work Location We would expect the majority of the work to be conducted at the suppliers own address, but there maybe times when both formal meetings and development work will take place at our Salisbury Site. Working Arrangments To ensure that new capabilities can be readily integrated into PANDA as the concept develops and evolves, the project will utilise an iterative and incremental approach to delivery. The supplier must adopt an Agile system engineering approach (e.g. Scrum) and work closely with the Authority throughout the development process to realise the project’s aims. It is expected that this work will require significant dialogue between the Authority and the supplier throughout the contract period; the Authority will make staff available to support this. Security Clearance Able to handle OFFICIAL material only. Additional T&Cs DEFCON 76 (EDN 12/06); DEFCON 501 (EDN 05/17) – (NOTE ONLY TO BE USED WHEN INTERPRETING THE DEFCONS); DEFCON 531 (EDN 11/14); DEFCON 608 (EDN 10/14) ;DEFCON 611 (EDN 02/16); DEFCON 649 (EDN 12/16); DEFCON 659A (EDN 02/17); DEFCON 703 (EDN 08/13).FULL TEXT VERSIONS OF THE DEFCONS CAN BE FOUND VIA KNOWLEDGE IN DEFENCE (KID) https://www.gov.uk/guidance/knowledge-in-defence-kid Skills & Experience Demonstrate with evidence the ability to deliver without authority funded capability enhancements (for example, procurement of additional ICT to support development activities). Demonstrate, with evidence the ability to conduct agile software development in-house, without support from subcontractors. Demonstrate with evidence the ability to continue and evolve software development from a complex inherited codebase. Demonstrate experience creating software using Python 3 to run on Debian-based Linux operating systems (>= Ubuntu 18.04 LTS) without reliance on closed-source, proprietary, software dependencies. Demonstrate expertise and experience of developing software that utilises machine learning techniques to realise complex data analytics. Demonstrate experience developing cyber security or system management software (preferably for high threat and government organisations). Demonstrate, with evidence, experience of third party technology integration. Demonstrate, with evidence, the ability to produce appropriate levels of documentation, and conduct verification and validation of software. Demonstrate experience using the Git Source Code Management (SCM) system and broader collaborative development tool suites. Provide examples of how you have provided customers with access to developmental and release versions of software source code, and engaged them in the development process. Nice to Haves No. of Suppliers to Evaluate 5 Proposal Criteria Demonstrate experience of developing robust, high quality software solutions in demanding timeframes, within the quoted budget. Demonstrate expertise and experience of developing software that utilises machine learning techniques to realise complex data analytics. Demonstrate experience developing cyber security or system management software (preferably for high threat and government organisations). Demonstrate with evidence the ability to continue and evolve software development from a complex inherited codebase. Provide a breakdown of the team structure (please include CVs of the team members doing the work). Provide estimated timeframes for the work (include a Gannt chart with approximate sprint timeframes). Detail and explain identified risks and dependencies. Provide details of offered approaches to manage these risks (include a Risk Register). Provide a detailed breakdown of costs and include information against the following: Hours and rates (including hours allocated to each team member); Cost of materials; and Travel and Subsistence. Cultural Fit Criteria Demonstrate with evidence ability to follow industry best practice throughout the whole software development lifecycle from requirements gathering to documentation, testing, verification and validation (including examples of tool chains used). Demonstrate consistent cultural commitment to agile software development practices, including embracing and responding to an evolving customer requirement Provide a summary of the suppliers work ethos and working environment. Demonstrate ability to successfully deliver within the UK Defence landscape. Show evidence of an internal culture of knowledge and experience sharing. Show evidence of being transparent and collaborative both internally and with the customer when making decisions. Payment Approach Capped time and materials Assessment Method Evaluation Weighting Technical competence 60% Cultural fit 20% Price 20% Questions from Suppliers Budget range £500-600k for the initial requirement (without extensions), spread over fy19/20 and fy20/21.