MOJ Cybersecurity Log Collection and Aggregation Platform

Tender description

Why the Work is Being Done The proposed system will collate logging data from Ministry of Justice systems and services, store them centrally, and allow their processing and analysis by MoJ security staff, to provide more effective and joined-up security for our systems Problem to Be Solved In MoJ we currently don’t have a central platform where security logs can be stored, accessed and analysed. As part of this project we are building - A central platform to collect, store and aggregate logs - Logs held by external suppliers are only available as a snapshot. - We need to pay for a single instance of the snapshot. - Currently the log storage is distributed, making it impossible to search for trends across departments Who Are the Users As a Cybersecurity analyst, I need to be able to easily create, edit and execute queries on logs in a variety of formats across a varied estate to convert individual events into actionable security alerts. This will allow me to monitor the estate effectively. As a member of an operational team, I need to be able to easily create, edit and execute queries across my relevant log sources to identity suspicious events and translate them into actionable security alerts. As a developer of a service, I need a secure repository to feed logs into so that I can monitor the health of my service Early Market Engagement We have previously conducted a procurement exercise to deliver a discovery phase, however none conducted for the current phase (Alpha) Work Already Done As part of the discovery we have developed a prototype Logging Platform based on the MOJ's Kubernetes cloud hosting environment (on AWS) and commonly used logging tooling (the Elasticsearch, Logstash and Kibana, or Elastic stack). This has been approved by the technical authorities, and is the recommended basis of your implementation. Existing Team MOJ Digital & Technology - Security & Privacy Team Current Phase Beta Work Location Supplier location(s) and Petty France, London, SW1H 9AJ Working Arrangments - Video call for an initial onboarding ramp-up period (as mutually agreed) with the vast majority of delivery being completed from supplier location(s) - use agile working methods - weekly progress reports - the Security & Privacy Team Project Manager to provide reviews, direction and clarification on progress on a required (but at least weekly) basis Security Clearance Baseline Personnel Security Check (BPSS) as a minimum. See https://www.gov.uk/government/publications/government-baseline-personnel-security-standard for further guidance. Additional T&Cs Any agreed Travel or Subsistence costs would be under MoJ's Travel and Subsistence policy Skills & Experience Provide recent and demonstrable experience of implementing log collection and storage conducted in the last three years within a public sector (or comparable) organisation Outline recent and demonstrable experience of using the Elasticsearch, Logstash and Kibana (Elastic stack) or directly comparable substitutions for analyzing logs (or similar uses) conducted in the last three years Outline recent and demonstrable experience in building modular scalable technical data analytical platforms conducted in the last three years Provide recent and demonstrable experience in building modular scalable platforms using infrastructure as code principles in Kubernetes/AWS conducted in the last three years Provide recent and demonstrable experience in building modular scalable platforms using infrastructure as code principles in Kubernetes/AWS conducted in the last three years Provide recent and demonstrable experience of transitioning a technical system to an operations team, explaining how you transferred knowledge to the team, conducted in the last three years Provide recent and demonstrable experience of User Research guiding your development, within the last three years Provide details of how you will develop outline service material, including training material and processes for MoJ service staff (“train the trainer”), and user guidance for end-users. Provide Define and design an operational support model, including operational processes, required as more services use the capability Demonstrate the separation of consolidated data feeds (i.e., many applications via one data stream) by role. Demonstrate logs are segregated sufficiently that different teams can see only “their” data. Demonstrate the Lifecycle of the Logs including deletion (data to be auto expired after a specified period) and retention capability from individual and all log sources Nice to Haves Provide recent and demonstrable experience of Amazon Web Services' Athena and/or Elasticsearch service conducted in the last three years Provide recent and demonstrable experience of using configuration as code to build and operate systems in a cloud-native manner Provide recent and demonstrable experience of Amazon Web Services' Cloudformation (or similar) conducted in the last three years Provide recent and demonstrable experience of open source development (in particular, well-made and robust code development) and accompanying solution & code documentation conducted in the last three years No. of Suppliers to Evaluate 5 Proposal Criteria Describe the method you suggest, referencing your experience, on how you would deliver an Alpha for a multi-tenant log aggregation platform based on the ELK (or directly comparable) stackset Describe the method you would propose to use, referencing your experience, on how you would onboard the logs from target systems Describe the method you would propose to use, referencing your experience, to build dashboards for cybersecurity analysts and how you would ensure that they had ownership of the dashboards Describe how you will ensure that the a developed platform will be flexible to ensure future expansion by any maintainer with sufficient capability Describe how you will ensure a high quality 'production ready' repeatable platform will be provided through your approach and methodology. Cultural Fit Criteria Explain how you provide knowledge sharing and handover at the end of an engagement Explain how you’ll ensure collaboration at all levels of the project and programme delivery between users, team members and management. Give examples of where you have taken this approach. Explain internal development team planning and quality assurance processes Recent and demonstrable experience of working in public sector or highly regulated environment conducted in the last three years Payment Approach Capped time and materials Assessment Method Case study Work history Reference Presentation Evaluation Weighting Technical competence 60% Cultural fit 10% Price 30% Questions from Suppliers No questions have been answered yet Budget range bidders to suggest total cost based on requirements we anticipate a spend of no more than £400k