Network Introspection Demonstrator

Tender description

Summary of the work The approach will provide distributed control of watermarking activities across federated networks, develop marking schemes for network packets in direct support of detect and respond activities. Latest start date Tuesday 31 January 2023 Budget Range £325,000 Why the Work is Being Done DSTL wants to develop generic cyber detect and respond concepts that can be applied to military challenges. Watermarking of network packets enhances downstream cyber security tooling contextual understanding of cyber events to provide meaningful prioritisation and monitoring. Using watermarking it should be possible to centrally control the marking of network packets across security boundaries and federated networks overtly and covertly. Problem to Be Solved Military networks are increasingly complex and as a result it is difficult to monitor them meaningfully therefore it is desirable to detect and respond surgically. DSTL wants to provide contextual information within network packets which span security boundaries and federated networks which otherwise would be unachievable by a single party. The demonstrator should be able to orchestrate the covert and overt marking of network packets through a common communications channel (OpenC2) to enable orchestration and interoperability with other defensive cyber tooling. Who Are the Users As a cyber-security researcher I need to determine the viability of orchestrating watermarking across network packets to aid in the detection or response of complex cyber threats. I need software development resourcing with networking experience to develop a distributed solution that can watermark packets across federated networks and security boundaries. I need to understand the art-of-the-possible of distributed control and application of marking including matching, nesting, cleaning watermarking schemes. I need to realise the benefits of watermarking to cyber defence capabilities such as deception and federated monitoring. Existing Team The supplier will be working with one or more dedicated technical partner(s) from Dstl for day to day interaction. A small team from the Authority will contribute to and review work carried out under this task where appropriate. This team will act as hosts, when or should the need to work on or demonstrate the concepts on our site arises. This team operates out of their own laboratory space which is equipped to support software development and deployment. The supplier may be expected to reach out to international standards bodies to understand how to utilise or enhance existing standards. Current Phase Not started Skills & Experience • Demonstrate experience creating software using Python 3 and/or C to run on Debian-based Linux operating systems (>= Ubuntu 18.04 LTS) without reliance on closed-source, proprietary, software dependencies. (0.3) • Demonstrate, with evidence the ability to conduct agile software development in-house, without support from subcontractors. (0.1) • Demonstrate with evidence the ability to continue and evolve software development from a complex inherited and/or Open Source codebases. (0.1) • Demonstrate with evidence the ability to deliver without authority funded capability enhancements (for example, procurement of additional ICT to support development activities). (0.1) • Demonstrate experience developing cyber security or system management software (preferably for high threat and government organisations). (0.1) • Demonstrate, with evidence, the ability to produce appropriate levels of documentation, and conduct verification and validation of software. (0.1) • Demonstrate experience using the Git Source Code Management (SCM) system and broader collaborative development tool suites. Provide examples (0.1) Nice to Haves • Demonstrate with evidence, experience using Mininet or similar network virtualisation technologies (0.3) • Demonstrate with evidence, experience developing or using monitoring tooling across security boundaries and federated networks. (0.2) • Demonstrate with evidence, working knowledge of network protocols (0.1) • Demonstrate with evidence, adhering to appropriate coding standards when developing software (i.e PEP8) (0.1) • Demonstrate with evidence, experience deploying or using defensive cyber tooling within an Industrial Control System environment. (0.3) Work Location We would expect the majority of the work to be conducted at the suppliers own address, but there maybe times when both formal meetings and development work will take place at our Salisbury (Wiltshire) site. Working Arrangments To ensure that the demonstrator can be utilised to facilitate human testing, the project will utilise an iterative and incremental approach to delivery. The supplier must adopt an Agile system engineering approach (e.g. Scrum) and work closely with the Authority throughout the development process to realise the project’s aims. It is expected that this work will require significant dialogue between the Authority and the supplier throughout the contract period; the Authority will make staff available to support this. Security Clearance Able to handle up to OFFICIAL SENSITIVE material. No. of Suppliers to Evaluate 5 Proposal Criteria • The proposed technical solution offered by the supplier in terms of how closely it addresses the problem as described above. (0.15) • The technical measures/steps taken by the supplier to ensure the proposed approach addresses all the stated technical needs of the users. (0.15) • The overall approach and methodology proposed to achieve the solution. (0.15) • The proposed additional watermarking concepts and schemes to enable cyber detect and response. (0.2) • The timeframes for the work (deliverables and other milestones dates as appropriate). These timeframes should be included within the project plan using a Gantt chart and/or other suitable visualisation(s). (0.05) • Detail and explain identified risks and dependencies. Provide details of offered approaches to manage these risks via a risk assessment with mitigations(0.1) • Value for money (0.1) • The project management plan provided should include, but not limited to, an initial backlog, GFA/GFI requirements, commercial aspects and the suppliers Software Development Capability. (0.1) Cultural Fit Criteria • Demonstrate consistent cultural commitment to agile software development practices. (0.3) • Demonstrate with evidence that they are able to articulate their work to clients with low technical expertise. (0.1) • Demonstrate with evidence an ability to collaboratively work with both a customer and other suppliers/relent 3rd parties on a piece of work. (0.1) • Demonstrate with evidence being transparent and collaborative when making decisions. (0.1) • Demonstrate with evidence of sharing knowledge and experience with other team members. (0.1) • Demonstrate with evidence an ability to successfully solve deliver and solve problems within the UK Defence landscape. (0.3) Payment Approach Fixed price Evaluation Weighting Technical competence 70% Cultural fit 10% Price 20% Questions from Suppliers 1. The proposal criteria asks industry to propose “additional watermarking concepts”, what watermarking concepts have already been considered by the authority? There have been no watermarking concepts explored by Dstl. Additional conceptions should be seen as a ‘shopping list’ of stretch goals or complimentary concepts to the ones defined in the proposal. 2. What are the required deliverables with dates? Part 1 of 2 Part 1 of 21. The code for the concept(s): Dstl requires access to the concept code. Ideally this would be via a version control system that can be access remotely by Dstl. 2. Documentation: All code and concepts should be documented including any setup required. Documentation is to be delivered in the closing weeks of the contracts or earlier if available. Progress report: After each 2-week sprint has closed it is expected that a summary of progress will be delivered. This can be the slides used in the sprint review. 3. What are the required deliverables with dates? Part 2 of 2 Part 2 of 2:4. In-person demonstration event: It is expected that an in-person demonstration event will be held at our site at Porton Down. The event will convey what has been accomplished under this work and have a demonstration of the concepts developed. 4. Is there a required/ideal contract duration? No longer than 12 months. Ideal would be delivery in 8/9 months 5. What is anticipated end date for the delivery? No longer than 12 months. Ideal would be delivery in 8/9 months 6. Can the Authority advise whether there are any task specific IP terms applicable or whether the standard DOS 5 IP terms will apply to the deliverables? Dstl can confirm that the standard DOS 5 IP terms will apply. See Clause 9 of the DOS5 CCS Core Terms.