Security Administration

The Security Administration technical area addresses the security of information and computing resources at all organization levels. This section describes the requirements. The types of service areas included under the Security Administration technical area are: (1) network security support, (2) software/application security support and (3) Overall Security Assessment.

a. Network Security Support The Contractor should provide operational and analytical support related to security for hardware and software information assets. Such support includes, but is not

limited to, the capability to:

i. Perform a risk assessment identifying vulnerabilities with recommended solutions. This assessment could include evaluation of both the physical and data security. Provide operational and analytical support of security system hardware and software supporting the Wide Area Network (e.g., firewalls, routers, intrusion detection, anti-virus and other hacker protections);

ii. Provide support necessary to evaluate the integrity of operating systems and environments;

iii. Ensure that security measures are sufficient to counter threats while ensuring that users, both internal and external, are not unreasonably impacted by the operation and administration of security system software;

iv. Repair any damage caused by "hacker" attacks;

v. Perform periodic security "scans" to ensure that agency network infrastructure is operating at the highest security level possible.

b. Software/Application Security Support The Contractor should provide security for software/applications in accordance with customer security policy and standards. Where the contractor believes these policies and standards are insufficient, the contractor shall recommend changes. Such support includes, but is not limited to, the capability to:

i. Provide operational and analytical support related to security for personal computers, file servers, and LAN and WAN information assets;

ii. Provide operational and analytical support related to network security;


iii. Analyze and evaluate new and emerging security technologies as well as vendor security products for their applicability and feasibility of use for personal computers, LANs, WANs, telecommunications and networks;

iv. Support customer security operations, including assisting customers with developing and implementing security methodologies and safeguards to protect their personal computers, file servers, LANs, WANS and network assets;

v. Provide technical training for all aspects of information security relative to personal computers, LANs, WANs, file servers and networks;

vi. Perform special projects and tasks to identify and remedy existing security weakness; and,

vii. Provide virus detection, elimination, prevention and intrusion detection support. Such support includes, but is not limited to, the capability to:

• Be responsible for specific activities that include incident-handling guidelines, preventive
  measures, software tools, etc., and may be an ongoing, multi-year effort;
• Identify, isolate, neutralize, and be responsible for handling malicious programs (e.g., viruses, worms, and Trojan Horses) infecting the client organizations systems and/or networks;
• Perform research on viruses, conduct system attack studies, and develop computer security tools, which provide knowledge that the Contractor can use and information to issue before and during incidents;
• Maintain a clearinghouse of relevant information (i.e., description of viruses, removal/recovery instructions, etc.) and help sites to learn about and use the computer security tools which they have developed; and, Initiate proactive efforts to include developing virus detection, elimination, and prevention guidelines and identifying software tools for responding to incidents/events.

viii. Provide support in developing and maintaining a Public key Infrastructure (PKI). This would include, but not limited to, the following:

• Review and establish security policies to be used with PKI.
• PKI enable applications including legacy applications.
• Interoperability issues.
• Establish Certificate and Registration Authorities.

c. Overall Security Assessment The Contractor should provide personnel that has experience in,

but not limited to, the following security areas:

• Provide security assessment based on federally mandated rules such as HIPPA (Health Insurance Portability and Accountability Act).
• Provide assistance in establishing and monitoring security standards mandated by rules such as HIPPA