Reference /Subject LIC is also expecting Layer 7 App DDOS attack protection? Kindly confirm

Transcription

1 Date: Enclosed the reply to your queries to RFP of no. Ref: CO/IT-BPR/CSC Date: Clause LIC is also expecting Layer 7 App DDOS attack protection? Kindly confirm Yes. Vendor will be responsible to block application DDoS attack upto 10 Gbps. The commercial for this will be taken into account to determine L1 bidder only if there are at least three bidders. we recommend to perform quarterly manual Application security testing on each application to identify business logic vulnerability. Identified vulnerability can be patched immediately at WAF level. This will help LIC to Fix vulnerability at WAF level which cannot be fixed at application level. of concurrent user mentioned by LIC is too less compare to size of LIC. What is the Max. no of concurrent user expected at any given point of time. Vendor to perform manual application security based on OWASP top ten security vulnerabilities. It can be either grey box or black box security testing which should cover both the automated and manual penetration testing (PT). Vendor has to give risk rating with recommendations and evidence. Slab 1 & 2: The maximum concurrent users are (+/- 10 %) right now which will be increased 10 % on year-to-year basis. Slab 3, 4 & 5: The maximum concurrent users will be (+/- 10 %). Request you to provide us with current peak bandwidth utilisation (at any given point of time) of each website. Slab 1: 250 Mbps Slab 2: 150 Mbps Slab 3: 45 Mbps Slab 4: 20 Mbps Slab 5: 8 Mbps who will be responsible to create custom rule for identified vulnerability? Traffic can increase 10% basis on Year-toyear basis. Please refer to commercial bid sheet for no. of applications under each slab. The vendor will be responsible for creating custom rules within 5 working days for high and medium vulnerabilities. kindly confirm no. of applications for Web application firewall with peak bandwidth for each application Since this is cloud based service we request you make Annually Advance payment Same as above. No advance payment is allowed. Payment will be made on a quarterly basis in arrears. Ref: CO/IT-BPR/CSC Date: of 7

2 8b 4 Penalty would be calculated at Rs. 1000/- per hour or part thereof for every hour of downtime beyond the permissible downtime with a maximum of 10% of quarterly contract value. Penalty would be calculated on accumulated downtime for each website/ s separately. 6a 3 The successful bidder shall activate the online scanning & WAF services as per SOW within 15 days from the date of issue of PO. 5p 3 For any bandwidth utilization beyond 100 Mbps payment shall be made on actuals on pro rata basis (in multiple of 1 Mbps). 9 4 Termination of Contract (Exit Clause) Extension of date to 27th Oct'2017 Request you to relax penalty and cap to to a maximum of 0.1% of quarterly contract value Please relax the time-line to 3 weeks (business working days) The per Mbps model needs to be confirmed - as on 11 the commercial terms states 1Mbps & Qty 50 ==> 150Mbps throughput (Pro-rata basis doesn't hold true in this case?) Commercial modelling can be done via charges per application. Bidder request that before termination under this clause, LIC should give a cure period notice of atleast 30-days and if the breach is not cured within the cure period time, the LIC can termination the contract Last date for submission will be 30 th Oct'2017 at 3.30 PM. Tender opening date & time: at 4 pm Penalty would be calculated at Rs. 100/- per hour or part thereof for every hour of downtime beyond the permissible downtime with a maximum of 10% of quarterly contract value. Penalty would be calculated on accumulated downtime for each website/ s separately. 3 weeks from the date of issue of purchae order 95% percentile method will be used to calculate the bandwidth used during the month. Payment for additional bandwidth will be made on pro-rata basis. Agreed if there is deficiency in service. Ref: CO/IT-BPR/CSC Date: of 7

3 12(j) 6 Right to Audit Bidder request that any such audit tot be conducted after providing not less than 30 days' prior notice to bidder and the audit be made subject to the auditors entering into a confidentiality agreement with bidder. Any such audits shall be conducted in accordance with Supplier s then-current confidentiality, security and employment policies and obligations at the applicable facility. The scope of such audit would be limited to services availed and service levels being covered under the agreement, and financial information and shared infrastructure, to extent it relates to third parties, would be excluded from such audit. The Supplier will not permit installing any tool to scan its shared infrastructure. The audit shall be conducted not more than once in a calendar year and remote hands fee be applicable to the same. Further the audit should not exceed a time duration of 4 hours (in any case should not exceed 8 hours) at any given instance. Remote Hands Fee(s) shall mean bidder's standard rates for any facility under audit and are intended to compensate bidder's costs for providing auditor access to bidder s facilities and personnel during the audit. Any such audit will be in compliance to regulatory guidelines or govrenment directives only. Hence no charges or conditions are acceptable. Ref: CO/IT-BPR/CSC Date: of 7

4 Additiona l Limitation of Liability Clause Bidder proposes following additional clause: No change 1 1. Intro ducti on To further strengthen the Security Infrastructure, LIC require a web based solution which perform daily vulnerability assessment, application audit, malware monitoring and protect these websites from data breaches and defacement through Web Application Firewall (WAF) in a service model. In case of service related matter the sole liability of the Bidder and sole remedy of LIC shall be the applicable credit allowance and / or termination of contract. In any other case, the overall liability of the Bidder be capped to 12-months of charges collected by the Bidder pursuant to the applicable order giving rise to the said liability. The Bidder shall not be liable for any indirect or consequential losses or damages etc. We would like to understand what does Application Audit mean here, e.g.? Application audit would mean checking the applications against OWASP top 10 vulnerabilities; version as updated from time to time and OSSTM guidelines Scop e of work e) Successful bidder should provide weekly scan results to LIC for all websites configured for daily vulnerability scanning by-passing WAF, if any. Does Vulnerability Scanning mean, Malware Scanning? It means all vulnerabilities that can be exploited through internet. Ref: CO/IT-BPR/CSC Date: of 7

5 2 5. Scop e of work 9 Anne xure- II (D) Tech nical Bid: Tech com plian ce 9 Anne xure- II(D) Tech nical Bid:T ech com plian ce General Gene ral m) Successful bidder shall report immediately on any change in the homepage of a monitored website. 15. WAF instance used should be dedicated to LIC and not shared with any other customer. 27. WAF shall take the feed from Vulnerability Scanner and update the WAF policy to counter the security vulnerability daily at application layer. This is a separate service which includes website monitoring and not covered in WAF. The WAF instance will be dedicated to the LIC but it will be on shared Infra We need to have more clarifications on this point, We can integrate VA with WAF but its vendor dependant. - We need understand what are the exact requirements here: 1. How many Web Applications are being used? 2. How many SSL based Web Applications? 3. Number of concurrent connections? 4. How much is the growth of Applications/Connections Predicted? 5. Is there a need for server load balancing or any load balancing requirements? No change. Both services- website monitoring and reporting on any changes to any page of the website- are required. It should not be limited to just home page. Agreed. No change in this RFP conditions. 1. Please refer to commercial bid document for tentative numbers for 5 years. 2. Almost all will be SSL based in near future. 3. Already responded % expected, but not guaranteed. 5. Not from bidder side. Ref: CO/IT-BPR/CSC Date: of 7

6 9 4 Exit Clause- Bidders must take a note that the Max limits of penalties are upper tolerance (i.e. 10% of quarterly contract value (excluding taxes)). LIC reserves right to terminate the contract in parts or full at any point of time depending on the scenario for breach of SLAs even before reaching the Max limit of penalties. Request LIC to modify the clause and reserve the right to terminate only when the SLA breach reaches the maximum limit and not before. No change as LIC may terminate the service with the bidder if there is no business need Payment Term- Quarterly arrear payment at the end of the quarter after due deduction of penal payment, if any. Request LIC to change the Payment Term from Quarterly arrear to Quarterly in advance. No change Ref: CO/IT-BPR/CSC Date: of 7

7 8 4 Penalty- LIC will tolerate four missing instance of daily and weekly scanning report in a quarter. Beyond which a penalty of Rs. 100/- per instance for every failed instance will be charged with a maximum of 10% of quarterly contract value. Request LIC to relax this clause Penalty- LIC will tolerate eight missing instance of daily and four weekly scanning report in a quarter. Beyond which a penalty of Rs. 100/- per instance for every failed instance will be charged with a maximum of 10% of quarterly contract value. Payment Terms and condition Payment will be made by the department/section using the service. EXECUTIVE DIRECTOR (IT/BPR) Ref: CO/IT-BPR/CSC Date: of 7