THE SSA HAS A REQUIREMENT TO EMPLOY MORE ADVANCED ANALYTICS IN REGARDS TO MONITORING USER BEHAVIOR ON THE SSA NETWORK. THE AGENCY HAS TAKEN THE INITIATIVE TO STRENGTHEN ITS ABILITY FOR ANALYSIS OF USER AND ENTITY BEHAVIOR, REFERRED TO AS UBA. WITH ADDITIONAL FOCUS ON CYBERSECURITY AND THE EFFECTS OF COMPROMISED CREDENTIALS THAT ALLOW MALICIOUS OUTSIDERS TO ACT AS INSIDERS, THE AGENCY EXPECTS THAT UBA AND ANOMALY DETECTION WITH RISK SCORING CAN BE USED FOR EFFICIENT INVESTIGATION AND MITIGATION OF RISKY BEHAVIOR, AND FOR TIMELY DETECTION OF MALICIOUS INTRUDERS. THESE SOLUTIONS WOULD OFFER INSIGHTFUL MACHINE LEARNING TECHNIQUES AND AUTOMATION TO DETECT ANOMALIES, WHICH THE AGENCY COULD USE TO BUILD ON THE CURRENT RULE-BASED THRESHOLD ALERTS. THE DIVISION OF SECURITY ENGINEERING IN OIS HAS A NEED TO IMPLEMENT A UBA SOLUTION FOR ENTERPRISE USE WITH A WIDE VARIETY OF SSA PLATFORMS AND SYSTEM LOGS AS DATA SOURCES, INCLUDING BUT NOT LIMITED TO: ACTIVE DIRECTORY, SPLUNK, NETWORK TRAFFIC, WEB TRAFFIC, LINUX AND UNIX BASED DEVICES, PRINTING SERVERS, AND OTHER HARDWARE AND SOFTWARE LOGS. THE SOLUTION SHOULD AUTOMATICALLY BASELINE USER AND ENTITY BEHAVIOR TO IDENTIFY ANOMALOUS BEHAVIOR AND ALERT ON THESE ANOMALIES FOR INVESTIGATION. THE SOLUTION SHOULD ALSO HAVE THE ABILITY TO COMPARE USER BEHAVIOR AGAINST THEIR PEER GROUP(S). MACHINE LEARNING CAPABILITIES ARE A NECESSITY FOR AUTOMATED BASE LINING AND ANOMALY DETECTION, BUT IT MAY BE NECESSARY FOR ADDITIONAL MACHINE LEARNING MODELS TO BE INTEGRATED INTO THE UBA SOLUTION TO ALLOW FOR A CUSTOM CONFIGURATION. THE SOLUTION SHOULD ALSO BE COMPLIANT WITH THE GOALS OF CDM/CMAAS PHASE 3 OBJECTIVES RELATED TO EVENT MANAGEMENT.

View the official award record

Our catalog shows awards with a value or ceiling of $250K+ active within the last 5 years. Need older history or smaller awards? Tell us what you need — we expand by request.