The U.S. Department of Defense (DoD) is looking to beef up security of a key e-mail system — and the bidding process could be a windfall not just for some lucky contractors, but also for burgeoning technologies like Software as a Service (SaaS) and cloud computing.
In a Request For Information
(RFI) from the DoD’s Defense Information Systems Agency (DISA), the department is looking for an “e-mail security gateway” to protect all DoD e-mail systems attached to its Non-classified IP Router Network (NIPRNET) — its chief network used for sensitive but unclassified information exchange and Internet access.
The RFI calls for protection for 5 million users across 700 domains, receiving 50 million estimated messages per day with an average size of 30 KB per message. It also requires anti-spam, antivirus, anti-phishing, content filtering and intrusion detection features — and in particular, it needs to be able to inspect encrypted messages and filter outbound messages. According to the RFI, it also has to support DoD PKI
The news comes shortly after a string of high-profile security breaches affecting the military and other key areas of the government — including attacks that seized warplane data and
All the while, the cost for cleaning up after breaches continues to rise. Last month, the Pentagon said it had spent $100 million in cyberdefense efforts — costs chiefly relating to repairing damage from attacks and fixing internal mistakes.
Not surprisingly, the U.S. military is looking to fix the problems. But the RFI does hold some surprises.
For one thing, this process could be a big win for SaaS and cloud computing. “The government will consider Software as a Service (SaaS), managed services, software-only solutions, or bundled software/hardware solutions,” the RFI states.
The inclusion of SaaS and cloud computing are new. “Historically, some private organizations have said, ‘We don’t put stuff in the cloud.’ The DoD is one of those types of organizations,” Nick Edwards, group product manager at Cisco, told InternetNews.com.
Cisco, the industry’s largest networking player, is among those planning to respond to the RFI and participate in any demonstration, which the RFI also said is a possibility.
Edwards added that Cisco IronPort can support deployments of the RFI’s requested size — it counts similar large customers from BlackBerry maker Research in Motion in the private sector to Army Knowledge Online, serving 2 million mailboxes.
As to telling the government how it all works, he anticipated no problems. “We have an open approach. We have never been secretive. Customers want to know if they can trust you with their security.”
He pointed to initiatives such as the Cisco Security Intelligence Operations Center and the Cisco IronPort Senderbase Network that aggregate data from Cisco devices worldwide to better anticipate and track threats. These initiatives proved their worth recently, he added, when they increased the success rate of the Cisco Intrusion Prevention System.
“Each of these [demonstrations] is unique,” he added. “We show how the product works, walk them through the interface and show them how to make configuration changes and demonstrate our range of features. When it comes to measuring the success of the product, it makes sense to deploy it in a live data stream with a deployment model that mimics as close as possible to identically the real world traffic to determine the number of e-mails the system can handle and the number of false positives, etc.”
Edwards said that he’s so confident that he’s eager for the competition to be public, though it’s yet to be determined when the demonstrations will take place. The RFI said the bake-off “will be at a location and time to be announced later.”
