Deception Technology

Description

National Grid are seeking to select a strategic partner to enhance our deception technology capability within our Security organization. National Grid welcomes interested parties who have experience with deceptive technologies. Lot 1: National Grid security team operates a 24*7*365 Cyber Security Operation Centre (CSOC) that monitors our estate for malicious, suspicious, or anomalous behavior and responds appropriately to ensure the consistency of services National Grid provides. Deception technologies can be an effective way to detect attackers in a network, gain visibility of their tactics and deter them away from production systems. Example techniques that could be employed by a deception solution include: • Honeypots - False systems or applications • Honeytokens - False credentials or other pieces of sensitive information • Deception networks - False networks that mimic production networks to gather intelligence on attacker activities and deflect their efforts away from the production network • Deception documents - False documents designed to appear sensitive or valuable The solution should have bi-directional integration with SIEM solutions for both alerting when anomalous behavior is observed, and to allow analyst to drill down into specific data points. Due to the strictly regulated industries National Grid operate in, we have a strong preference towards vendors who can provide a hybrid architecture whereby infrastructure is split between on-premise and cloud. The required solution will integrate with internal IT infrastructure and external vendors of National Grid. Vendors will be expected to demonstrate how they can effectively integrate with other tooling in the environment. In addition to the software and hosting service, we will be looking for a robust plan around the operations support models available.