Loading...
HomeMy WebLinkAboutAgenda 01-17-23; 8-j - End Point Protection – Managed Detection Response CrowdStrike Contract 1 ORANGE COUNTY BOARD OF COMMISSIONERS ACTION AGENDA ITEM ABSTRACT Meeting Date: January 17, 2023 Action Agenda Item No. 8-j SUBJECT: End Point Protection — Managed Detection Response CrowdStrike Contract DEPARTMENT: Information Technologies (IT) ATTACHMENT(S): INFORMATION CONTACT: David Mathias IT Operations Manager/ Security Officer, 919.245.2272 Jim Northrup, Chief Information Officer, 919.245.2276 PURPOSE: To approve and authorize the Manager to sign a one-year contract with Carahsoft Technology Corporation (Carahsoft) and CrowdStrike in the amount of $112,965 to move 1,500 devices, e.g., computers and servers, from the currently deployed Carbon Black endpoint protection to CrowdStrike end point protection, with the addition of a vendor initiated managed detection system. BACKGROUND: This service utilizing a different vendor, i.e., CWD-G, Inc was presented to and approved by the Board of Commissioners at the November 15, 2022 Business meeting. However, the service could not be implemented as approved in November due to the vendor's inability to utilize and sign the Orange County contract template due to conflicting terms in the template and purchasing vehicle used to meet legal requirements, i.e., CDW-G could not use the Omnia Cooperative Purchasing Agreement. The proposed new vendor for consideration is Carahsoft, and all documents, processes and procedures have been vetted by the Carahsoft, Orange County Purchasing staff, and the County Attorney's Office. Orange County Information Technologies is currently deploying Carbon Black and a next generation antivirus system on all compatible computing devices. The current system has been managed successfully by IT staff since 2019. One of the shortcomings of the current system is that, unless IT staff is focused on email 24 hours a day/7 days a week, detection may go unnoticed for hours. For example, an event or infection could occur on a Sunday at 11:59 PM, thereby increasing the risk of a single machine infecting other machines around it, i.e., the network until staff monitoring of email resumes at 8:00 am on Monday. The proposed CrowdStrike system not only replaces Carbon Black, but has an additional component of 24 hours a day/7 days a week monitoring and response, e.g., an infection or harmful event is remediated up to and including network quarantine. Through the contract the vendor guarantees a 1 to 2 hour response time, dependent on event severity, per the Service Level Agreement. Real world response times are considerably less and available upon request. 2 The purchase would be made through Carahsoft, a reseller of CrowdStrike products. The contract documents were originated by the vendor which are in line with industry standards while meeting policy requirements and legal sufficiency. These industry standards place an emphasis on the intellectual property despite the additional benefit of human involvement. FINANCIAL IMPACT: The CrowdStrike purchase cost is $112,965 which includes first-year maintenance costs. SOCIAL JUSTICE IMPACT: There are no Orange County Social Justice Goals specifically applicable to this item: However, while an annual maintenance agreement may not seem to impact Social Justice, this software is essential to the smooth running of government and like many infrastructure items is a foundational element to ensure all Board Goals and Priorities are pursued. ENVIRONMENTAL IMPACT: There are no Orange County Environmental Responsibility Goal impacts associated with this item. The new CrowdStrike system does create a more efficient workplace. RECOMMENDATION(S): The Manager recommends that the Board approve the purchase from Carahsoft Technology Corporation (Carahsoft) and CrowdStrike and authorize the Manager to execute all necessary contracts as well as any future amendments.