Agenda 01-17-23; 8-j - End Point Protection – Managed Detection Response CrowdStrike Contract

Browse Search

1 ORANGE COUNTY BOARD OF COMMISSIONERS ACTION AGENDA ITEM ABSTRACT Meeting Date: January 17, 2023 Action Agenda Item No. 8-j SUBJECT: End Point Protection — Managed Detection Response CrowdStrike Contract DEPARTMENT: Information Technologies (IT) ATTACHMENT(S): INFORMATION CONTACT: David Mathias IT Operations Manager/ Security Officer, 919.245.2272 Jim Northrup, Chief Information Officer, 919.245.2276 PURPOSE: To approve and authorize the Manager to sign a one-year contract with Carahsoft Technology Corporation (Carahsoft) and CrowdStrike in the amount of $112,965 to move 1,500 devices, e.g., computers and servers, from the currently deployed Carbon Black endpoint protection to CrowdStrike end point protection, with the addition of a vendor initiated managed detection system. BACKGROUND: This service utilizing a different vendor, i.e., CWD-G, Inc was presented to and approved by the Board of Commissioners at the November 15, 2022 Business meeting. However, the service could not be implemented as approved in November due to the vendor's inability to utilize and sign the Orange County contract template due to conflicting terms in the template and purchasing vehicle used to meet legal requirements, i.e., CDW-G could not use the Omnia Cooperative Purchasing Agreement. The proposed new vendor for consideration is Carahsoft, and all documents, processes and procedures have been vetted by the Carahsoft, Orange County Purchasing staff, and the County Attorney's Office. Orange County Information Technologies is currently deploying Carbon Black and a next generation antivirus system on all compatible computing devices. The current system has been managed successfully by IT staff since 2019. One of the shortcomings of the current system is that, unless IT staff is focused on email 24 hours a day/7 days a week, detection may go unnoticed for hours. For example, an event or infection could occur on a Sunday at 11:59 PM, thereby increasing the risk of a single machine infecting other machines around it, i.e., the network until staff monitoring of email resumes at 8:00 am on Monday. The proposed CrowdStrike system not only replaces Carbon Black, but has an additional component of 24 hours a day/7 days a week monitoring and response, e.g., an infection or harmful event is remediated up to and including network quarantine. Through the contract the vendor guarantees a 1 to 2 hour response time, dependent on event severity, per the Service Level Agreement. Real world response times are considerably less and available upon request.