|
Software Package And Information Systems – Procurement Of Microsoft Licenses For Servers And Personal Computers. The Subject Of Procurement Includes The Delivery Of Microsoft Licenses And The Provision Of License Compliance Management Services And Security Assessments Of The Microsoft Environment. Along With The Delivery Of Licenses, The Bidder Must Provide A Related Service Of Consulting, Analysis And Assessment Of The State Of The Clients Information System With The Aim Of Ensuring Proper Licensing, Optimizing The Use Of Licenses And Increasing The Security And Transparency Of The Microsoft Infrastructure. The Service Includes Advising The Client In Order To Eliminate The Risk Of Improper Licensing Of Software And Software Services, Continuous Information As Needed, And At Least Once A Year Education On Licensing Rules And Changes To The Manufacturers License Conditions, As Well As Conducting An Annual License Inventory Of Software And Software Services In The Clients Information System. The License Inventory Includes Scanning, Recording, Analysis And Optimization Of The Use Of Software And Licenses, As Well As The Creation Of A Report On The State Of Licensing. In Addition To The License Inventory, It Is Necessary To Carry Out The Service Of Systematic Detection Of All Devices, Services And Systems In The Clients Network Environment In Order To Collect Detailed Information About The Property. The Goal Is To Get A Complete And Accurate Picture Of The Infrastructure, Including Undocumented Devices, Unattended Systems, Shadow It, And Obsolete Components. The Bidder Will Then Analyze The Results, Validate The Data And Highlight Irregularities, Risks And Potential Security Issues Associated With The Discovered Assets. As Part Of The Same Service, The Provider Is Obliged To Conduct A Detailed Analysis Of The Clients Existing Active Directory Environment With The Aim Of Detecting Security Vulnerabilities, Incorrect Configurations And Outdated Settings. The Scan Covers Domain Controllers, User And Service Accounts, Gpo Settings, Protocols, Delegations, Certificate Services, And Cross-Domain Relationships. Analysis Must Include Identification Of Weak Passwords, Shadow Admin Accounts, Vulnerable Spns, Obsolete Objects, Insecure Scripts, Vulnerable Protocols (Smbv1, Lm/Ntlmv1, Llmnr), Kerberos Vulnerabilities, And Incorrect Delegation And Dacl/Ace Settings. Additionally, Pki System Configurations, Certificate Templates, Rodc Settings, Auditing Policies, Dns Security And Services Installed On Domain Controllers Must Be Checked. Based On The Collected Data, An Analysis Of Possible Attack Paths And A Risk Assessment Must Be Made. The Final Result Of The Performed Service Must Include A Structured Report With Findings, Priority Recommendations For Eliminating The Observed Problems, And A Presentation Of The Results. The Service Must Additionally Include Scanning Of The It Environment To Detect Security Vulnerabilities And Checking Whether Previously Identified Problems Have Been Successfully Resolved. The Provider Must Analyze The Scan Results, Remove False Positives, Prioritize Risks And Provide Clear Recommendations For Remediation.
|
