RFI -Testing and Development resource augmentation

Summary and scope

The Centre for eResearch and Digital Innovation (CeRDI) and Information Technology Services (ITS) recently undertook a two-year project to migrate the CeRDI hosting infrastructure from an external provider into the Federation University ITS managed server infrastructure. An outcome of the migration project was to establish an appropriate suite of security controls around CeRDI services and applications, including modernised server operating systems, isolated network configurations and security upgrades to applications. The overarching goal of this new project is to ensure the strong security foundation established in the migration project is maintained and extended to enable proactive vulnerability detection and mitigation. In the current cyber security landscape, continuous effort is required to detect vulnerabilities, mitigate risks and safeguard data. ITS and CeRDI each operate several tools to detect vulnerabilities. These tools are constantly being updated so that they detect new issues, and we also add new tools to our toolkits as they become available. Each of these tools generate alerts which need to be investigated by a systems administrator or a developer. The mitigations then need to be developed, tested and deployed. All these steps - scanning, assessment, mitigation, testing and deployment - are currently performed manually. An opportunity exists to automate this work, allowing better security outcomes to be achieved at lower cost. This RFI aims to identify organisations that can support CerDI in achieving the outlined objectives by providing capability through resource augmentation.