to be delayed by more than 25 Business Days, Verizon may terminate Customer's order for MSS -. Premises ..... Log Analyt
MANAGED SECURITY SERVICES – PREMISES PREMIUM + Part I: Part II: Part III: Part IV: Part V: Part VI:
Rates and Charges. Service Description and Requirements. Unified Security Services Rates and Charges. Service Terms and Conditions. Service Level Agreement. Definitions.
Part I: Rates and Charges. The provision of Managed Security Services – Premises Premium + (“MSS - Premises Premium”) to applications or Serviced Devices listed in the applicable Contract is a separate MSS - Premises Premium service. Customer will pay the non-recurring charges (“NRCs”) and monthly recurring charges (“MRCs”) per MSS Premises Premium service and per Serviced Device (or per other specified item) as set forth in the applicable Contract or, for rates not found in the applicable Contract, the rates posted here. The NRC is billable for new installs or physical location moves. Unless expressly indicated otherwise, all NRCs will be invoiced upon Order Confirmation Date and the initial MRCs will be invoiced upon Service Activation Date. 1. Discounts. Discounts, if any, will be automatically applied to each Contract, depending on the term of the Agreement indicated in the Contract. Part II: Service Description and Requirements. 1. Description of Service. MSS - Premises Premium offers Monitoring or Monitoring and Management services (Note: Monitoring only is not available for Unified Security Services, as described below) for a selection of security devices, applications and systems located on a Customer Site. The different service features of MSS - Premises Premium are described below. Unless otherwise provided herein, Customer is responsible for any Monitoring or Monitoring and Management activities for Subordinate Devices. Capitalized terms used in the description that are not described therein shall have the meaning ascribed to them in the Online Terms or in Part V (Definitions) of this Service Attachment. Due to the inherent evolutionary nature of technology, Verizon reserves the right to change, modify, update or enhance MSS - Premises Premium Service Description from time to time. The Service Description provides additional details and information regarding service settings and service delivery. Verizon will notify Customer upon publishing a new release of the Service Description by (a) posting the updated Service Description to the Security and Compliance Dashboard/Security Dashboard or (b) communication via the Security Services Advisor (“SSA”). New releases of the Service Description are effective upon such release. 1.1 Implementation of MSS - Premises Premium. Prior to commencement of MSS - Premises Premium, Verizon will schedule a kick off meeting to introduce the Verizon service delivery team, identify the appropriate contacts for Customer, discuss the scope of the MSS - Premises Premium service and its business impacts, and obtain any required information from Customer. Upon receipt of completed deployment kit, Verizon shall create a proposed project plan with high level milestones and timelines. MSS Premises Premium will only be provisioned after Customer has approved the project plan. During the implementation of the MSS - Premises Premium, Customer may propose changes to the project plan or the MSS - Premises Premium service. Verizon will assess Customer’s proposal and may require Customer to submit a new Service Order or Amendment to reflect the approved changes. 1.1.1 Customer Responsibilities. Customer must complete a deployment kit within 15 Business Days of the kick off meeting or Verizon may terminate Customer’s order for MSS - Premises Premium service. If Customer fails to approve the project plan, or fails to provide any necessary information to implement the project plan, and such delay causes any activity on the critical path of the project plan to be delayed by more than 25 Business Days, Verizon may terminate Customer’s order for MSS Premises Premium service. Upon termination of an order for MSS - Premises Premium service, Verizon may charge Customer for any expenses incurred by Verizon (including labor fees) up to the date of termination. 1.2 Specifications for MSS - Premises Premium. MSS Premium is available as a monitoring service or a monitoring and management service as described in the service matrix below. Additional MSS Premium – Security Enterprise services are available as general MSS Premium services and not directly related to a site or a Serviced Device. Certain services may have limited availability. Verizon. All Rights Reserved.
Page 1 of 27
Verizon CONFIDENTIAL
Managed Security Services – Premises Premium + Monitoring Services
Firewall Network Switch Router Security Appliance Network Intrusion Detection System (“NIDS”) Network Intrusion Prevention System External NIDS sensors HIDS/HIPS on Servers – Full Escalation (1) HIDS/HIPS on Servers – Threshold Escalation (2) HIDS/HIPS on Clients Application Level Firewall Log Monitoring and Management Load Balancer SSL VPN Email Security Gateway Proxy Server Content Screening FIPCM Servers and Clients Endpoint Security on Servers and Clients Premium Plus Remote Office OS Log Monitoring Active Directory Log Monitoring
Device Availability and Health Monitoring √ √ √ √
Management Services
√
√ √
√
√
Service Management and Reporting √ √ √ √
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√
Threat Analysis
√
Security Incident Handling
√
√ √ √ √
Device Health Management √ √ √ √
Device Security Management √ √ √ √
Service Management and Reporting √ √ √ √
Device Maintenance
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√ √
√
√
√ √
√ √
√ √
√ √
√ √
√
√
√
√
√
√
√
√
√ √
√ √
√ √
√ √
√ √
√ √
√ √
√ √
√
√
√
√
√
√
√
√
√
√
√
√
√
√
√ Availability only # #
√
√
√
√
√
√
√
√
√
√
(1) HIDS/HIPS – Full Escalation: This service is available for HIDS/HIPS agents residing on servers only. When a Customer orders this service, Events and Incidents are created for each individual HIDS/HIPS agent. On-line and offline reporting happens per HIDS/HIPS agent. (2) HIDS/HIPS – Threshold Escalation: This service is available for HIDS/HIPS agents residing on servers or on clients (desktops/laptops). When a client orders this service, sensors with the same policy are grouped together. For each group, a number of Customer-specific thresholds are defined. When a threshold is exceeded, an automated escalation is sent to Customer. On-line and off-line reporting happens per group. # Availability limited to Verizon contacting Customer when Serviced Devices are no longer sending logs to the SMC. 1.2.1
1.2.2
Device Availability and Device Health Monitoring. 1.2.1.1 Device Availability Monitoring. Verizon monitors the availability of the Serviced Device 24x7. 1.2.1.2 Device Health Monitoring. Verizon monitors the health of the Serviced Device by measuring CPU, memory, disk and swap usage health parameters. Verizon establishes a health threshold for each of the health parameters reported by the Serviced Device and creates a “Health Incident” if one or more thresholds are needed. Device Health Management. The following features are provided under Device Health Management:
Verizon. All Rights Reserved.
Page 2 of 27
Verizon CONFIDENTIAL
Managed Security Services – Premises Premium + Device Troubleshooting. Verizon will investigate the cause of an ‘availability’ or ‘health’ problem of the Serviced Device through remote problem diagnosis and initiate device troubleshooting to remedy the problem remotely. 1.2.2.2 Hardware Management. Under Hardware Management, if Verizon detects a problem or a hardware failure, Verizon will contact the Serviced Device manufacturer or vendor and coordinate on-site servicing by the relevant maintenance service provider. Verizon does not provide on-site hardware maintenance under this Service Attachment. If the Serviced Device requires replacement, Verizon shall coordinate the return the hardware to the manufacturer or vendor. Verizon does not provide Hardware Management services on Unsupported Devices. 1.2.2.2.1 Customer Responsibility: To receive Hardware Management services, Customer must have 24x7 maintenance support for the Serviced Device and authorize Verizon to act on Customer’s behalf for such maintenance support. If Customer elects to directly manage its maintenance support, Customer is solely responsible to escalate any problems with the Serviced Devices to the manufacturer/vendor. In such a case, however, Customer must coordinate with Verizon for any upgrade or replacement of a Serviced Device. Customer may not return a Serviced Device (or any components thereof) to the manufacturer or vendor without Verizon's written consent. 1.2.2.3 Device Restoration. Under Device Restoration, Verizon will restore the configuration and Rule Sets of the Serviced Device, including the operating system configuration and the application software, from its own back-up copies. Following restoration, Verizon will work with Customer to test the operational availability of the Serviced Device and its connection the SMC. 1.2.2.3.1 Customer Responsibility: Customer is responsible for installing the correct operating system version and patch level on the restored Serviced Device if the Serviced Device is deployed on a server platform. If a Serviced Device is replaced, Customer will also include the physical installation of such Serviced Device with the external IP address configuration. In any case, Customer is responsible to restore: (i) the network connection between the Serviced Device and the SMC, (ii) the communication between the Serviced Device and the Subordinate Devices, and (iii) all software on the Subordinate Devices. 1.2.2.4 Hardware Replacement and Software Upgrades. Under Hardware Replacement and Software Upgrades, Verizon will inform Customer if the manufacturer announces the endof-life of a Serviced Device. The date the support ceases that is communicated by the manufacturer is the end-of-life date. Verizon will notify Customer of software bugs and/or vulnerabilities related to the current version on a Serviced Device and recommend an appropriate software upgrade. These software upgrades may require Customer to upgrade or replace its existing hardware. Hardware replacements and software upgrades/migrations may be completed by Verizon under a separate agreement. A setup NRC may be charged if Customer requests a change of the make and model of a Serviced Device. (Note: The following is not applicable to Unified Security Services, which comprise a bundle of specific hardware appliances and features.) If Customer changes the model (but not the make) of a Serviced Device, and the related MSS - Premises Premium service is not changing, Customer’s request may be processed as a Major Change Request. Customer may request software upgrades for new features and functionality. Such upgrades may be undertaken by Verizon pursuant to a Major Change Request or a separate agreement if Verizon supports the requested software version. 1.2.2.4.1 Customer Responsibility: Unless otherwise agreed to in a separate agreement, Customer is solely responsible for replacing Unsupported Devices. Device Maintenance. The following features are provided under Device Maintenance: 1.2.3.1 Software Maintenance. Under Software Maintenance, Verizon monitors the manufacturer release of new Security Upgrades for Serviced Devices. Verizon does not proactively upgrade features for each Serviced Device. These types of upgrades have to be requested through a ‘Major Change Request’ or through a separate agreement and may only be implemented as long as the version is supported by MSS - Premises Premium service. Verizon will notify Customer of the ready for deployment status for a 1.2.2.1
1.2.3
Verizon. All Rights Reserved.
Page 3 of 27
Verizon CONFIDENTIAL
Managed Security Services – Premises Premium +
1.2.4
critical Security Upgrade within 36 hours after completing the testing and validation of the Security Upgrade. 1.2.3.1.1 Security Upgrades are provided remotely i) unless not feasible due to the physical location of the Serviced Device, or ii) except in cases of operating system and/or firmware upgrades. On-site installation of Security Upgrades may be performed by Verizon under a separate agreement. Verizon also monitors the release of operating system patches and implements patches on the Serviced Device, where applicable. The maximum number of Maintenance Windows regardless of the total number of Serviced Devices that a Customer can define shall not exceed two per week. The day and time of each Maintenance Window will be specified in the Service Context. Each Maintenance Window must be at least four consecutive hours. 1.2.3.1.2 Software maintenance and SLAs do not apply to Unsupported Devices. 1.2.3.1.3 Customer Responsibility: To receive Software Maintenance services, Customer must purchase a 24x7 maintenance support package for its Serviced Devices and authorize Verizon to act on Customer’s behalf to coordinate with the third party manufacturer/vendor to receive Security Upgrades. Customer is responsible for software maintenance of all Subordinate Devices. 1.2.3.2 Device Back-up. Verizon performs a daily back-up of the Serviced Device’s configuration files, Rule Set, and operation system (where applicable). Verizon keeps a copy of the Serviced Device application software and implemented upgrades and/or patches. Threat Analysis. 1.2.4.1 Overview: A Security Incident is generated after logs and events have been processed through threat detection policies and use cases. Verizon defines Logs, Event, and Security Incidents as follows: Logs: A collection of various IT, network, application, and security related information created by Subordinate Devices. Security Event: A data record produced by the SEAM (State and Event Analysis Machine) correlation engine based on Verizon’s proprietary threat detection policies. Security Incident (Incident): A single event or a series of events that have been aggregated and correlated based on Verizon’s proprietary’s threat detection policies. A security incident may represent an attack. Incident Record Communication: A record in the system which tracks and drives the workflow of incidents, change and service requests during their lifecycle to closure. Verizon’s threat detection policies are, amongst others, based on a behavior based, multifactor correlation capability processed through the SEAM that evaluates and correlates reputational and behavioral patterns and characteristics in addition to signature-based detection methods. Verizon correlates and aggregates related events into Security Incidents automatically through its threat detection policies. Verizon has a wide variety of methods to detect Security Incidents. Events may appear harmless when they are detected in isolation; however, when they are combined with information from other events or from information in the Service Context, a more harmful pattern may appear. Events will be compared with Customer’s Service Context and output obtained from network vulnerability scans. The Security and Compliance Dashboard provides a range of reporting functions. Verizon will perform scans on Customer’s Internet facing IP subnets and hosts on a quarterly basis for the locations under contract. The scan data will be used to classify and assign risk scores to Security Incidents and related events, as well as tune the configuration of Serviced Devices, if applicable. The quality of Verizon’s classification and the number of Incidents escalated as an Insufficient Info Incident depends on the quality and completeness of the information that Verizon receives on the network environment of the Serviced Device, including up-to-date scanning and asset data. Customer acknowledges that, without up-to-date network scanning and asset criticality data, Verizon will not be able to maintain optimum configurations of the Serviced Devices, i.e., there will
Verizon. All Rights Reserved.
Page 4 of 27
Verizon CONFIDENTIAL
Managed Security Services – Premises Premium + be an increased risk of false-positives being generated, and Verizon will not be able to assess accurately the impact of Incidents on Customer’s environment. 1.2.5
Security Incident Classification Verizon Classifies Security Incidents into 4 Categories:
Incident Classification
Risk Levels
Conditions
L0
The Incident has been classified as ‘Insufficient Info’ based on the associated events.
L1
The Incident is identified as an attack or an attempted attack that may result in damage or unauthorized access to a device or application. The cause of the Incident renders Customer’s infrastructure vulnerable or compromised.
Harmless Attack
L2
The Incident is identified as a known attack, attempted known attack or reconnaissance effort. Customer’s infrastructure is not considered vulnerable or compromised based on the Service Context.
False Positive
L4
The Incident may be falsely triggered, is informational or benign in nature.
Insufficient Info
Harmful Attack
Offline Analysis Category is used during first phase of deployment Classification
Level
Off-line Analysis
L9
1.2.5.1
Conditions These levels are used during the first phase of a deployment, or after major changes in the network (such as adding or removing a server or Serviced Device, moving a Serviced Device, changing security policies and Rule Sets, installing major signature updates or major software upgrades, implementing an Urgent Change Request or replacing a Serviced Device). These Events will only be logged without real time analysis.
Security Incident Handling. Verizon generates Security Incidents in both real- and nonreal time, depending on the detection method. The status of the Incident will be changed throughout its lifecycle. Status changes are communicated by e-mail and are displayed on the Security and Compliance Dashboard. An SMC Time Stamp (“UTC”) is added after each ‘status’ change. A Security Incident can have the following status: Security Incident Status
Incident Status Open (Security Incident Detection)
Conditions The Incident has been generated based on Verizon’s threat detection policies.
Verizon. All Rights Reserved.
Page 5 of 27
Verizon CONFIDENTIAL
Managed Security Services – Premises Premium + Escalated (Security Incident handling)
An Incident Record Communication is created with the Security Incident information to allow the mitigation, containment or resolution of the risk. A Security Incident is escalated when it is: o A Harmful Attack Incident and concerns a real threat o
Closed
An Insufficient Info Incident: the security analyst needs extra information to classify the Security Incident.
The Incident has been auto-closed or closed by the security analyst.
An Incident classification and status may change based on additional analysis, intelligence information or after Customer feedback has been received. 1.2.5.2 Real-Time Security Incidents. Verizon uses threat detection policies based on one or more use cases to create Security Incidents in real time. All use cases and proprietary signatures are categorized to help (a) increase insight into Security Incidents and (b) reduce the number of false-positive Incidents. The Incident descriptions provide recommendations on possible actions Customer can take. 1.2.5.3 Non-Real Time Security Incidents. Verizon uses threat detection policies based on one or more use cases in order to find patterns over a longer period of time and to allow low confidence indicators to be analyzed more effectively. Security analysts will review these Incidents periodically as a block of security information. If an Incident or a combination of Incidents is considered to be important, the SOC will escalate it. This method optimizes Security Incident handling and focuses on escalating potentially harmful Incidents and reducing Insufficient Info Incidents and False Positives. The Security Incident Escalation SLA does not apply for non-real time security incident handling. 1.2.5.4 Non-Real Time Security Incidents for Customer Digests. Verizon uses threat detection policies based on one or more use cases to present Security Incidents periodically without SOC review or analysis. These Security Incidents will be closed automatically, but can be reviewed by Customer on the Security and Compliance Dashboard in the Security Digest section. Customer digests are focused on specific topics. This Incident handling is optimized for certain types of Incidents that do not require real-time Incident handling and SOC review. They provide additional information to the customer and can support compliance initiatives. The Security Incident Escalation SLA does not apply for customer digests. 1.2.5.5 Security Incident Escalation. Verizon will only escalate Security Incidents that are classified as ‘Insufficient Info’ and ‘Harmful Attack.’ Verizon will examine the characteristics and context of the events and Incidents, and evaluate the possible impact of a threat/attack on Customer’s Serviced Devices before escalating an Incident Record Communication. Verizon will provide additional information to support the investigation of a Security Incident and may propose possible recommendations for next actions. Verizon will not provide remediation services under this service. Customer:
Is responsible for providing missing Incident information for Incidents classified as ‘Insufficient Info’ within the required timeframe; if Customer fails to provide such information, Verizon may send a reminder or change the status of the Incident to ‘Closed.’ Will authorize a Change Request when mitigating actions are expected to be taken by Verizon on any of the managed devices. Is responsible for repairing the integrity of the affected applications and infrastructure for devices under management by Verizon. Must inform Verizon of any actions taken by Customer in order to enable Verizon to update its inventory of Customer’s infrastructure and set the Incident status to ‘Closed.’
Verizon will Escalate an Incident Record Communication with the Following Incident Information: Verizon. All Rights Reserved.
UTC timestamp of the Incident creation Page 6 of 27
Verizon CONFIDENTIAL
Managed Security Services – Premises Premium +
The identity of the affected Serviced Device(s) and its location Source information and destination information Threat signature and use case information, if applicable: threat use case ID, name, and description Packet dumps, if obtainable from the Serviced Device and Subordinate Devices using the existing infrastructure. Targets for Security Incident Escalation
Communication
Communication
Reporting
Channel
Email
Phone and Email
Information Type
Incident Record Communication Insufficient Info (L0) SMC Time Stamp (UTC) Incident Creation ≤ 30 minutes after Incident Creation Authorized Contacts
Incident Record Communication Harmful Attack (L1) SMC Time Stamp (UTC) Incident Creation ≤ 15 minutes after Incident Creation Authorized Contacts
Security and Compliance Dashboard Security and Compliance Dashboard
Reference Time Response Time Contact Person
Refreshed every 15 minutes Authorized Contacts
There are no service level targets for Incidents created in non-real time or in Customer digests. 1.2.6
Service Management and Reporting. 1.2.6.1 Security Dashboard/Security and Compliance Dashboard. Authorized Users have 24x7 access to the Security Dashboard/Security and Compliance Dashboard. Each Authorized User must have one SSL Certificate to access the Security Dashboard/Security and Compliance Dashboard. MSS - Premises Premium includes up to five SSL Certificates. The set-up of an additional Authorized User, and associated SSL Certificate, uses two Service Tickets. 1.2.6.2 Other Incident Tickets. ‘Other Incident Tickets’ are tickets that are created by Verizon or Customer for service related Incidents. They can be logged on a 24x7 basis by the Authorized Users through the Security Dashboard/Security and Compliance Dashboard, via e-mail or telephone. Verizon will not manage Serviced Devices under Monitoring (only) services through an Other Incident Ticket. Verizon assigns a unique Call ID and a Severity Level (as shown below) to every support request that it accepts. The Severity Level is based on the information received from Customer and on the impact of the problem on the Customer’s network environment. 1.2.6.2.1 Customer Responsibilities: Customer must provide its representative’s name, company name, telephone number, e-mail address, error codes/messages received, description of the impact to Customer’s network or business environment, and a detailed description of the problem and how it may replicated, including the steps to replicate the problem.
Problem Severity
Level
Severity 1
S1
Severity 2
S2
Verizon. All Rights Reserved.
Error Conditions An error causes the Serviced Device or the Services to fail. Normal day-to-day business is not possible, e.g. system failure, or an inaccessible or inoperable production system. An error significantly affects the functions of the Serviced Device or MSS - Premises Premium services and prevents normal day-to-day business. Or an error occurs in a high-risk environment, e.g. an error in one line of a high-availability setup.
Page 7 of 27
Verizon CONFIDENTIAL
Managed Security Services – Premises Premium + Severity 3
S3
Severity 4
S4
An isolated error impacts the functions of the Serviced Device. There is no important impact on the day-to-day business. Or an error occurs that significantly affects the Serviced Device or the Services but a Workaround exists. A benign error or a requested improvement. There are no problems with the Serviced Device or MSS - Premises Premium services, and there is no immediate impact on the production environment.
For Severity 1 and 2 problems, Customer and Verizon will both assign a dedicated contact person. There is a Meantime to Resolution (“MTTR”) SLA for Severity 1 tickets. Severity 3 or 4 software problem may be resolved in the next revision or upgrade of software. Verizon reports on the status of a problem with status reports. Verizon reserves the right to refuse unreasonable or unsupportable requests including requests: (i) by unauthorized parties, (ii) that cover the installation of new devices or software, (iii) that amounts to training or consultancy, or (iv) that involves the redesign of Customer’s infrastructure. Verizon will inform Customer of the resolution of ‘Other Incident Ticket’ when resolved. If Customer does not provide the necessary information or undertake a specific task requested by Verizon, Verizon may change the severity level or close the Other Incident Ticket as set out below: After one Business Day, a Severity 1 or 2 problem will be lowered one level After five Business Days, Verizon may close the Other Incident Ticket. Verizon notifies Customer when the Severity Level is lowered to a level that does not require further action. Verizon conducts root cause analysis of the problem and communicates the results to Customer. If the source of the problem lays within Customer’s responsibility (for example, Customer networking issues or Subordinate Devices not under Verizon’s management) each ‘Other Incident’ Ticket will consume four Service Tickets. 1.2.6.3
1.2.6.4
Request for Information. Customer can submit a Request for Information (“RFI”) on Serviced Devices or on MSS - Premises Premium services. RFIs can be raised through the Security Dashboard and will receive a unique call ID that must be used in all further communications on this RFI. Each question uses one Service Ticket. No Service Tickets will be charged if the RFI is related to an existing escalation of an ‘Incident’, ‘Health’ or ‘Other’ Incident. Service Tickets are charged once a Serviced Device has been declared Ready for Operations (“RFO”). Inquiries not directly available through the Security Dashboard or which require a more detailed analysis compared to what is available on the Incident Reports will not be considered as a regular RFI. Examples of such requests are requests to retrieve raw data for forensics and additional one-time reports. Verizon may accept such request pursuant to a separate agreement. Data Availability and Retention. Log Management collects, stores and searches raw logs, and is enabled for all Serviced Devices under Monitoring only. Log Management supports field-based filtering and raw log searches for up to 90 days or 0.2 TB per Serviced Device, whichever occurs first. Log Analytics provides interactive search and analysis capabilities to search log data and works on the same data as the log management capability with the same data storage limitations. Information on Security Incidents and raw Events associated with Incidents are stored in the SMC and are kept for 1 year. Archived Incidents can be made available to Customer via a Service Request - RFI through the Security Dashboard. The number of Service Tickets charged and the response time is dependent on the amount of data to be retrieved and the complexity of the request. The data on raw Events can be made available upon request up to one month after service has ended on that Serviced Device. At the end of such retention period, logs and Customer sensitive data will be disposed of in accordance with the relevant Verizon policies.
Verizon. All Rights Reserved.
Page 8 of 27
Verizon CONFIDENTIAL
Managed Security Services – Premises Premium + The amount of data Verizon receives for a Serviced Device in any month may not exceed 10 GB. Verizon will charge Customer Service Tickets for any amount of data received for a Serviced Device during a month in excess of 10 GB as set forth in the following table: Additional Data Received (each Serviced Device) Per 10 Gigabyte 1.2.7
Service Tickets Charged 6 Service Tickets
Device Security Management. Verizon will maintain a maximum of five users or user groups for authenticating Serviced Devices. The Customer should provide an external authentication server if the number of users or user groups exceeds five. Monitoring and managing such external authentication server is outside the scope of MSS - Premises Premium service. 1.2.7.1 Configuration Management. Verizon will provide recommendations to Customer to maintain the optimum configuration of a Serviced Device. Verizon implements configuration changes during the Maintenance Window agreed to in the Service Context. 1.2.7.1.1 Customer Responsibility. To change a Serviced Device configuration, Customer must make a request using the ‘Change Request’ procedures on the Security Dashboard. Customer is responsible for the configuration management of Subordinate Devices. 1.2.7.2 Rule Set Management. Verizon will implement the initial device Rule Set developed by Customer and approved by Verizon during the service provisioning phase. Customer may request changes to a Rule Set at any time and Verizon may implement the change, upon Verizon’s evaluation of the proposed change. The development, migration, and review of Rule Sets and/or Serviced Device policies will be subject to a separate agreement or at the mutually agreed number of Service Tickets. Customer may obtain a copy of the Rule Set at any time via the Security Dashboard.
1.2.7.3
Verizon initiates the propagation of Rule Set updates on the Management Station of the Serviced Device for Subordinate Devices. Verizon is not responsible for the actual propagation of the Rule Set updates to those Subordinate Devices, but Verizon will inform the Customer via e-mail should the propagation of the Rule Set updates not reach Subordinate Devices. Customer Initiated Change Requests. Customer Initiated Change Request (“Change Requests”) can only be submitted by Authorized Users through the Security Dashboard/Security and Compliance Dashboard. Verizon may reject Change Requests which are not properly submitted (e.g. a Change Request not submitted on the Security Dashboard/Security and Compliance Dashboard or an ambiguous or unclear Change Request). Verizon will email the Authorized User if a Change Request is rejected. Verizon assigns a unique number to each Change Request submitted. Customer must use this number in all communications about the Change Request. The number of Service Tickets consumed by an implemented Change Request is determined by the type of change request and SLA to accept and implement. Verizon may ask Customer for additional confirmation and authorization before implementing a Change Request. Verizon will send a confirmation request to the Authorized Users. A Change Request has a status in each phase of its lifecycle as shown below. When the status changes, an SMC Time Stamp is attached and the Customer is emailed. The Service Description provides full details and conditions relating to the different types of Customer-initiated Change Requests, as described below.
Status Levels in the Acceptance Phase New Assigned Reopened Work in Progress Hold Verizon. All Rights Reserved.
Change Request Conditions The Change Request has been received by Verizon. The Change Request has been assigned to a security analyst. The Change Request has been reopened for further action or feedback. This may be due to an internal Customer or failed change. The Change Request is being managed by a Security Engineer. The Change Request is under review and the SLA is paused. Page 9 of 27
Verizon CONFIDENTIAL
Managed Security Services – Premises Premium + Status Levels in the Implementation Phase Hold - Accepted Hold - Internal Hold – Under Review or Pending Peer Review Hold – Customer Request or Awaiting Customer Feedback Hold – Internal Vendor Hold – Customer’s Vendor Hold – Scheduled Work Status Levels in the Verification Phase Resolved - Discarded Resolved Implemented Closed 1.2.7.3.1
1.2.7.3.2
Verizon. All Rights Reserved.
Change Request Conditions The Change Request has been reviewed and accepted for implementation. The implementation SLA is in effect. The Change Request has been put on hold by Verizon and the implementation SLA is in effect. The Change Request is pending an action from Verizon. The implementation SLA is in effect. The Change Request is on hold by request of Customer or it is on hold pending an action by Customer which is preventing the implementation of the Change Request. The implementation SLA is not in effect. The Change Request is pending an action by a Verizon vendor and implementation of the Change Request is pending. The implementation SLA is in effect. The Change Request is pending an action by Customer’s vendor, which is preventing implementation of the Change Request. The implementation SLA is not in effect, as Verizon is awaiting action from Customer’s vendor. The Change Request has been scheduled for a specific date and time to activate the Change Request. The implementation SLA is in effect. Change Request Conditions The Change Request has been discarded. The implementation SLA is stopped. The Change Request has been implemented. The implementation SLA is stopped. The Change Request has been implemented and Customer has verified the implementation. No further action is required. Regular Change Request. A Regular Change Request (“RCR”) is a planned change to the topology of the infrastructure or security policy that: involves changes to existing rules, or the creation of new rules or objects, in the Serviced Device Rule Set, involves creation of new hosts in the policy, and the host is part of a subnet that is already accessible and configured on the Serviced Device, involves allowing or disallowing traffic between existing hosts, involves a change to the application software, or involves changes to operating system settings, except for changes to IP addresses. Verizon reviews and accepts an RCR within 24 hours after submission. Verizon implements an accepted RCR in the next Maintenance Window, provided that the minimum time between submitting an RCR and its implementation is at least 48 hours. RCRs consume two Service Tickets. Major Change Request. A Major Change Request may be needed in addition to an RCR. Such a change can be implemented subject to a separate agreement or at a mutually agreed number of Service Tickets. There are no SLAs for the implementation of a ‘Major Change Request’. A Change Request is ‘Major’ when it involves any of the following: More than ten changes to the Rule Set of the Serviced Device. Changes to the IP addresses of a Serviced Device. A simple architecture change (e.g., adding a DMZ or web server behind the firewall). Activating a previously unused function on a Serviced Device. Page 10 of 27
Verizon CONFIDENTIAL
Managed Security Services – Premises Premium +
1.2.7.4
Changes estimated to require more time than available in a Maintenance Window. Configuring a new site-to-site VPN tunnel on the Serviced Device. Verizon provides ‘management’ of up to 10 tunnels as part of the Firewall and Security Appliance services. It does not include Availability or Health Monitoring for these tunnels. The first 10 tunnel configurations are included, but additional charges apply for > 10 VPN tunnels. There are no SLAs for the implementation of a Major Change Request. 1.2.7.3.3 Fast Track Change Request. A ‘Fast Track’ Change Request is a planned or unplanned change which: Impacts changes to existing rules or the creation of new rules or objects in the Rule Set of the Serviced Device as long as a maximum of three Serviced Devices are involved. Creates new hosts in the policy of the Serviced Device as long as the host is part of a subnet that is already accessible and configured on the Serviced Device. Allows or disallows network traffic between existing hosts. A Fast Track Change Request consumes six Service Tickets. 1.2.7.3.4 Urgent Change Request. An Urgent Change Request (“UCR”) is an unplanned change which: Modifies the existing rules of one Serviced Device or the creation of new rules or objects in the Rule Set for one Serviced Device. Involves changes which specify the required configuration setting and its new value. Customer will provide the following when submitting an Urgent Change Request: Detailed data to allow Verizon to review the request within the SLA target of ≤ 2 hours. Availability of an Authorized Contact by telephone to further clarify the Urgent Change Request. Confirmation of Customer decisions made during phone calls via Email(s) to Verizon. UCRs consume eight Service Tickets. Customer acknowledges that an Urgent Change Request gives Verizon less time to review and mitigate potential availability or security risks associated with the change request and, therefore, implementation carries a higher degree of risk. Customer accepts all risks associated with an Urgent Change Request when submitting such a request. 1.2.7.3.4.1 Urgent Change Request for Anti-DDoS Serviced Devices. Customer may request urgent assistance from Verizon in order to make changes on the Anti-DDoS Serviced Device in an effort to mitigate the effects of an ongoing or imminent DDoS related threat. • Customer must first submit a UCR and then contact the SOC by telephone. • Verizon will attempt to validate and implement the UCR as soon as possible. Verizon Initiated Emergency Change Request. Verizon may implement Emergency Change Requests, such as changing the Rule Set of the Serviced Device. Verizon may also disable Threat Signatures under the following circumstances: Verizon witnesses or is notified of a massive attack of a virus/worm outbreak with the risk of flooding Verizon’s infrastructure. Verizon notes flooding that may be caused by changes in the topology of Customer’s infrastructure (e.g., rewiring, adding new subnets, new applications with new protocols, misconfigured Subordinate Devices). If Verizon believes that changes to the Service Context submitted by Customer are believed to influence a Rule Set. These changes may include adding, removing, or
Verizon. All Rights Reserved.
Page 11 of 27
Verizon CONFIDENTIAL
Managed Security Services – Premises Premium +
1.3
moving servers, adding new applications or web servers, and changes to Rule Sets of Customer-managed devices. Verizon is authorized to make changes to the Serviced Device Rule Set, disable Threat Signatures and make changes to Serviced Devices in emergencies according to the notification timeline for Urgent Change Requests. 1.2.8 Security Services Advisor. Customer is assigned a SSA who will host a quarterly service review meeting. The SSA is assigned to multiple MSS - Premises Premium customer accounts and is not dedicated to Customer. The SSA assists with the following items: Training on Security Dashboard/ Security and Compliance Dashboard Manages Customer Communication and Security Advisories Provides assistance in scheduling a quarterly external network scan Manages service issues and Service Credit requests The SSA may perform additional functions as described in the Service Description The SSA is the Customer escalation point for issues regarding the amount of Service Tickets allocated to a service request, issues with credits, inquiries about the scope of the services, and quality of the MSS - Premises Premium service and the SLA. In addition, the SSA makes recommendations to improve Customer’s security and risk posture, analyzing the Serviced Device capacity lifecycle, providing Customer-specific and industry-specific risk advisories, assisting Customer with critical asset identification and internal/external vulnerability scanning and scan data uploads to improve Threat Analysis and Security Incident Handling, and training Customer on the use and features of the Security and Compliance Dashboard. (Note: Unified Security Services does not include Security Services Advisor support.) 1.2.9 Management Stations (if applicable). A management station may be required to capture and manage the Logs or Events/Alerts from specific Serviced Devices. Verizon may provision Customer or Verizon-owned management stations hosted in Verizon’s SMC for certain types and categories of Serviced Devices. In all other situations, Customer is responsible for the necessary management licenses and/or related software/hardware to enable Verizon to provide MSS - Premises Premium on the Serviced Device. The required management station design and architecture is determined solely by Verizon in consultation with the Customer prior to activation of MSS - Premises Premium service. Additional information is provided in the Service Description. (Note: This feature is not applicable to Unified Security Services.) 1.2.10 Installation, Configuration, Design, and Review Services. Verizon does not provide onsite installation, architectural and policy design services under MSS - Premises Premium service. MSS Premises Premium service also does not include policy and configuration reviews, initial setup or maintenance of configuration on Subordinate Devices, or migrations from management stations located on Customer’s premises to management stations hosted the SMC or from third-party owned management stations to management stations either located on Customer’s premises or hosted in the SMC. All of these excluded services, however, can be conducted by Verizon under a separate agreement. 1.2.11 Unsupported Devices. Verizon may monitor and/or manage Unsupported Devices and end of life software versions if agreed to under this Service Order/Service Attachment. This service covers the temporary management of Customer devices for a maximum period of six months until replaced by supported Serviced Devices. The following restrictions apply: Monitoring and/or Management of the Unsupported Device is provided “as is.” Monitoring (only) customers will only receive Device Availability Monitoring. Monitoring and Management customers will receive Device Availability Monitoring, Device Troubleshooting, Configuration Management and Rule Set Management services. No SLAs apply. Hardware replacements and software upgrades/migrations for unsupported devices or end of life software may be planned and carried out by Verizon, if agreed under a separate written work agreement and charged at the Applicable Rates. If Customer wishes to change the vendor of a Serviced Device or upgrade a model of a Serviced Device provided by the same vendor, Verizon will charge a device set-up fee to perform the operational changes. Premium Plus and Security Enterprise Service Options. Under Premium Plus, the following options are available for Serviced Devices and are subject to an additional MRC and, in some cases, an NRC. Security Enterprise services are available as a general MSS - Premises Premium service and are note associated with a particular Serviced Device or site. Security Enterprise services are subject to an additional MRC and, in some cases, an NRC. Premium Plus and Security Enterprise options cannot be purchased on a standalone basis. (Note: Premium Plus and Security Enterprise options are not applicable to Unified Security Services.)
Verizon. All Rights Reserved.
Page 12 of 27
Verizon CONFIDENTIAL
Managed Security Services – Premises Premium + Note: Currently, Premium Plus Service options are not supported for Anti-DDoS devices. Neither Premium Plus nor Security Enterprise options are supported for Unified Security Services. Premium Plus Service Option
Monitoring √
Remote Office Availability SLA 1.3.1
1.3.2
1.3.3
Monitoring and Management Service √ √
Remote Office. Remote Office may be ordered if: The Serviced Device is the only device and protects the network assets on the remote physical location. The Serviced Devices is a Firewall, Router, or UTM Security Appliance. The Serviced Device has no more than three distinct remote office rule sets across all remote locations. A Change Request to a distinct Remote Office Rule Set is implemented on all Serviced Devices with that Rule Set and is treated as a Major Change Request. The Service Level Agreement does not apply to Remote Office devices. Availability SLA. The Availability SLA may be ordered if: The Serviced Device is located with the Customer network traffic and all traffic ceases flowing through the Serviced Device while the Serviced Device is unavailable (“Serviced Device Service Outage”). The Serviced Device is installed in an; i) Active/Passive (High Availability) mode where a secondary device will automatically takeover the critical device functions in case of failure of the primary device; or ii) Active/Active mode where either device may automatically take over the critical device functions and network load of the other device in case of a single device failure. ** Note that the term “Serviced Device” in this bullet refers to both devices in an Active/Passive (High Availability) mode. For devices in an Active/Active mode, the term “Serviced Device” refers to both of the two Serviced Devices in that configuration. High Availability Service is not a supported configuration option for Anti-DDoS Serviced Devices. The Serviced Device is covered by an 8x5xNext Business Day (NBD) hardware replacement maintenance contract. The Serviced Device is equipped with a Verizon accessible serial console interface allowing device-level access. Security Enterprise Service Options. Security Enterprise Service Options Executive Reporting Security Policy Program Security Policy Program Reporting and Review Local Event Collector Service Tickets Network Threat Monitoring 1.3.3.1
1.3.3.2
Executive Reporting. Daily and/or weekly reports will be prepared. Such reports will contain an overview of escalated Availability, Health, and Incidents over the last reporting period as well as an overview of the Change Requests over the last reporting period. Customer may request to review these reports with the SSA in the quarterly service review. These reports will be made available through the Security Dashboard and will be sent to Customer via e-mail. Security Policy Program. The Security Policy Program addresses the needs of enterprises that require a monthly in-depth review of threat management and provides customers with the following services: Device review to check the enabled signature sets. Policy assistance in managing vendor signatures and updates. Monthly strategic review on Incidents to provide broader trends on Incidents.
Verizon. All Rights Reserved.
Page 13 of 27
Verizon CONFIDENTIAL
Managed Security Services – Premises Premium +
1.3.3.3
1.3.3.4
1.3.3.5 1.3.3.6
Security Digest review: include a summary with highlights and recaps of items of interest (non-real time threat monitoring). Integration of scan data on the quarterly internal Network Vulnerability Scanning service and up to eight additional scans. The Security Policy Program cannot be sold on a standalone basis and is provided in addition to a Managed Security Service. The program is charged on a per customer basis. Security Policy Program Reporting and Review. A monthly reporting summary review. The report contains a detailed overview of Security Incident handling and provides recommendations for continuous improvement on how to resolve specific security issues. This service includes the following reporting types and summaries: Security Incident handling summary of Incidents and Events. Report that provides trending per month and per 12 months. Local Event Collector. Equipment at Verizon’s premises used to set up secured monitoring or management connections between the Serviced Devices and one or more SMCs. Service Tickets. A unit for charging certain usage-based services under MSS - Premises Premium. Network Threat Monitoring. Network Threat Monitoring reinforces customer threat and security event recognition capabilities based on watchlist matching as further described here:
For U.S. Services: Managed Security Services – Security Enterprise – Network Threat Monitoring + For non-U.S. Services: Managed Security Services – Security Enterprise – Network Threat Monitoring + (Note: Not all features are available to customers in Luxembourg.) Part III: Unified Security Services Rates and Charges. The provision of Unified Security Services to applications or Serviced Devices listed in the applicable Contract is a separate Unified Security Service. Customer must purchase or lease a security appliance (Serviced Device) from Verizon and procure Verizon maintenance/support for such security appliance during the Service Commitment. Customer will pay the non-recurring charges (“NRCs”) and monthly recurring charges (“MRCs”) per Unified Security Service and per Serviced Device (or per other specified item) as set forth in the applicable Contract or, for rates not found in the applicable Contract, the rates posted at the link in Part 1. The NRC is billable for new installs or physical location moves. Unless expressly indicated otherwise, all NRCs will be invoiced upon Order Confirmation Date and the initial MRCs will be invoiced upon Service Activation Date. Unified Security Services is only available in the United States. 1. Service Description and Requirements. Unified Security Services is comprised of MSS – Premises Premium + Monitoring and Management (subject to the exceptions noted in Part II, Sections 1; 1.2.7.3.2; 1.2.8; 1.2.9; 1.3; 2.1; and 2.6), a security appliance deployed on Customer’s premises with 24x7 Monitoring and Management of the security features included in the service tier purchased by Customer. Customer must purchase or lease the designated security appliance from Verizon. Three service tiers are available: Basic, Intermediate and Advanced. Each tier provides progressively more security features, as described below: 1.1 Basic Service Tier. The Basic tier includes the following features: 1.1.1 Network Firewall. Controls incoming and outgoing network traffic based on a set of rules. Rules are composed of firewall objects such as source and destination IP addresses, source and destination ports, zones, and scheduling. 1.1.2 Virtual Private Networks (“VPN”). Virtual Private Network (VPN) technology enables remote users to connect to private networks and resources via secure/encrypted (SSL or IPSec) tunnels over open insecure connections. A VPN reduces the possibility that unauthorized parties can intercept the information exchanged between the remote user and host private networks. VPNs can also be used to connect two or more private host networks. 1.1.3 Gateway Based Anti-Virus / Anti-SPAM. These real-time gateway-based solutions are supplemental network protections to be combined with Customer’s existing primary anti-virus/antiSPAM security tools. The anti-virus service protects against network-transmitted malware such as viruses, worms, trojans, ransomware, scareware, spyware, adware, botnets, phishing and grayware trying to breach the edge of a network. The anti-SPAM service uses both a real-time sender IP reputation database and a spam signature database, along with sophisticated spam filtering tools, to help detect and alert on a wide range of spam messages. Verizon. All Rights Reserved.
Page 14 of 27
Verizon CONFIDENTIAL
Managed Security Services – Premises Premium + 1.1.4
Guest WIFI (Small Security Appliance Only). Isolated wireless Internet access for guest users who accept a customer’s terms and conditions. Upon connecting to the Guest WIFI, users will be prompted with a customizable (based on templates) splash page they must accept to gain access. Guest users will only be allowed out to the Internet, and will not have access to any internal resources in the customer’s network. 1.2 Intermediate Service Tier. The Intermediate tier includes all of the Basic service tier features plus the following features: 1.2.1 Web Content Filtering. Web content filtering is a means of controlling the HTTP- and HTTPS-based Internet content that an end user is able to view using either proxy or payload replacement technologies. Typically, administrators of a business network choose to block harmful or unproductive categories of content such as adult, gaming, malicious, social media, etc. from a primary group of users and set up a secondary group of users (e.g., executives) with less restrictive browsing options. 1.2.2 Intrusion Detection System (IDS). Monitors a network edge for outside attacks by using anomaly and signature-based detection technologies. Upon identification of a potential attack, it alerts an administrator to the attack or signals an integrated IPS service to protect the network. 1.2.3 Intrusion Protection System (IPS). Works in conjunction with the IDS to protect a network against known attacks or vulnerability exploits by an attacker attempting to gain access to a private network. IPS will actively block and alert on the attempted intrusion. 1.2.4 Layer 7 Application Controls. Monitors the network edge traffic to detect specific application traffic destined for endpoints within Customer’s network and controls the communication with the endpoint, regardless of the port, protocol, or IP address used. This allows Customer to create more specific firewall rules by application, as opposed to just port and IP address. 1.3 Advanced Service Tier. The Advanced tier includes the features of the Basic and Intermediate service tiers plus the following features: 1.3.1 SSL-Encrypted Traffic Inspection. Allows anti-virus, anti-spam, web content filtering, and data loss prevention (“DLP”) to be applied to SSL-encrypted network traffic. The service intercepts, decrypts and inspects the encrypted sessions between the end user and remote device to determine if it is necessary to block the payload. If the network traffic is identified as not malicious, it is re-encrypted and continues on its normal path without any indication the inspection has taken place. 1.3.2 Data Loss Prevention. DLP is a sophisticated pattern matching solution to prevent unauthorized external communication of sensitive or regulated data beyond the network edge. Typically, administrators of a network choose to define data patterns for content such as social security numbers, credit card numbers, items tagged confidential or proprietary, etc., to be blocked, or logged and allowed. 1.3.3 Voice over IP (“VoIP”) Traffic Shaping. VoIP traffic shaping is a major advantage when attempting to ensure the quality of VoIP calling by applying bandwidth limits and prioritization. Traffic shaping can also be applied to VoIP traffic using differentiated services code points (DSCP) or type of service indicators (ToS) to determine how the IP datagram should be delivered, using criteria of delay, throughput, priority and cost. 1.3.4 Explicit Proxy Web Optimization. As with VoIP traffic shaping, deploying an explicit proxy with caching can help improve your user’s web browsing experience, caching web content at your network’s edge, avoiding the need to constantly retrieve static content from remote servers. 2. Security Appliance. The security appliance is sized small, medium and large based on the data transfer rate of the associated network connection, respectively, ≤ 100 Mbps, ≤ 250 Mbps and ≤1Gbps). Specifications for security appliance features can be found in the Service Description for Unified Security Services posted on the Security Dashboard/Security and Compliance Dashboard. Charges for the security appliance and associated deployment services and maintenance will be listed as separate line items on the applicable invoice. 3. Specifications for Unified Security Services. Unified Security Services is available only as a monitoring and management service. Monitoring Services Device Availability and Health Monitoring Unified Security Services
3.1
Threat Analysis
Security Incident Handling
√
√
√
Management Services
Service Management and Reporting √
Device Maintenance
Device Health Management
Device Security Management
Service Management and Reporting
√
√
√
√
Hardware Replacement. Verizon will manage the third party vendor maintenance and support agreements relating to the security appliance on Customer’s behalf during the Service Commitment. In that capacity,
Verizon. All Rights Reserved.
Page 15 of 27
Verizon CONFIDENTIAL
Managed Security Services – Premises Premium + Verizon will escalate problems to the vendor and coordinate the servicing of the hardware and software as needed. Verizon will configure and ship a spare security appliance to Customer the next Business Day after a Return Material Authorization (RMA) replacement has been approved and prior to return of the faulty security appliance (advance ship). Verizon will process all RMAs using UPS priority next Business Day shipment. 4. Customer Obligations 4.1 Initial Rule Set Creation (Security Policy). Verizon will assist Customer to create a limited initial Rule Set, using a deployment configuration survey and templates to simplify the task. Verizon will work remotely with Customer (via telephone and/or email) to develop and mutually agree with Customer on the initial configuration. The initial configuration will be limited to security appliance feature configuration and no more than 40 network objects and a 20-line Rule Set. More complex initial Rule Sets can be provided subject to terms mutually agreed upon by Verizon and Customer and may incur additional staging costs. Customer will provide information to Verizon as reasonably requested by Verizon to provide such assistance and to configure the security appliance prior to installation of Unified Security Services. 4.2 Installation and Remote Access. Unified Security Services does not include on-site Installation. The security appliance is shipped to Customer’s site, where Customer will connect it with Verizon’s guidance. When requested by the SOC, Customer must connect the security appliance to an Internet reachable router or similar device via the serial console cable provided to allow device-level access for diagnosis and configuration. Failure to do so may impact service availability or result in termination of service. 4.3 Equipment Return. Unless Customer elected to purchase the security appliance in the order, Customer must return any security appliance provided as part of Unified Security Services within 30 days after termination of Unified Security Services. Following any hardware replacement pursuant to Section 3.1, Customer must return the faulty security appliance to Verizon within 30 days after the RMA authorization. All security appliances must be returned in the same condition as they were originally delivered, normal wear and tear excepted, and packaged in their original packaging or equivalent packaging materials. If Customer fails to return the security appliance within 30 days after (a) termination of Unified Security Services or (b) RMA authorization, as applicable, Customer must pay the actual cost and expense to replace such security appliance. Part IV: Service Terms and Conditions. 1. Excluded Services. The parties acknowledge that Verizon has no obligation to provide MSS - Premises Premium for any Serviced Device that: (i) has been subjected to unusual physical or electrical stress, misuse, negligence or accident; (ii) has been modified, merged, relocated, repaired, serviced or otherwise attended to by a party other than Verizon or without Verizon’s prior written consent; (iii) runs a version of operating system and/or application software that is not supported by Verizon, or that is no longer supported or maintained by the relevant manufacturer or licensor; or (iv) has not been properly registered and/or for which required permits or approvals are not or no longer maintained. 2. Customer Responsibilities. 2.1 Maintenance Contracts. Customer shall (i) at its own expense, procure and maintain with each vendor adequate maintenance contracts and all licenses necessary for the Serviced Devices to enable Verizon to properly perform MSS - Premises Premium; (ii) comply with MSS - Premises Premium prerequisites and operational procedures as set forth in the applicable terms; and (iii) promptly inform Verizon of any changes effectuated in Customer’s network and/or Information Technology infrastructure (“Customer Environment”) and any changes to the nomination and/or authorization level of the individuals Customer has authorized to oversee, monitor or evaluate the provision of MSS - Premises Premium. Section 2.1(i) is not applicable to Unified Security Services. 2.2 Interoperability. Customer acknowledges that modifications or changes to the Serviced Devices (such as future releases to the Serviced Device’s operating software) or to the Customer Environment may cause interoperability problems or malfunctions in a Serviced Device and/or the Customer Environment. Customer acknowledges that it is Customer’s responsibility to maintain, at its sole cost and expense, the Customer Environment to ensure that the Customer Environment is interoperable with each Serviced Device. 2.3 Minimum Orders. Customer acknowledges and accepts that some MSS - Premises Premium services may require a minimum order quantity. Customer shall be advised if a minimum order quantity applies in advance of Customer’s order. Any unused portion of such minimum quantity shall be deemed forfeited upon termination or expiration of the related MSS - Premises Premium service and Customer shall not be entitled to receive any refund, credit or other form of reimbursement of fees paid in respect of such unused portion. Verizon. All Rights Reserved.
Page 16 of 27
Verizon CONFIDENTIAL
Managed Security Services – Premises Premium + 2.4
2.5
2.6
2.7
Service Equipment. Verizon may use Service Equipment to collect Logs and Events from Serviced Devices and to forward such Logs and Events to the SMC (“Connection Kits”). If Verizon determines that a Connection Kit is needed on Customer’s Site, Customer must either: (i) provide such Connection Kits subject to Verizon specifications, or (ii) Verizon may provide Connection Kits to a limited number of countries at an additional cost. Verizon will configure and access such equipment remotely. Where Verizon supplies Connection Kits, Customer return such Connection Kits at Customer’s sole cost to the address indicated by Verizon upon termination of MSS - Premises Premium. Connection Kits must be returned in the same condition as they were originally delivered, normal wear and tear excepted, and packaged in its original packaging or other equivalent packaging materials. If Customer fails to return the Connection Kit within 14 days following the termination of MSS - Premises Premium, Customer shall pay the greater of: (i) 50% of the relevant set-up per site NRC indicated in the Service Order; or (ii) the actual cost and expense to replace such Connection Kit. 2.4.1 CPE Purchase. Customer may purchase CPE from Verizon pursuant to the terms found here: For U.S. Services: Customer Premises Equipment and Related Services + For non-U.S. Services: Customer Premises Equipment and Related Services + User Interface. In connection with the provision of MSS - Premises Premium, Customer may be provided with one or more user IDs, account numbers, personal identification numbers or codes, passwords, digital certificates or such other means of authentication (“Login”) to access a web-based portal, dashboard, or other form of user interface (“User Interface”). The User Interface and Login may be used for accessing on-line services, authorizing instructions and requests and/or ordering additional services or Service Tickets. Customer shall at all times keep its Login strictly confidential and shall take all reasonable precautions to prevent unauthorized use, misuse or compromise of its Login. Customer agrees to notify Verizon promptly upon learning of any actual or threatened unauthorized use, misuse, or compromise of its Login. Verizon is entitled to rely on Customer’s Login as conclusive evidence of identity and authority. Customer shall be liable for all activities and charges incurred through the use of Customer’s Login, and will indemnify, defend and hold Verizon harmless from all liabilities, losses, damages, costs and expenses (including, without limitation, reasonable attorneys’ fees and costs) incurred by Verizon to the extent resulting from the use and/or compromise of Customer’s Login, unless the unauthorized use, misuse or compromise of Customer’s Login is solely attributable to a Verizon’s gross negligence or willful misconduct. Installation Sites and Equipment. Customer shall prepare any installation site in accordance with Verizon’s instructions to ensure that any equipment that interfaces with Customer’s computer system is properly configured as required for the provision of MSS - Premises Premium service and operates in accordance with the manufacturer’s specifications. With the exception of Serviced Devices managed under Unified Security Services, all Serviced Devices must have a routable network path to the Connection Kit and, if required, an agent must be loaded on each Serviced Device. Customer will install and maintain software agents required for the provision of MSS - Premises Premium to Serviced Devices (e.g. for syslog logging for operating system (“OS”) and active directory server), at its cost. If Customer fails to make any preparations required herein and this failure causes Verizon to incur costs during the implementation or provision of MSS Premises Premium service, then Customer agrees to reimburse Verizon promptly for these costs. Customer acknowledges and agrees that MSS - Premises Premium is offered and provided by Verizon to multiple customers doing business in various industries. Absent terms to the contrary in the Agreement, MSS - Premises Premium is implemented without specific controls that may generally be required or customary for customers in any particular industry and is not designed to satisfy any specific legal obligations. Customer shall be solely responsible for determining that MSS - Premises Premium satisfies Customer’s obligations under law or contract. Customer agrees to use MSS - Premises Premium in accordance with all applicable laws and not to use MSS - Premises Premium in any manner that imposes obligations on Verizon under any laws other than those laws with which Verizon agrees to comply as specifically set forth in the Agreement. Without limiting the generality of the foregoing, Customer agrees not to cause, or otherwise request that Verizon create, receive, maintain or transmit protected health information (as defined at 45 C.F.R. § 160.103) for or on behalf of Customer in connection with MSS - Premises Premium or in any manner that would make Verizon a business associate (as defined at 45 C.F.R. § 160.103) to Customer. In the event Customer acts or uses MSS - Premises Premium in a manner not permitted under this Section 2.7, Customer shall (a) be in material breach of the Agreement, including this Service Attachment; (b) indemnify, defend and hold harmless Verizon for any losses, expenses, costs, liabilities, damages, penalties, investigations or enforcement proceedings (including attorneys’ fees) arising from or relating to Customer’s breach of this Section 2.7; (c) take, at Customer’s expense, prompt action to correct and/or mitigate the effects of Customer’s breach of this Section 2.7; and (d) provide Verizon with reasonable cooperation and support in connection with Verizon’s response to Customer’s breach of this Section 2.7. Customer shall assume and be
Verizon. All Rights Reserved.
Page 17 of 27
Verizon CONFIDENTIAL
Managed Security Services – Premises Premium + solely responsible for any reporting requirements under law or contract arising from Customer’s breach of this Section 2.7. 3. Warranties. 3.1 Verizon Warranties. Verizon warrants to Customer that it will perform its obligations in a good and workmanlike manner. The remedies set forth in the service level agreement (“SLA”) portion of this Service Attachment are Customer’s sole and exclusive remedies in connection with the portions of MSS - Premises Premium related to the failure to meet any standard set forth in the SLA. Verizon does not warrant that MSS Premises Premium will detect and prevent all possible threats and vulnerabilities or that such services will render Customer’s network and systems invulnerable to all security breaches and vulnerabilities. 3.2 Third Party Warranties. For any third party products and/or services incorporated as part of MSS Premises Premium, Customer shall receive only the warranties offered by such third party to the extent Verizon may pass through such warranties to Customer. 3.3 Customer Warranties. Customer represents and warrants that (a) it has and will continue to have all rights, power, permissions and authority necessary to have Verizon perform MSS - Premises Premium services in the Customer environment (including, without limitation, all rights, power, permissions, authority and network user consents necessary in respect of any IP address assigned to a Serviced Device and consent from its network users to Verizon’s logging and monitoring activities hereunder), and (b) will not provide any PHI to Verizon for purposes of Verizon’s performance of services hereunder. Customer hereby assumes the sole responsibility for the accuracy of the IP addresses and domains provided to Verizon. Customer will be liable for all costs and expenses from any third party claims of loss, damage (including reasonable attorneys’ fees) and liability of any kind that may be incurred as a result of Customer’s breach of the foregoing warranty. 4. Termination. 4.1 Pre-Service Activation Date Termination. Either party may terminate a request for MSS - Premises Premium service for any Serviced Device prior to the Service Activation Date with or without Cause, effective thirty (30) days after written notice of cancellation. If Customer requests for a termination of an MSS Premises Premium service prior to the Service Activation Date as set forth under this provision, or Verizon terminates an MSS - Premises Premium service as a result of Customer’s failure to provide the necessary information or reasonable assistance required by Verizon to provision MSS - Premises Premium service and deem it as the Service Activation Date, Customer will pay any set-up fees and other amounts accrued for MSS - Premises Premium through the termination date. 4.2 Post-Service Activation Date Termination. Either party may terminate MSS - Premises Premium, or an MSS - Premises Premium service on any Serviced Device, with or without cause, effective sixty (60) days after written notice of termination is given to the other party. Customer accepts and agrees that, in the event (i) Customer terminates any order for convenience or (ii) Verizon terminates any order for Cause prior to the end of the Initial Order Term, then Customer will pay Verizon all unpaid fees payable under this Service Attachment and the applicable order for the remainder of such Initial Order Term. Customer shall promptly pay Verizon’s invoice in accordance with the terms of the Agreement. 4.3 Reinstatements. If Customer elects to terminate an MSS - Premises Premium service for any Serviced Device or renew an MSS - Premises Premium service after it has ended, Verizon may require payment of the then applicable service initiation fees to re-establish the MSS - Premises Premium service (e.g. set-up NRCs). 5. Assumption of Risk. 5.1 Scanning Risks. MSS - Premises Premium involves the use of network scanning technology that has inherent risks, including, but not limited to, the loss, disruption, or performance degradation of Customer’s or a third party’s business processes, telecommunications, computer products, utilities, or data (the “Scanning Risks”). When Customer requests network scanning, or any MSS - Premises Premium component utilizing network scanning, Customer authorizes Verizon to perform the network scanning and assumes all risk for adverse consequences resulting from or associated with such component of MSS - Premises Premium. Verizon shall take reasonable steps to mitigate these Scanning Risks; however, Customer understands that these Scanning Risks are inherent in the provision of certain computer security services and the use of certain computer security products and cannot be eliminated. Customer shall indemnify and defend Verizon for all costs and expenses related to a third party’s claim of loss, damages and liabilities (including legal expenses and the expenses of other professionals) incurred by Verizon, resulting directly or indirectly from any claim attributable to or arising out of Verizon’s use of network scanning technology (each, a “Scanning Claim”), including, without limitation, the use by Verizon of network scanning technology to analyze assets that are not controlled directly by Customer, including, without limitation, servers hosted by third parties. This obligation of Customer in connection with a Scanning Claim shall not apply if Verizon’s gross negligence or willful misconduct gave rise to such Scanning Claim. Verizon. All Rights Reserved.
Page 18 of 27
Verizon CONFIDENTIAL
Managed Security Services – Premises Premium + 5.2
7.
8.
9.
10.
11.
Change Requests. Customer assumes all risks associated with Change Requests initiated by Customer. Verizon will deliver Change Requests strictly in accordance with the instructions provided by Customer. Verizon has no responsibility to provide technical advice to Customer in relation to the Change Requests, and the risks associated with such Change Requests. Third Party Products or Services. The parties agree that Verizon shall not be liable for any damages caused by hardware, software, or other products or services furnished by parties other than Verizon, its agents, subcontractors, or any damages caused by the products and/or services delivered by or on behalf of Verizon which have been modified, serviced, or otherwise attended to by parties other than Verizon or without Verizon’s prior written and express consent. Customer acknowledges that Verizon shall not be liable for any damages resulting, directly or indirectly, from any act or failure to act by Customer or any third party (including, without limitation, the nonperformance, defaults, omissions or negligence of any third party that provides telecommunications services in the country or countries in which Customer’s premises or systems are situated and other countries from, across, to or in respect which MSS - Premises Premium is provided by or on behalf of Verizon). Industry Alerts and Third Party Updates and Patches. WITH REGARD TO SERVICES WHICH PROVIDE INFORMATION SHARING AND/OR INDUSTRY ALERTS, VERIZON DISCLAIMS ANY LIABILITY TO CUSTOMER, AND CUSTOMER ASSUMES THE ENTIRE RISK FOR (A) INFORMATION FROM THIRD PARTIES PROVIDED TO CUSTOMER WHICH TO THE BEST OF VERIZON’S INFORMATION, KNOWLEDGE AND BELIEF DID NOT CONTAIN FALSE, MISLEADING, INACCURATE OR INFRINGING INFORMATION; (B) CUSTOMER’S ACTIONS OR FAILURE TO ACT IN RELIANCE ON ANY INFORMATION FURNISHED AS PART OF MSS - PREMISES PREMIUM; AND/ OR (C) THE USE OF ANY THIRD PARTY LINKS, PATCHES, UPDATES, UPGRADES, ENHANCEMENTS, NEW RELEASES, NEW VERSIONS OR ANY OTHER REMEDY SUGGESTED BY ANY THIRD PARTY AS PART OF MSS - PREMISES PREMIUM. Intellectual Property Rights. Neither party acquires right, title or interest in or to the other party's information, data base rights, data, tools, processes or methods, or any copyrights, trademarks, service marks, trade secrets, patents or any other intellectual or intangible property or property rights of the other party by virtue of the provision of MSS Premises Premium or materials delivered pursuant MSS - Premises Premium service. Customer retains all right title and interest in and to the underlying factual data gathered through the provision of MSS - Premises Premium. Verizon owns all right title and interest in and to Verizon’s trade secrets, confidential information or other proprietary rights in any creative or proprietary ideas, information or other material used by Verizon or presented to Customer (each, a “Technical Element”), including, but not limited to: data, software, modules, components, designs, utilities, databases, subsets, objects, program listings, tools, models, methodologies, programs, systems, analysis frameworks, leading practices, report formats, manner of data expression and specifications. Verizon grants Customer a nonexclusive, royalty-free license to use each Technical Element integrated into any deliverable solely for Customer’s internal business purposes. Customer may disclose a Technical Element integrated into a deliverable to a third party as long as such third party is subject to a written nondisclosure agreement, requiring such third party to maintain the confidentiality of such Technical Element and to use such Technical Element only for the benefit of Customer. Notwithstanding anything contained herein to the contrary, Customer is prohibited from creating derivative works of all or any portion of a Technical Element. Confidential Information. Customer acknowledges that the following information constitutes “Confidential Information” hereunder: (a) the methods, systems, data and materials used or provided by Verizon in connection with the provision of MSS - Premises Premium; and (b) the results of Verizon’s assessment of Customer and all reports issued by Verizon in connection with such results including, without limitation, security analyses and insight (“Net Intel Information”). Customer will disclose Net Intel Information only to Customer employees with a “need to know” for the purposes set forth in this Service Attachment and who are bound to confidentiality obligations at least as restrictive as those set forth in the Agreement and this Service Attachment. In no event may Customer use lesser efforts to protect Net Intel Information from use or disclosure not permitted under the Agreement than it uses to protect its own highlysensitive confidential information, or less than reasonable efforts. The term “Confidential Information” shall not include information that is comprised of statistical information, or other aggregated information regarding security vulnerabilities, security configurations and the like insofar as such information does not identify Customer or Customer’s computer network or computer systems. Encryption Approvals in India. Encryption functionalities associated with the management service of MSS Premises Premium may only be provided to Customers that have obtained permission from the Indian Department of Telecommunications or other Indian governmental authority or officer specially designated for the purpose. Customer is solely responsible for obtaining such approvals. Customer hereby indemnifies and hold harmless Verizon, from and against any claims, suits, judgments, settlements, losses, damages, expenses (including reasonable attorneys’ fees and expenses), and costs (including allocable costs of in-house counsel) asserted against or incurred by Verizon arising out of a failure by Customer to comply with the restrictions described in this clause or as otherwise imposed by applicable laws and regulations of India pertaining to the use of encryption in India.
Verizon. All Rights Reserved.
Page 19 of 27
Verizon CONFIDENTIAL
Managed Security Services – Premises Premium +
Part V: Service Level Agreement. 1. Key Performance Indicators. This SLA defines the service metrics for which Customer has the right to receive credits ("Service Credits") in case Verizon fails to meet such metrics. In relation to a particular Serviced Device, the SLA will become effective when Verizon has issued the Ready for Operations notice. 2. Communication and Reporting Metrics. The tables below show the service metrics and Service Credits for communication from Verizon related to MSS - Premises Premium services. The Target Level ≤ X/Y in the Service Credit table means that if Verizon exceeds the target response time X time(s) out of Y instances per month then the Customer may be eligible for a Service Credit. 2.1 Availability Report Channel
Communication Phone and Email
Information Type Reference Time Response Time Contact Person
Availability Report SMC Time Stamp ≤ 15 minutes Authorized Users
2.1.1
Reporting Security Dashboard – My Reports Availability Report SMC Time Stamp Refreshed every 15 minutes Authorized Users
Availability Report Service Credits Response Time Availability Report > 15 minutes
Target Level ≤ X/Y ≤ 1/ 10
Service Credit 1
2.2 Health Report Channel
Communication Email
Type Reference Time Response Time Contact Person
Health Report SMC Time Stamp ≤ 15 minutes Authorized Users
2.2.1
Reporting Security Dashboard – My Reports Health Report SMC Time Stamp Refreshed every 15 minutes Authorized Users
Health Report Service Credits Response Time Health Report > 15 minutes
Target Level ≤ X/Y ≤ 1/ 10
Service Credit 1
2.3 Software Maintenance Security Upgrades Service Level Objective Communication Email Ready for deployment notification SMC Time Stamp ≤ 36 hours after completion of testing and evaluation Authorized Users
Channel Information Type Reference Time Response Time Contact Person
2.4 Security Incident Escalation Communication
Communication
Channel
Email
Phone Email
Information Type
Incident Report Insufficient Info
Incident Report Harmful Attack
Verizon. All Rights Reserved.
Page 20 of 27
Reporting Security and Compliance Dashboard Security and Compliance Dashboard + My Verizon CONFIDENTIAL
Managed Security Services – Premises Premium + Reference Time
SMC Time Stamp
SMC Time Stamp
Response Time
≤ 30 minutes
≤ 15 minutes
Contact Person
Authorized Users
Authorized Users
2.4.1
Reports SMC Time Stamp Refreshed every 15 minutes Authorized Users
Security Incident Escalation Service Credits Response Time Incident Report - Insufficient Info > 30 minutes, ≤ 120 minutes Incident Report - Insufficient Info > 120 minutes Incident Report - Harmful Attack > 15 minutes, ≤ 60 minutes Incident Report - Harmful Attack > 60 minutes
Target Level ≤ X/Y
Service Credit
≤ 5 / 100
1
0/month
2
≤ 1/100
1
0/month
2
2.5 Regular Change Request Regular Change Request Accepted Implementation 2.5.1
Timeframe ≤ 24 hours after request During Maintenance Window
Regular Change Request Service Credits Response Time Acceptance > 24 hours
Target Level ≤ X/Y ≤ 1/10
Service Credit 1
2.6 Fast Track Change Request Fast Track Change Request Accepted Implementation 2.6.1
Timeframe ≤ 4 hours after request ≤ 36 hours after acceptance
Fast Track Change Request Service Credits Response Time Acceptance > 4 hours Implementation > 36 hours after acceptance
Target Level ≤ X/Y ≤ 1/10
Service Credit 1
0/10
1
2.7 Urgent Change Request Urgent Change Request Accepted Implementation 2.7.1
Timeframe ≤ 2 hours after request ≤ 4 hours after acceptance
Urgent Change Request Service Credits Response Time Acceptance > 2 hours Implementation > 4 hours, ≤ 8 hours after acceptance Implementation > 8 hours after acceptance
Target Level ≤ X/Y ≤ 1/10
Service Credit 1
0/10
1
0/10
2
3. Mean-Time-to-Resolution Metric (for Monitoring and Management only). The Mean-Time-to-Resolution (“MTTR”) SLA is four hours for Severity 1 Availability, Health or Other Incident tickets where the outage is a Serviced Device hardware or software failure. 3.1 Resolution Time Calculation. Resolution time is calculated as shown below: 3.1.1 The MTTR SLA timer starts when: 3.1.1.1 For Other Incident Tickets: when the ticket is opened by Verizon or Customer. Verizon. All Rights Reserved.
Page 21 of 27
Verizon CONFIDENTIAL
Managed Security Services – Premises Premium + 3.1.1.2 For Availability/Health Incident tickets: When incident is created in SEAM (i.e. AM/HM Incident “Registration time”). For tickets with multiple Incidents, the Incident with the oldest registration time is used as the start time. 3.1.2 The MTTR SLA timer stops when: 3.1.2.1 For Other Incident tickets: When Verizon determines that the outage on the Serviced Device has stopped. The time stamp of the Serviced Device with the most recent outage stop time is the stop time for tickets containing multiple Serviced Devices. 3.1.2.2 For Availability/Health Incident tickets: When Verizon determines that the Incident on the Serviced Device has stopped. The time stamp of the Serviced Device with the most recent Incident stop time is the stop time for tickets containing multiple Serviced Devices. 3.1.3 The MTTR SLA clock will be paused when: 3.1.3.1 The ticket is On Hold as requested by Customer 3.1.3.2 Verizon awaiting feedback from Customer. 3.1.3.3 Verizon has notified the vendor or manufacturer and the vendor has provided the RMA reference number for hardware replacements. 3.1.3.4 Verizon does not manage the maintenance and support contract or has not been provided with the necessary maintenance and support credentials to invoke the maintenance and support contract on behalf of the Customer when i) Verizon has confirmed that a hardware replacement is required or ii) there is a software or configuration problem that needs to be escalated to the vendor. Customer must open a hardware replacement or software/configuration ticket with the vendor. 3.1.3.5 The SLA clock will resume once the replacement device is installed and connectivity is restored to the SMC. 3.2 MTTR Conditions. The following conditions apply: 3.2.1 The Serviced Devices must be equipped with a Verizon accessible serial console interface allowing device-level access. 3.2.2 The vendor maintenance and support agreements must provide 24x7 support for tickets. 3.2.3 Customer must provide onsite assistance if required (e.g. re-booting or verification of cables of the Serviced Device). 3.2.4 Verizon will not pause the SLA clock for software or configuration problems when Verizon is responsible for opening a support ticket with the vendor or manufacturer. 3.2.5 A MTTR SLA report is made available and reviewed with Customer in the quarterly service review by the SSA. 3.3 MTTR Service Credits. MTTR Target Level ≤ X/Y Service Credit ≤ 4 hrs N/A N/A > 4 hrs ≤ 6 hrs ≤ 1/ 10 2 > 6 hrs 0/10 3 4. Premium Plus Availability SLA. The following Premium Plus Availability SLA applies for Secured Devices under Premium Plus Service. 4.1 Availability Calculation. The Availability SLA is calculated as: (
1-
Total minutes of Serviced Device Service Outage per month
Days in month x 24 hours x 60 minutes Service Outage time does not include any Maintenance Window time. 4.2 Availability Service Credits. Customer may receive Service Credits as follows: Device Service Availability > 99.8% ≥ 99.5% and ≤ 99.8% < 99.5%
)
x 100%
Service Credit N/A 2 Device Credits 3 Device Credits
5. Service Credits Amount. 5.1 Subject to the conditions and exclusions set forth herein, Verizon will pay the applicable Service Credits as provided above. Service Credits will be calculated monthly. Service Credits are only available one month after the Service Activation Date. Verizon. All Rights Reserved.
Page 22 of 27
Verizon CONFIDENTIAL
Managed Security Services – Premises Premium + 5.2 One Service Credit equals the pro-rated charges for one day of the applicable MRC payable for the affected Serviced Device. 5.3 The Target Level ≤ X/Y means that if Verizon exceeds the target response time X time(s) out of Y instances per month then the Customer may be eligible for a Service Credit. 6. Service Credit Claims. 6.1 Customer must notify Verizon within 30 Business Days following a month where an SLA metric has not been met. No Service Credits will be issued if Verizon is not notified. 6.2 Verizon will verify any requested Service Credit, and will confirm the amount of the credit, if applicable. Verizon’s Service Credit calculation is the final and definitive assessment of any credit payable. 6.3 Service Credits will be offset against future charges. 7. Service Credit Conditions 7.1 If a number of unmet service metrics arise out of the same event, Customer will be entitled to the highest value Service Credit for one unmet metric. 7.2 The total number of Service Credits for an affected Serviced Device may not exceed 50% of the MRC. 7.3 Verizon will not pay Service Credits if the failure to meet service metrics is, directly or indirectly, due to: A failure by Customer (or an entity under Customer’s control) to comply with Customer’s obligations as described herein; The non-performance, default, error, omission, or negligence of any entity not under Verizon’s reasonable control (such as, but not limited to, failure of any of Customer’s third party providers of telecommunications services or problems with equipment Customer has provided); The performance of routine maintenance work on a Serviced Device, service equipment at Customer’s location, or on any of the equipment used to provision MSS - Premises Premium service during the applicable Maintenance Window or emergency maintenance; Tests performed or commissioned by or on behalf of Customer (e.g. Urgent Change Requests); and/or Any Force Majeure event.
Part VI: Definitions. 8x5xnext Day 24x7
Business
Business Days Business Hour
Change Request Connection Kit
Exploit
Nonstop service, 8 hours a day during Business Days. Nonstop service, 24 hours a day, 7 days a week, 365 (366) days a year, independent of time zones and local or international public holidays. Monday through Friday, from 00:00 UTC to 24:00 UTC (Universal Time Code). One hour during a Business Day. For example, a request coming in at 6:30pm London time and handled “within 4 Business Hours” is handled before 10:30pm London time. The phrase “within 24 Business Hours” means “before the same time of the next Business Day”. A request from Customer or from Verizon for a change to the SEAM policy, the Rule Set, configuration, Service Context or a Security Upgrade. Equipment installed on the Customer’s premises used to set up secured monitoring and/or management connections between the Serviced Devices and one or more Security Management Centers. A method to use a Vulnerability to gain unauthorized access to functions, data, or privileges with malicious intent. An exploit can include a script, virus, Trojan, or a worm. The exploit is mainly defined by the way it replicates and spreads. An attack is the use of an Exploit. A script refers to a document with steps to manually find and exploit vulnerabilities. A script is replicated by publishing it. A virus refers to malicious software attached to a medium (e.g., files, removable media, documents). A virus replicates using this medium. A Trojan refers to malicious software embedded in applications. The Trojan will not replicate itself; it spreads with the application. A worm refers to a self-contained program (or set of programs) that spreads copies to other computers. A worm can spread through network connections and e-mails in a matter of hours.
Verizon. All Rights Reserved.
Page 23 of 27
Verizon CONFIDENTIAL
Managed Security Services – Premises Premium + High Availability with Active/Active mode:
High Availability with Active/Passive mode: Incident Record Communication Log Transport Agent
Logs Maintenance Window
Order Confirmation Date. Other Incident Ticket
Project Manager
Refresh Rate
RFO
RFS
Risk Correlation Rule Set
A configuration of two or more devices in a load balancing setup with all the devices passing network traffic. In case of failure of one device, the other device(s) either manually or automatically takes over the device functions of the failed device. This configuration is supported on a limited basis based on specific network architectures and Serviced Devices. Verizon will review and approve, if applicable, during the pre-sales design phase. A redundant configuration of two devices with duplicate software and data not necessarily co-located where the ‘passive’ device is activated manually or automatically when the ‘active’ device fails. A record in the system that tracks and drives the workflow of Incidents during their lifecycle to closure. A Log Transport Agent is a third party software component that runs on Serviced Devices to enable the transport of the Event logs generated by the Serviced Device to the Connection Kit and to the SMC. Like any agent software, a Log Transport Agent may impact available resources to perform tasks and functions. The Customer is responsible for the implementation, maintenance and updates of the Log Transport Agents. A collection of various IT, compliance, network, application, and security related information created by Subordinate Devices. A time window agreed between the Customer and Verizon for Verizon’s performance of maintenance or management services on the Serviced Devices. During a Maintenance Window, the Serviced Devices and/or MSS - Premises Premium services may be temporarily disrupted or unavailable. Maintenance windows are limited to a maximum of 6 hours per maintenance window. Verizon will confirm Customer’s order via email and the date of this email is the “Order Confirmation Date”. The Order Confirmation will confirm the MSS service(s) requested. A ticket for service related incidents logged with Verizon and created by the Customer or Verizon. Other Incident Tickets will consume Service Tickets as outlined in this Service Attachment. A Verizon-designated person who will act as the central point of contact throughout the MSS - Premises Premium implementation process and MSS - Premises Premium staging services, if applicable. The Project Manager will be responsible for managing the schedule and will also collaborate with the Customer to develop a project plan that will specify resources, dates, times, and locations for the tasks described in the project plan. The Project Manager also is responsible for managing the change control process. The rate at which information on the Security Dashboard/Security and Compliance Dashboard is refreshed. The Refresh Rate varies dependent on the type of information and the Serviced Device to which the information relates. In general, Security and Health Incidents are updated on the Security Dashboard/Security and Compliance Dashboard at a Refresh Rate of 15 minutes. Statistics of Serviced Devices are refreshed on a daily basis. Updates to Service Requests are reflected on the Security Dashboard/Security and Compliance Dashboard as soon as changes are made to the status or comments are added, as per change management process. Ready For Operations - The date (following RFS) that Verizon sends RFO notice to Customer and informs Customer that the Serviced Device and SEAM policy have been finetuned and the escalation parameters, Service Context, and procedures have been set as mutually agreed. The SLA is effective as of this date. RFO is given per Serviced Device. Ready For Service - The date on which Verizon starts providing the MSS - Premises Premium service on a Serviced Device. The RFS may vary for each MSS - Premises Premium service Comparing data from multiple sources to find patterns and relationships that may point to attacks and abuse. Risk Correlation of Threats, Vulnerabilities and Assets. The security policy Rule Set installed on the Serviced Device or SEAM. The Rule Set may also be called “policy” when there is no confusion with corporate or other policies.
Verizon. All Rights Reserved.
Page 24 of 27
Verizon CONFIDENTIAL
Managed Security Services – Premises Premium + SEAM
Service Context
Service Ticket
Serviced Device
State and Event Analysis Machine – Proprietary Software used by Verizon to process log data and events from Serviced Devices. Its functions include: Normalization – converting entries in logs and individual alerts into generalized Events independent of the device and its brand or version. Classification – giving Events a first classification, using Verizon proprietary Event Classification Policy Language, filtering out false positives or Events related to vulnerabilities absent in the targeted environment. Pattern matching – recognizing patterns pointing to reconnaissance scans, infections, or attacks. Statistics – calculating averages to discover trends and anomalies, and to allow comparisons. Workflow management – recording the activities for an Incident. Information management – managing the information needed to examine, evaluate, and classify Incidents. User management – defining the views and authorization levels of users A set of documents with version control, posted on the Security Dashboard, containing information about the Customer that Verizon uses for the provisioning of MSS - Premises Premium to the Customer. The Service Context is setup during the service initiation phase and is maintained via the change management process. Customer can also add or update host information in the Service Context. The Service Context may include one or more of the following: Authorized User details and authorization procedure for escalation, notification, and reporting Service Description Escalation, notification, reporting, and change control processes Authorized Users Information on maintenance and support contracts Timeframe of Maintenance Windows Roles and Responsibilities in the form of a RACI Matrix for complex and/or custom solutions Network topologies and asset inventories of systems A unit for charging certain usage-based services under MSS - Premises Premium. A number of Service Tickets are included in each MSS - Premises Premium service by default for each Serviced Device per 12-month period following RFS. A ‘Serviced Device’ can be a device, appliance, software application or a system located on a security device installed on the Customer’s premises which is monitored and/or managed by Verizon’s Managed Security Services. Serviced Devices may include operating systems (“OS”) (e.g. Windows or Linux server) and active directory server. A Serviced Device can be deployed in the following configurations: • Primary: A device processing the day-to-day load. • High Availability: A redundant configuration of two devices (duplicate software and data); not necessarily co-located; activated manually or automatically when the primary device fails. Also sometimes referred to as an “Active/Passive” configuration. • Active/Active: A configuration of two devices in a load balancing setup with both devices passing network traffic. In case of failure of one device, the other device either manually or automatically takes over the device functions of the failed device. In this configuration, each device is treated as a separate Serviced Device under MSS Premises Premium, subject to a separate MRC. Note, however, that the rate for the optional Device Service Availability SLA quoted above covers both devices.
Verizon. All Rights Reserved.
Page 25 of 27
Verizon CONFIDENTIAL
Managed Security Services – Premises Premium + SSL Certificate
Security Dashboard/Security and Compliance Dashboard Security Event or Alert (“Event”) Security Incident or (“Incident”) Security Upgrade
SLA (Service Level Agreement) SMC (Security Management Center)
SMC Time Stamp
SOC (Security Operations Center) Subordinate Device
Threat
Threat Signature Unsupported Devices
UTC (Coordinated Universal Time)
A digital certificate is compliant with x.509v3, RFC 2459, RFC 3280, and RFC 3039 and includes at a minimum: A public key
The identity or unique pseudonym of the certificate subscriber who owns and holds the private key matching the listed public key
The Issuer’s identity
A start date and expiration date
A reference to the governing policy of the Issuer
Customer portal where customers can have a near real time view on the events/incidents being processed, and where they can view the company’s security posture and effectiveness of the Security Devices and services at various levels. A data record produced by the SEAM (State and Event Analysis Machine) correlation engine based on Verizon’s proprietary threat detection policies. A single Event or a series of Events that have been aggregated and correlated based on Verizon’s proprietary threat detection policies. A Security Incident may represent an attack. Changes to application software program to fix a security weakness or defect and which is generally released by the Serviced Device manufacturer as a Security Patch. A Security Upgrade includes signature or threat content updates. The agreement setting forth the specific service levels and the terms and conditions for receiving Service Credits if Verizon were to fail to meet these service levels. A data center that hosts the Managed Security Services platform and the systems for monitoring, managing, or supporting the Serviced Devices. The SMC includes: equipment to connect to the Connection Kit, management stations, hosts the virtual Local Event Collector and SEAM engines, Security and Compliance Dashboard, and back-end systems such as back-up devices, file servers, and terminal servers. A time stamp recorded by Verizon at the SMC and reported on the Security and Compliance Dashboard. The time stamps are used as the reference for measuring the Service Level Agreement. The SMC Time Stamp is recorded in UTC and synchronized worldwide using the Network Time Protocol (“NTP”). A data center where the Verizon security analysts work. A subordinate device can be a (virtual) appliance, system, software, log data, application located on Customer’s premises or its Service Provider and which integrates with the security devices but which are NOT monitored and managed under MSS - Premises Premium and by Verizon. A (suspected) use of an Exploit, or the (suspected) presence of a Vulnerability in the configuration, platform, or application code. A Threat can be an infection by a worm or virus, or it can be a targeted attack. Exploits can also be combined into Blended Threats, exploiting multiple security weaknesses or defects. Code used to recognize a Threat by its pattern. A Threat Signature may contain algorithms to detect dynamically changed malicious behavior, combat obfuscation, or impersonation. A Serviced Device that is either (i) no longer supported or maintained by its manufacturer; or (ii) an appliance, system, network, or software that is not included in Verizon’s portfolio of security products supported on the MSS - Premises Premium platform. Certain limitations and conditions with respect to the availability of MSS - Premises Premium apply for Unsupported Devices. Universal Time indication standardized by the Bureau International des Poids et Measures (BIPM) and defined in CCIR Recommendation 460-4. The UTC is the time indicated on atomic clocks. Verizon consults and uses it for its Sacs via the Internet protocol NTP. The UTC code uses the 24-hour clock. 4 pm (afternoon) is equal to 16:00 UTC. Depending on the daylight savings period, the UTC is 4 or 5 hours ahead of Eastern Standard Time (EST), and 1 or 2 hours behind Central European Time (CET).
Verizon. All Rights Reserved.
Page 26 of 27
Verizon CONFIDENTIAL
Managed Security Services – Premises Premium + Vulnerability
Workaround
A weakness or defect that can be exploited to gain access to data, functions, or privileges violating the intended authorization. Vulnerabilities can range from defects in application or system software (e.g. bugs), in the user administration (e.g. non-protected user accounts), in the configuration (e.g. unintended network or file access), in the policy and rule set definition (e.g. unrestricted open ports or exposed IP-addresses), etc. The combination of all vulnerabilities of a given system or infrastructure is the exposure. An alternative function or method, often using a temporary patch or reconfiguration, to achieve a result equivalent to the original function or method.
Verizon. All Rights Reserved.
Page 27 of 27
Verizon CONFIDENTIAL
