Acquisition with the purchase or rental of a solution of analysis and decontamination terminals for USB keys. They will combine the use of multiple antivirus engines to increase detection capacity.

These terminals must be able to be connected to the SIEM solution of the company's SOC in order to analyze and correlate the security events detected on the devices analyzed on all the sites.

The purpose of the consultation is to establish a market for the acquisition of USB support decontamination terminals. A terminal must:

1) be CSPN qualified or in the process of CSPN qualification by ANSSI;

2) be in the form of a self-service “kiosk”, other form factors may be offered;

3) benefit from a touch screen;

4) scan any type of USB media;

5) be able to retrieve its logs in a SIEM type monitoring IS (System Information and Event Management type Qradar or Splunk);

6) update automatically or manually, whether for the on-board OS as well as for the anti-virus engines and associated signature databases;

7) allow these updates to be scheduled in automatic mode;

8) produce an analysis report of a USB medium in a standard electronic format;

9) present an interface in French or English, configurable, with in particular the company logo;

10) display a progress bar for the scan of the support and allow it to be stopped (abort);

11) display a configurable screen saver when it is not in use, allowing images or videos to be viewed;

12) be able to be supervised in a minimalist way by a Whatsup or Orion type solution.

Volumetry:

The volume of terminal to be installed could be included in a range going from 50 to 200, their maintenances, subscriptions and other services must also be included.

Target:

EDF main site in Ile-de-France but also CNPEs (optional).

Final objective:

EDF wants to secure removable USB physical media used on the group's industrial sites (hydraulic sites for EDF SA, ACR for Enedis) and a few sensitive tertiary sites as well as potentially other major sites.

This type of support is very often the only way to introduce or recover data in equipment not connected to the company network.