TO:

Emirates Steel Company - Arkan

TO:

Ministry Of Community Empowerment

May 1, 2025 ECE-2025-049

Technical Proposal
SMTP Gateway Email Protection System
FOR BPM003924

EMIRATES COMPUTERS | TECHNICAL PROPOSAL

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

Document Management & Version Control

Document Title Technical Proposal – Ministry of Community Empowerment

Document Filename Technical Proposal_MOCE_28042025

Issued By Dhamotharan Ulaganathan

Issue Date 1st May 2025

Reviewed By Pre-Sales Team

Approved By Technical Manager

Date Version Author Remarks

1st May 2025 V1 Dhamotharan Ulaganathan First Draft

Contact Information

Sales Technical

Dhamotharan
Name Razan Kaddoura Name
Ulaganathan

Position Sales Manager Position Pre-Sales

Telephone 02 699 8158 Telephone 02 699 8117

Fax 02 641 3401 Fax 02 641 3401

Mobile 050 464 1530 Mobile 0506167058

e-Mail [email protected] e-Mail [email protected]

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 1

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

Table of Contents
1. Executive Summary--------------------------------------------------------------------------------------- 3
2. Why Emirates Computers ------------------------------------------------------------------------------- 4
3. Proven Track Record ------------------------------------------------------------------------------------- 1
4. Why we’re a Trusted Partner. -------------------------------------------------------------------------- 1
Covering Page -------------------------------------------------------------------------------------------------------------------------------- 2

5. Customer Requirements -------------------------------------------------------------------------------- 3

6. Proposed Solution ---------------------------------------------------------------------------------------- 3
Prerequisites ---------------------------------------------------------------------------------------------------------- 3
7. Bill Of Materials ------------------------------------------------------------------------------------------ 25
8. Scope Of Work ------------------------------------------------------------------------------------------- 25
9. Compliance Matrix -------------------------------------------------------------------------------------- 28
10. EC Support & Escalation Matrix -------------------------------------------------------------------- 39
11. Reference Sites ------------------------------------------------------------------------------------------ 41
12. Engineer Skill Matrix (System). --------------------------------------------------------------------- 42
13. Engineer Skill Matrix (Networking) ---------------------------------------------------------------- 42
14. Awards & Recognitions -------------------------------------------------------------------------------- 43
15. Annexure 1: ISO Certificate -------------------------------------------------------------------------- 43
16. Annexure 2: Engineers CV’s -------------------------------------------------------------------------- 44
17. Terms & Conditions------------------------------------------------------------------------------------- 45

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 2

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

1. Executive Summary
This proposal is the outcome of many similar projects undertaken by Emirates Computers. An in-depth
understanding of the magnitude of this project and an understanding on how to make this project a
successful venture, this gives us a significant advantage over the competition and provides us with the
necessary experience in handling any issues that mayarise.

Please find our complete response to your requirements; you will find that, technically, our proposed
solution complies with all your requirements.

In closing, Emirates Computers looks forward to a long-term partnership with the Ministry Of Community
Empowerment based on mutual respect, understanding, and good business practices that will be
rewarding for Emirates Computers.

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 3

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

2. Why Emirates Computers

Emirates Computers will provide you with the best advice and most accurate information on which
hardware best suits your needs, combined with rapid, high-quality installation and reliable IT support
service to ensure your IT system remains up and running.
Whether you’re looking for new equipment or need to upgrade existing equipment, Emirates Computers
can provide your business with the most cost-effective and reliable IT hardware and software for your
needs.

• Leading systems integrator in the UAE and the region

• Early adopters of new and complex technologies (Data Centers, IP NextGeneration Network,
Physical Security, Unified Computing System, Cyber Security, Managed Services, Cloud Technology,
and Digital Transformation…)

• ISO 14001:2015, 9001:2015, 45001:2018 based Managed Services offering inclusive of 24x7 NOCISO

• Strong understanding of CUSTOMER existing Infrastructure & Digital Transformation solution

provider for more than 10 years

• Established ITIL and ISO 20001 ITSM Certified NOC (Network OperationCentre) to provide 24 X 7
Operations and Support.

• 24/7 Helpdesk Support

• High credit ratings from international vendors and banks.

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 4

Key Value Company.
• Data Center, Network, System Solutions, IT & Cyber
Security, Managed Services, Cloud & Digital
Transformation Solutions.

• Capacity to execute similar large-scale IT projects.

Branches.
• Ability to deliver End-to-End solution including
technology, people, processes, and managed services.

• Emirates Computers/Partners Multi-disciplinary

professional services & project management.

A unique approach to executing the project in phases

Emirates.
•
where structured project management is proposed.

• Being one of the oldest ICT organizations with top

management support and commitment

Advantages Years.
• Successful realization of the project leveraging on
Emirates Computes know-how in this domain.

• Confidence about the partner’s capabilities, abilities to

execute the project and credentials in this domain.

• Local staging facilities.

• Overcome the challenges and succeed in achieving

Employee.
the sought-after strategic objectives.

• Reduce risk to ensure the most effective delivery of

this complex requirement in the least time possible.

• Information confidentiality of such strategic national

EMIRATES COMPUTERS | TECHNICAL PROPOSAL
projects.
Clients.
 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

3. Proven Track Record

Emirates Computers has a proven track record and over 42+ years of experience and expertise in
helping businesses choose and implement the right IT systems. Our partnerships, combined with
Emirates Computer’s knowledge and experience, ensure that our technical team gives you the very
best customer experience possible – prioritizing quality, customization, and cost-effectiveness.
This provides you with the optimum installation and the very best care for your business and its IT
systems.

4. Why we’re a Trusted Partner.

Emirates Computer is a multi-award-winning system Integrator in UAE for the last 42 years. We
have a fully owned UAE national company. We are strategic partners of MOI and ICA for the last
20+ years. Our Technical expertise in different products such as Huawei, DELL EMC, Cisco,
Microsoft, Citrix, Trend Micro, etc. is unique inthe market. Our team of experts will help design and
build any IT requirement for today's customer requirements.
Emirates Computers can supply the complete range of IT Solutions and services at verycompetitive
prices.

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 1

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

Covering Page

1st May 2025

MINISTRY OF COMMUNITY EMPOWERMENT,

Abu Dhabi, United Arab Emirates

Kind Attention,

Purchase Department / IT Department

Dear Sir/ Madam

Subject: SMTP Gateway Email Security Protection

Thanks for the inquiry. With reference to the above, please find attached our technical proposal with all the
required details.

We hope you will find everything as per your requirement. Should you have any queries regarding the
above please do not hesitate to contact the undersigned.
Thanking you and always assuring you of the best services and attention.

+971 504641530

+971 2 699 8158 Sincerely,

Razan Kaddoura,
[email protected]
Account Manager
www.emiratescomputers.ae

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 2

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

5. Customer Requirements
MOCE is seeking to purchase SMTP Gateway (Email Security Solution) Ensuring Comprehensive
Protection for Our Email Infrastructure.

The solution should offer advanced email security features, including but not limited to spam
filtering, malware detection, phishing protection, and email encryption. The solution must be
scalable, reliable, and able to integrate with our existing infrastructure.

The Ministry of Community Empowerment (MOCE) requires the supply, installation, configuration,
and support of a comprehensive Email Security Solution that ensures the protection, continuity, and
compliance of its email infrastructure for over 900 mailboxes.

6. Proposed Solution
Based on the customer requirement, the Emirates Computers team carefully considered all the
requirements and proposed the below best-fit solution (Technically and commercially), Below is
the summary of the proposed solution, followed by the detailed product specification.

Sno Product Details Description

Proofpoint Core Email Protection - V, Provides inbound

1 PFPT-B-P0M-V-A email protection
against threats that target organizations. - Virtual

2 PP-SUP-PS Platinum Level Support

PFPT EFD Commercial Basic (up to 1 sending domain)

3 PFPT-M-EFDBC-S-A
12 Months

Prerequisites
Email Gateway On-Premises Deployment:

Virtual Machine Requirements:

If the deployment method is a physical appliance, this section can be ignored.
The following are the minimum requirements for the virtual deployment:

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 3

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

Specification Minimum Requirement

VMWare Version ESXi 6.0

Disk Space 250GB
RAM Memory 12GB
CPU 2 CPUs

Network Setup:
The following are required network setup configurations:

Specification Minimum Requirement

VMWare Version ESXi 6.0

Disk Space 250GB
RAM Memory 12GB
CPU 2 CPUs

Ports:
The following are required network ports to be accessible:
Port Source Destination Explanation
Existing
Solution Proofpoint Server
Mail Server Required to send and
25 (SMTP)
receive emails
Proofpoint Mail Server
Sever Existing Solution
Proofpoint Required for license
443 (HTTPS) Internet
Sever activation and updates
Proofpoint Internet or Internal DNS
53 (DNS) Required for DNS
Server Server
Internal
22 (SSH) Required for
Network Proofpoint Server
management
10000 (HTTPS) (Administrator)

Threat Protection Suite Overview

The P0 bundle includes these components:

• Filtering modules - the Spam Detection, Virus Protection, and Email Firewall Modules filter
SMTP messages for envelope criteria, connection criteria, virus infections, spam, and
message content.

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 4

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

• The Targeted Attack Protection (TAP) Module consists of URL Rewrite, Message Defense,
and the Dashboard. This module protects your organization from malicious email attacks
and provides additional visibility into phishing and spear phishing.
• The Threat Response Auto-Pull (TRAP) server - responsible to remove threats from the
mailboxes of the end users.

Spam Detection

The Proofpoint Protection Server includes Proofpoint's proprietary MLX technology, the latest
Machine Learning system developed by scientists at the Proofpoint Anti-spam Laboratory.

Proofpoint laboratory scientists and engineers analyze a dynamic corpus of millions of spam
messages that represent the universe of spam messages entering corporate email environments.
Using sophisticated tools and experience, they distill hundreds of thousands of spam and non-
spam attributes. This method anticipates future spam attacks by exposing the underlying
characteristics of current spam attacks, as well as identifying emerging techniques.

The characteristics are fed into sophisticated classifiers, such as Bayesian and Logistical
Regression classifiers that output a set of balanced weights for those attributes. The weights are
a statistical representation of how likely each attribute indicates spam during the final message
classification process. This information - classifiers, attributes, and weights - which concisely
represent Internet spam, is then packaged in the form of Proofpoint's MLX Engine and
automatically delivered to Proofpoint customers. Laboratory scientists are constantly updating
the MLX Engine by discovering new spam attributes, optimizing weights to fit the changing nature
of Internet email, and exploring new classifier methodologies.

At each deployed Proofpoint Protection Server, local processing by the MLX Engine detects
occurrences of the previously distilled spam attributes in each message - from the IP layer,
through the envelope and header layers, and into the message body. The MLX Engine then utilizes
the message's detected attributes and the appropriate classifiers to calculate the probability that
the message is spam. This final probability, or spam score, ranges from 0 to 100 (0 signifying that
the email is valid, 100 signifying that the email is spam). Based on an enterprise custom-built
policy, the score determines what final category applies to each message and what actions to
take based on that categorization. For example, messages that score above 80 are discarded,
messages that score above 50 are quarantined, and messages with score greater than or equal
to zero are delivered to the intended recipient.

The Spam Detection Module:

• Examines every aspect of incoming email - the sender's IP address, the message
envelope, headers, structure, and the message content and formatting.
• Applies thousands of tests to determine the likelihood that a message is spam and
enables messages to be uniquely processed depending on the results.
• Applies Proofpoint's frequent updates to the MLX Engine, either automatically or manually
by the administrator.

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 5

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

Using the spam attributes generated by all of these tests, the MLX Engine calculates a spam score
and determines the final disposition for the email. On its own, no single rule classifies a message
as spam - each rule contributes to the spam score according to a predefined weight. To optimize
spam detection for your environment, you can fine-tune the weights assigned to some of the tests
or disable certain tests.

The Spam Detection Module uses policies and rules to filter and classify messages for containing
spam. The Module applies a comprehensive set of rules to each message to determine a spam
score for the message. It includes a default spam classification policy named Organizational
Spam Policy that includes rules that administrators can change or expand with additional rules.

Administrators can create unique policies and rules to handle messages that contain spam and
apply them to different Sub-Orgs or Groups in an Organization. Spam policies are configured as a
Filtering attribute for the Organization, for Sub-Orgs, Groups, or individual Users. See About
Attributes and Filtering Attributes for more information.

The rules of the Spam Detection Module rules detect and are not limited to the following:

• Malware
• Impostor (BEC)
• Phish
• Adult
• Spam
• Bulk

Business Email Compromise (BEC) Protection

Our integrated platform uses Advanced BEC Defense, which is powered by our latest artificial
intelligence (AI)-driven BEC detection engine, Supernova. This cutting-edge technology has
resulted in an increase of 17 times more threats identified, expanding our detection to a wide
variety of email fraud attacks.

Advanced BEC Defense conducts in-depth analysis on various message attributes, including:

• Message header data

• Sender’s IP address
• Sender or recipient relationship
• Sender reputation

Advanced BEC Defense uses large-language module-based semantic analysis to analyze

message bodies for sentiment and language. This helps to determine whether a message is a
BEC threat. The behavioral machine learning engine tracks activity to extract behavioral tells, or
signatures of threats, in order to understand patterns that it will then use to detect anomalies in
real-time.

Some of the elements that it tracks include:

• Whether a sender is sending an unusual number of emails

• Whether emails are coming from an unusual IP address

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 6

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

• Whether a sender has ever been seen by the users of the company

These signals strengthen the detection stack and enable new use cases. As a result, the detection
engine now catches other advanced email threats, like ransomware, credential phishing and
compromised third-party accounts.

Advanced BEC Defense detects display-name spoofing and lookalike domains. It even blocks the
most sophisticated supplier fraud attacks by dynamically analyzing messages for tactics
associated with supplier invoicing fraud. It uses machine-learning to adjust and learn in real time
and aims for low false-positive rates.

Virus Protection

Antivirus protection is a key component of the Proofpoint Protection Server. The Proofpoint
Protection Server provides this functionality by integrating optional antivirus engines from
several leading antivirus vendors.

The virus engine uses a number of virus signatures or identity files that identify specific known
viruses, as well as a heuristic engine to detect previously unknown strains.

The virus engine exists as either McAfee or F-Secure.

Email Firewall

The Email Firewall Module provides the following methods to control, filter, and manage email
traffic in your organization:

• Filters messages by connection and message attributes and applies rules for disposition
of these messages.
• Uses trusted and blocked lists to apply an authoritative disposition to messages from
senders on these lists without further processing by the Proofpoint Protection Server.
• Uses dictionaries to filter messages for content and apply rules for disposition of these
messages.
• Provides an SMTP Rate Control feature to restrict email traffic per IP address.

The Email Firewall Module filters messages by both connection and message attributes. The
connection and message attributes are contained in the envelope information and are analyzed
by the Email Firewall Module as soon as the message is passed from sendmail to the Proofpoint
Protection Server through the Milter interface.

Many organizations today are concerned with the potential liabilities caused by transmitting email
with inappropriate content through their messaging systems. You can create dictionaries
containing inappropriate words with associated weights that correspond to determining whether
or not the message is inappropriate. You can then create rules with dispositions based on the
score of the message. The Email Firewall already includes an Offensive Language dictionary, and
you can also obtain other preconfigured dictionaries from Proofpoint Support or Professional
Services.

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 7

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

The Email Firewall Module enforces email flow policies by shaping SMTP traffic dynamically in
real time. The Proofpoint Protection Server MLX Dynamic Reputation technology is integrated into
the Email Firewall - it constantly inspects SMTP connections at the IP address level, monitoring
the number of connections and analyzing the content of the messages. The MLX Dynamic
Reputation engine assigns a reputation score to each IP address based upon observed behaviors.
Based on the scores, the SMTP Rate Control feature of the Email Firewall Module takes corrective
action according to the defined policies. For example, if 75 percent of the messages sent from a
specific IP address over a specified time period contain spam, the Proofpoint Protection Server
applies a policy to refuse or restrict messages from that specific IP address.

The SMTP Rate Control traffic shaping policies improve the network bandwidth utilization for your
organization, reduce the overhead for sending messages to the Quarantine, and reduce server
storage requirements as well as CPU resources.

Dynamic Reputation

Proofpoint Dynamic Reputation is a connection management and email reputation service that
uses Proofpoint NetMLX machine-learning technology to block incoming connections from
malicious IP addresses. The system provides enterprises with an accurate first line of defense
against spam, directory harvest attacks, denial of service attacks, snowshoe spamming, and
other email-borne threats while delivering substantial bandwidth savings.

The Proofpoint Attack Response Center collects information for millions of IP addresses using
data from Proofpoint honeypots, customer sites, and other sources. Proofpoint NetMLX machine-
learning algorithms continually parse hundreds of data points for all IP addresses in real-time to
generate extremely timely, accurate network reputation scores.

Proofpoint NetMLX creates the industry's most accurate and up-to-date database of reputation
for IP addresses sending email across the Internet, allowing each customer site to benefit from
the network effect provided by Proofpoint's real-time, machine-learning analysis of world-wide
sender behavior. Each minute hundreds of data points for all IP addresses are parsed with
advanced machine-learning algorithms to generate a score that represents the sender's
reputation, whether positive or negative. Proofpoint Dynamic Reputation uses these scores
combined with local behavioral data to make intelligent decisions about accepting, throttling, or
rejecting incoming email connections.

Smart Search

The Proofpoint Smart Search module allows administrators to trace and analyze information
about messages once they have been processed by the Proofpoint Messaging Security Gateway
(appliance).

Administrators can quickly trace what happened to messages to solve email delivery problems
and analyze overall email infrastructure behavior. Detailed information about a message once it
has been processed provides administrators with the ability to quickly answer email transaction
questions from the business email community, help desk, and customer support staff.

Targeted Attack Protection (TAP)

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 8

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

The Targeted Attack Protection Module consists of URL Rewrite, Message Defense, and the
Dashboard. The module protects your organization from phishing, spear phishing, and other
malicious attacks.

URL Rewrite

When you enable URL Rewrite, URLs in a message may be rewritten and directed to Proofpoint's
cloud-based service for reputation analysis.

URL Rewrite rewrites the URL and redirects the URL to Proofpoint's Cloud service when a user
clicks a URL in an email message. If the URL is not known to be malicious, the user will be
redirected to the original URL. Once redirected, the URL Rewrite service is no longer in the traffic
flow between the user and the web site. If the URL is malicious, the user will see a warning
message and the site is blocked in the browser. This protects other users from clicking the
malicious URL. However, if the first victim clicks a malicious URL before its reputation is known,
administrators can mitigate the situation using the Targeted Attack Protection Dashboard.

Message Defense

Message Defense protects your organization from being infected with malware by temporarily
delaying messages that contain attachments or URLs with unknown reputations.

Message Defense uploads unknown attachments to the Proofpoint Attachment Scorer service to
the cloud sandboxing environment of Proofpoint.

After scan results are returned, if all attachments are known to be clean, the message and its
attachments continue through the filtering engines and if no other rules are triggered, the
message is delivered to the email infrastructure. If any attachment has a malicious reputation,
the message is quarantined.

Targeted Attack Protection Dashboard (TAP Dashboard)

The Dashboard alerts administrators of email attacks and provides the detail they need to search
for targeted attack information, triage to reduce potential damage, submit feedback to Proofpoint,
and create detailed reports for security and executive personnel.

It provides very detailed SoC reporting including the Very Attacked People (VAP) report.

Threat Response Auto-Pull (TRAP)

When malicious email is detected, detecting systems send an alert to Threat Response with
information about the message. Threat Response then goes into Exchange, O365, or Gmail to
move the message into quarantine. Auto-Pull will also then look for forwarded copies of the
message in other mailboxes on the same server and move those to quarantine as well.

Once TRAP has received the security alert it will take the following actions:

• TRAP will collect the alerts, normalize the information, and prioritize the alerts by
assigning a threat score and grouping similar messages by recipient and known
malware campaigns.

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 9

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

• TRAP will take the IP/Host names, URLs and MD5 hashes that are sent in a forensics
report from the alert sources, search reputation and intelligence repositories and identify
if any of these repositories contain related threat intelligence information.
• TRAP can connect to Active Directory via an LDAP call and collect information about the
user associated with the email address. The LDAP attributes that are collected provide
insight into who’s being targeted/impacted by email attacks.
• TRAP will relocate the identified message(s) from the recipients and place them in a
quarantine mailbox where they can be reviewed and examined but where the end user
can’t access them.
• Once the message is located TRAP can identify if the message was forwarded to
someone else. If it was, then TRAP can search associated mailboxes for the forwarded
messages. If those messages are located, they will be quarantined as well. TRAP will
continue to take these tracking actions until all copies within the environment have been
quarantined.

PROOFPOINT EFD (DMARC)

Executive Summary

Proofpoint’s Email Fraud Defence (EFD) is the only proactively managed authentication solution
that can assist Customer in not just identifying and authenticating its third-party senders
across the consumer and enterprise, but goes beyond DMARC capabilities to address the
multiple tactics bad actors use to impersonate a brand/domain/employee/business partner.
EFD prevents Business Email Compromise (BEC) attacks by helping Customer identify who is
sending emails using Customer domains, ensuring all valid senders are properly authenticated,
and blocking the rest. EFD will also provide visibility into who is sending you email and how they
are authenticating. This helps protect your customers, trusted partners, and your own users
from identity deception.
Addressing Customer requirements for enhancing and expanding the current DMARC position in
order to achieve a strong email authentication posture requires several phases, and must
address the multiple tactics used to create identity deception. Having the data and experience
in supporting such an initiative is critical. Proofpoint has helped thousands of enterprises on
their DMARC journeys, securing more domains than our competitors combined. In the Fortune
1000 alone Proofpoint has secured more enterprises in the last 3 years (295) than all our
competitors combined (184). Our methodology is proven, our technical advantages validated,
and the roadmap has been aligned to delivering the greatest value beyond DMARC. One thing
we hear from every CISO is the fact they are looking to minimize the number of point solutions,
lower their OpEx and look for a platform to leverage from a trusted partner. Very direct reasons
why our customers choose EFD are publicly available stats that speak to our strength with this
solution:
• Our nearest competitor has ~135,000 domains with their DMARC records in DNS, we
have ~420,000, which means that we have almost three times the reporting surface for
the free-to-air reporting from the ISPs and Gmail.
• We have ~220,000 domains at p=reject, almost 100,000 more than our nearest
competitor has in total at all p=values.

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 10

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

• Our nearest competitor is present in the records of 11% of the Fortune 1,000, whereas
we are in 29%
Through this document we will highlight many of the key differentiators between our EFD
solution and other DMARC vendors, but one of the biggest and most relevant is the breadth of
data we have access to, and therefore provide to Customer. Anyone can publish a record to DNS
and receive feedback reports from webmail providers, but only Proofpoint can also provide data
about messages sent to business gateways and non-DMARC compliant ISPs. This is because of
the global scale of our email gateway business, and relationships cultivated or acquired. This
additional visibility allows you to go beyond solving consumer-based spoofing; It provides the
visibility to solve B2B & supplier spoofing as well.

For Customer, the solution proposed in this document is more than just a reporting tool. An EFD
project comes with an assigned Professional Services consultant to assist the organisation with
interpreting the results and will provide actionable instructions. The consultant is vital for a
successful deployment as DMARC is nuanced and interpreting the data can be difficult. The
sheer volume of data that is generated can be overwhelming and many projects never reach
completion because the resulting lack of confidence that all DMARC issues have been correctly
addressed often means that they never reach Reject status. Having an expert that can do the
triage, heavy lifting with interpreting the data and guiding you through your DMARC project leads
to the fastest and safest method of reaching Reject status.

Email Fraud Defence protects your organization from all phishing and impostor attacks that
spoof your domains. Visibility into who is sending email on your behalf allows you to authorize
all legitimate senders and block fraudulent emails before they reach your employees, business
partners, and customers. EFD gives you visibility across your email ecosystem by not only
analysing and interpreting DMARC reports, but also enriching them with robust message
samples. Understand who is sending email on your behalf with a full view into the email traffic
coming into and going out of your organization.

Key capabilities include:

• Protecting Customer domains with “reject” policies
• Monitoring of all emails sent using Customer domains (whether they’re sent from you or
by third parties)
• Recipients can authenticate valid email is from authorised senders
• Distinguish between legitimate emails and bad emails failing authentication
• Workflow instructions for specific authentication policies

It enables IT teams to:

• Understand the authentication posture of your third-party email senders
• Distinguish between legitimate emails and bad emails failing authentication
• Know the reasons behind – and how to fix – each authentication failure

In addition, when you deploy Email Fraud Defence with other Proofpoint solutions, you can
nullify an entire class of impostor email fraud:

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 11

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

• Prevent CEO/CFO wire transfer attacks and payroll attacks

• Block emails spoofing corporate and brand identities before they reach your employees
and customers
• Stop email-based ransomware

Solution Overview

Proofpoint’s Email Fraud Defence is a cloud-based solution that makes it easy to implement email
authentication to protect your employees, partners and customers from email fraud. As a domain
owner, EFD receives DMARC reports on a customers behalf and layers on intelligence that quickly
identifies authentication issues among legitimate email, offers troubleshooting advice, and
recommends when blocking policies can safely be declared in DNS. As an email receiver, EFD can
also provide the visibility necessary for you to confidently enforce DMARC on your inbound email,
without the risk of blocking legitimate messages.

Customer run a complex supply chain and has numerous partner relationships. This requires a
significant focus on not just identifying third-party senders for Marketing purposes but also
Business to Business (B2B) third-party sender relationships. Thus, in looking to determine those
legitimate third-party organisations that may send on your behalf, most organisations are blind
to the full extent of the emails in circulation in their name. Thinking that they have captured all
emails because of the observed data in the free-to-air ISP generated RUA reports, they move to
p=reject too soon, and then later find that their DMARC deployment has interfered with their
business.

Proofpoint owns numerous data sources from the use of their Secure Email Gateway, in addition
to acquisitions and industry cooperation’s adding to a broad range of proprietary data sources
used in assessing the origin of emails. These, along with the two RUA/RUF publicly available
data sets, are combined to provide a comprehensive and accurate diagnosis of email
authentication.

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 12

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

As can be seen from the table above, data sources 1-7 are only available with EFD. Other
solutions on the market will be ingesting data from sources 8-9 and presenting them in a way
that Customer would be fully able to do themselves, should they wish too, however a DMARC
solution that relied solely on publicly available data will not give full visibility in to critical B2B
authentication data.

As the Email Fraud Defence team was a founding member of the DMARC.org, and has been
helping clients implement email authentication practices five years before DMARC was a public
standard, we are well versed in the analysis of DMARC/email authentication data, the
implementation of SPF/DKIM/DMARC, identifying and accounting for false positives, dealing
with change management windows, and understanding possible paths forward when dealing
with exceptions.
The EFD solution compromises:
• Access to a web-based application over standard and secure communication channels:
• Monitor email activity from your domains and subdomains, including non-sending
and defensively registered domains.
• Save time diagnosing, prioritizing, and fixing authentication issues related to your
domains.
• View email activity using your domains received by consumer mailbox providers,
business gateways and your own gateway.
• Block malicious emails leveraging your domains from reaching your customer’s and
partner’s inboxes.
• Understand which receivers are honouring your DMARC policies and which aren’t.
• Identify, authorize, and log legitimate IP addresses and forwarders sending mail on
your behalf.
• Gain visibility into server configuration problems.
• Investigate headers and Uniform Resource Identifier (URI) information to identify
suspicious activity impacting your brand.
• Receive real-time alerts concerning issues about phishing, spoofing, and blocked
legitimate messages.

A dedicated Professional Services consultant – our experienced team helps you reduce the risk
of blocking legitimate mail by providing:
• Continuous monitoring to optimize your DMARC implementation
• A dedicated extension of your team to help you identify legitimate email streams
• Ongoing support as your business email practices evolve
Domain Discover - Lack of visibility into your domains/subdomains (brand and defensive
registrations) as well as lookalike domains increases your threat landscape. This functionality
will:
• Continually scan over 400 million domains for threats
• Automatically classify domains and identify the most urgent threats
• Provide full lookalike domain detection
• Provide detailed intel around registrant info, email traffic, web content
• Support domain takedown and gateway blocking of offending domains
• Support virtual takedown for faster/easier remediation

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 13

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

Hosted SPF - Incorrect or misconfigured SPF records are a major source of authentication
failures and maintaining accurate records can be a time-consuming process so Hosted SPF will:
• Manage customer SPF records for accuracy and efficacy
• Ensure third-party sending IPs are continually updated to maintain authentication
• Enable customers to permit/de-permit senders in real-time through the EFD portal
• Take the time and guesswork out of maintaining the SPF record
BIMI - Lack of confidence in sender validity and risk of display-name spoofing reduces the
likelihood of email opens/clicks, lowering the value of email marketing. BIMI support will:
• Insert a corporate logo within the display picture of all authenticated emails
• Provide a visual check for valid emails – protecting the company and its consumers
• Help prevent a variety of consumer-based fraud
Go beyond a standard DMARC implementation by gaining visibility into your supplier risk. The
Nexus Supplier Risk Explorer feature will:
• Automatically identify suppliers from email traffic
• Assess level of risk your suppliers pose to your organization
• Reveal lookalikes of your suppliers’ domain
• Validate suppliers’ DMARC record
• Reveal the message volume and the messages delivered from the lookalikes of your
suppliers’ domain
• Prioritise each supplier’s domain’s risk level and help you focus on the most critical
incidents

How Proofpoint EFD solution works from a Security Domain

EFD is provided as Software as a Service (Saas) using Amazon Web Services, along with
consulting services to implement the solution. Proofpoint has implemented several security
controls to ensure the protection and privacy of consumer Personal Data and to prevent
inadvertent access, exposure or theft of Personal Data and client data.
As part of the proposed solution Customer would gain access to:
• A platform that uses HTTPS for access and TLS 1.2 for all external communications.
Data is encrypted with AES-256 in the database. All passwords are hashed with salt.
• A simple, browser-accessible user interface and API with nothing for customers to
install, therefore there is no requirements for any local installations or maintenance of
any hardware or software by Customer.
• A GUI that support role-based access controls for delegation that does not introduce risk
of unauthorised changes taking place. The roles are:
o Admins will have complete control of configuring the account with Domains, IPs,
Creating Users, and Updating policy for a domain
o Read-only access will be able to access all data, and export data. However, the
user will not be able to make changes to domains, add IP addresses, or create
end-user access
• Multifactor authentication can be implemented for end-users to access the portal.
Proofpoint supports both a physical YubiKey OTP method and using a mobile app,
Google Authenticator
• IP Based Access Restriction is also available so GUI access can be restricted to the
addresses provided by Customer

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 14

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

• The same GUI will be used to manage the solution for all domains, so information is
reusable, and duplication made obvious
• The underpinning technology powering the system is API based so fully scalable and
flexible, and can be imported in to Customer’s own tools should it be required.

Proofpoint is committed to protecting the confidentiality, integrity and availability of information

provided by and to its clients. We ensure the protection of consumer Personally Identifiable
Information (PII). All PII from forensic data is redacted and encrypted and appropriate access
control measures are in place. Proofpoint complies with all applicable data protection and
privacy laws. As a data processor, Proofpoint is committed to complying with GDPR
requirements. Our full GDPR statement can be found here:
https://www.proofpoint.com/sites/default/files/pfpt-us-legal-gdpr-efd-180112.pdf

Proofpoint supports Transport Layer Security (TLS); all transmissions of data to Proofpoint’s
infrastructure can be encrypted through the TLS protocol. DMARC reports are sent to us in
whatever state the mailbox provider deems appropriate, but should they decide to send data in
encrypted format, we can support that. Once we receive DMARC data from the mailbox provider,
all data in transit within Proofpoint’s infrastructure is encrypted. Email Fraud Defence
infrastructure is deployed in AWS, all data stored in the cloud is encrypted at rest and only
Proofpoint has access to the key.

EFD Deliverables

Once your DMARC record is in place, participating mailbox providers will send daily aggregate
reports to the destination you defined in the RUA tag. DMARC aggregate reports provide
information about which emails are authenticating against SPF (Sender Policy Framework),
DKIM (DomainKeys Identified Mail) and DMARC, and which are not. This data is provided in
XML format and shows each message sent from a domain, such asCustomer.co.uk, to the
mailbox provider, for example gmail.com. The aggregate report also shows each message
source IP and if this was authenticated against the published SPF record, and whether the DKIM
check passed or failed. While aggregate reports do not provide much information about the
email messages themselves, they can provide valuable visibility into the health of your email
program by helping you identify potential authentication issues and/or malicious activity.

The other DMARC record placed in DNS requests participating mailbox providers to send
forensic reports to the destination you defined in the RUF tag. These reports are sent in real
time, and in addition to providing information about which emails are authenticating against
SPF, DKIM, and DMARC (as aggregate reports do), forensic reports include additional
information such as the subject line and header information as well as, most importantly any
URLs (URIs) included in the message.

It is worth noting that forensic reports are not generated by all DMARC compliant gateways and
as such account for a very small amount of DMARC traffic. Our portal makes the data available
for additional threat context, but also does a large amount of data augmentation via the other
threat intelligence sources that we operate which goes way beyond what the other standalone
DMARC portals can achieve. This additional data can provide the insight required to
differentiate a legitimate versus illegitimate email.

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 15

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

See attached “What is DMARC data.pdf” for more information on what the forensic and
aggregate reports contain and how they will be used as part of the project.

With the data feeds above, and our unique proprietary feeds, the EFD portal will begin to
populate with actionable data. Empowered with visibility in to the use of 21 Customer domains,
the dedicated Professional Services consultant will be able to audit the health of your domains
to identify which of your mail streams are not authenticating properly, help you understand your
email program’s current level of risk, and offer best practices for improving authentication or
defeating phishing and spoofing. This allows Customer to more confidently deliver and execute
a detailed documented project plan to harden SPF, DKIM and DMARC policies for all 21 email
domains detailed in the WO.

The project plan will provide steps to publish SPF, DKIM and DMARC records to DNS, first in
data gathering (monitoring) mode, to migrate through DMARC quarantine to ultimately
implement DMARC reject mode. This transition will be documented and approved as per
Customer governance and change management processes to reduce the risk of any legitimate
messages being blocked. The project plan will define resource allocation and expected tasks to
be completed between sessions to ensure tasks are managed, and milestones are reached on
time. The process to add new domains to the portal for DMARC visibility, monitoring and
management is straightforward and well documented within our help pages, however the
consultant will train Customer colleagues in the process during interactive sessions. They will
also be able to provide RFC and industry documentation to train Customer colleagues in
management of DNS records for authenticating email (SPF, DKIM and DMARC), within
Customer’s own DNS and external third-party as required.

The management interface provides real-time visibility in to use of Customer domains in

legitimate and malicious email traffic. Several dashboard views are available, for example:

1. Domain by domain SPF, DKIM and DMARC pass rates and alignments:

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 16

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

2. Permitted (known/trusted) sender by SPF, DKIM and DMARC pass rates and alignment:

3. Global authentication results:

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 17

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

4. DMARC pass/abuse rates:

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 18

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

5. Progress tracking over time:

6. Policy progress over time:

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 19

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

7. Sender geographical location:

8. Lookalike domains registered globally (Domain Discover):

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 20

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

9. Supplier Risk Explorer:

The system is tuned to group senders in to known services (such as Salesforce) to easily
identify known trusted senders:

The grouping can be split to show mail flow and authentication stats on individual IPs owned by
the vendor:

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 21

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

And a who is link will provide additional DNS registry information such as domain owner:

Once mail from these services has been authenticated it will move from an unauthorised to
authorised section within the portal to provide a deeper view on authentication trends:

Should the need arise to migrate DMARC or email gateway data the consultant will be able to
provide documentation and instructions to reduce mail flow risk.
All data in the dashboards and portal is available through a REST API for integration in to
Customer systems, such as SIEM, for reporting visibility and alerting Customer governance and

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 22

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

SOC teams. For reference, API documentation including the data fields available, can be found
here: https://data.emaildefense.proofpoint.com/docs/index.html
Email alerts can also be configured in the portal to flag changes such as:

• DMARC and SPF record updates, errors or warnings

• Lookalike domain registrations
• Traffic anomalies

The EFD portal also includes Domain Discover, which automatically identifies lookalikes of your
domains (figure 8 above). Proofpoint dynamically detect newly registered domains posing as
your brand in email attacks or by phishing websites, by analysing millions of domains and
connect registration data with our own data on email activity and active attacks. Customer can
receive instant alerts when suspicious domains move from parked to a live, weaponized state.
This module also includes the Virtual Takedown service, you can quickly reduce consumer,
business partner and employee exposure to malicious lookalike domains. And you can pursue
removal of the domain with the registrar or hosting provider.

The Virtual Takedown process is as follows:

1. Customer submits a domain for virtual takedown within Domain Discover.
2. Proofpoint reviews submission and checks for sufficient evidence.
3. If vetted, Proofpoint submits domains to appropriate blocklist(s) within minutes of review.
Note that domains will only be sent to relevant blocklists as not all blocklists are focused
on the same threats.
4. Blocklists evaluate the domain submission and accept or reject it.
5. If accepted, domain is added to the blocklist and the blocklist update will be propagated
out to the blocklist's clients.

For the duration of the project, the Proofpoint Professional Services consultant will:

• Assist Customer in creating and documenting new processes that can be

embedded within existing Customer internal processes for ongoing management
of email authentication
• Update Customer colleagues on email authentication failures and provide
remediation steps to properly authenticate legitimate senders. The experienced
consultant will have extensive knowledge and be able to provide use cases and
playbooks from previous projects to remediate issues quickly.
• Provide on the job training to Customer colleagues in successful understanding
and management of the solution
• Host weekly (or as-desired) calls with your stakeholders with detailed agenda,
status updates and project plans.
• Provide assistance in adding domains for monitoring and claim IPs within the
portal.
• Provide an authentication Scorecard: detailed personalized review of
authentication data, identifying authentication gaps, points of remediation, and
recommended best practices.

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 23

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

• Provide a comprehensive DMARC policy risk assessment completed per domain,

highlighting domains ready to enforce DMARC ‘reject’ policy, and the potential
impact on legitimate mail traffic.
• Set up Email Governance & Email Threat Intelligence alerts based on your
preferences.
• Build your SPF record according to SPF best practices, i.e. number of NS
lookups, character limitation, avoid PTR records, etc.) Your PS consultant will
ensure the exactness and accuracy of your SPF record. Proofpoint also offers an
extensive SPF troubleshooting tool.
• Guide you through the DKIM signing implementation process and provide best
practices in regard to key pair creation, CNAMEing, key length, etc. You can track
DKIM implementation status directly within the Email Fraud Defence (EFD) portal
where any issues are flagged at the domain-level and broken down by sending IP.
• Advise with configuring SPF & DKIM policies to comply with DMARC
configuration.
• Advise with creation of quarantine folders & policy routes on your Email gateway
to monitor inbound domains with DMARC policy violations.
• Advise with configuration of audit mode DMARC policies to gain visibility from
the quarantined items.
• Advise on enforcement of DMARC rules for customer owned domains.
• Continuous monitoring ensuring malicious phishing emails are always blocked
and that legitimate emails remain unaffected by a ‘reject’ policy.
• Troubleshoot failed authentication issues coming from your domains.

On top of this and at all times, further resources are available to Customer colleagues:

The EFD Help Centre is available in the upper right-hand corner of the Main EFD UI Screen. This
includes:

• A Getting Started Guide

• Implementation Checklist
• Glossary of Terms
• Several 2-5 minute How-to videos for navigating the Portal are available.

Web-based training. This training is recommended for project team members prior to the start
of the engagement. The course is broken into 6 chapters that can be taken in any order and
includes:

• Overview of email fraud threat types

• SPF, DKIM & DMARC email authentication protocols
• Engagement Onboarding Process
• Overview of Email Fraud Defence UI and functionality

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 24

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

7. Bill Of Materials
Sno Product Details Qty
PFPT-B-P0M-V-A
Proofpoint Core Email Protection - V, Provides inbound
email protection
1 against threats that target organizations. - Virtual 900
PP-SUP-PS
2 Platinum Level Support 1

PFPT-M-EFDBC-S-A
PFPT EFD Commercial Basic (up to 1 sending domain)
3 12 Months 900

Onetime Professional Services

Part Unit
No. Description Qty.
Number Qty.
ECE Professional Services, Implementation / Configuration, UAT, Sign
1 ECE_PS 1 1
Off , Knowledge Transfer & Documentation.

8. Scope Of Work
In connection with this Scope of Work, Emirates Computers will perform the Services as
specifically described below.

Emirates Computers will comply with the RFP terms mentioned in the Scope of Work Section.

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 25

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

Project Kickoff

• Facilitate project kick-off, planning and status meetings.

• Meet with the customer to ensure that the environment and operational implementation
requirements (hardware, software, and infrastructure) are met by the customer, and
provide the customer with a list of required or beneficial updates.
• Plan and estimate a schedule for the installation and configuration tasks for the service
as needed.
• Determine and review required staffing levels with the customer.
• Confirm pre-engagement requirements are met.

Project Design

• Review and validate high-level requirements and planned use of features and functions.
• Provide input into the customer’s project plan as needed.
• Review change control requirements.

Solution Supply

• Provide Proofpoint Core Email Protection (Virtual Appliance) for 900 mailboxes.
• Provide Proofpoint Email Fraud Defense Basic (up to 1 domain).
• 12 months of licensing and Platinum Support (24x7x365).

Installation and Configuration

• Install and configure Proofpoint Core Email Protection Virtual Appliance on MOCE’s on-
premises infrastructure.
• Configure Proofpoint EFD for domain protection and DMARC enforcement.
• Validate the security of emails based on the MX validation with Proofpoint services.
• Ensure DMARC is working as expected.
• Enable SFP validation based on the Proofpoint solution.
• UAT and fine-tuning based on the available Proofpoint licenses.

Assist the customer with the configuration of product features included with Proofpoint
Protection:

• Review Network and System Settings.

• Email Firewall, End User Services, Spam Detection, Virus Protection, and User Imports.
• Assist the customer with the configuration of mail routing.
• Assist with the configuration of user imports via LDAP/LDAPS or Hosted File Transfer.

Assist with configuration of purchased product modules included with Proofpoint Targeted
Attack Protection:

• Deploy TAP Attachment Defense.

• Deploy TAP URL Defense.
• Review TAP (Targeted Attack Protection) Dashboard.

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 26

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

Assist the customer with the configuration of product features included with Proofpoint Threat
Response Auto Pull (TRAP)

• Deploy Threat Response Auto-Pull (“TRAP”) virtual agent in Customer’s datacenters.

• Integrate TRAP with customer’s mail system.
• Demonstrate TRAP notification and quarantining capabilities and enable automated
message quarantining capabilities.

Assist the customer with the deployment of the Log API

• Assist with obtaining the necessary API key.

• Assist as needed with the integration of the API as it relates to Proofpoint products.

Note: This does not include assisting with the configuration/customization of the customer’s
SIEM for report production

• Assist with the configuration of Basic Proofpoint Encryption (TLS) and Basic Email Data
Loss Prevention (DLP)
• Assist customer with the integration of CLEAR (Closed-Loop Email Analysis & Response)
• Create a new TRAP Abuse Mailbox Monitor and configure the Abuse Mailbox Monitor.
• Configure Match Conditions

Note: If PhishAlarm and/or PhishAlarm Analyzer have not been deployed we will work with
Customer to deploy the PhishAlarm plug-in to customer’s Outlook, Exchange, or Gmail
environment(s) and ensure provisioning within the Security Education Platform.

Training and Communication

• Conduct product knowledge transfer with Customer resources during implementation.

• Provide product documentation, support guide and user communication templates.

Production Cutover

• Execute Test Plan and assist customer with inbound and/or outbound email cutover.
• Validate Proofpoint instance is functioning within expected parameters.

Project Closure

• Validate product functionality – ensure all processes are operating normally.

• Review and document Technical Support procedures as needed.
• Complete any project closure procedures.

Customer Responsibilities

Project Design

• Provide at least one technical resource with system administration responsibilities and
appropriate system access privileges.
• Provide network architecture and email flow diagram of the Customer’s environment.

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 27

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

• Communicate all business objectives and requirements.

Implementation

• Ensure all relevant resources are available for kick-off, planning, configuration, and status
meetings.
• Ensure vendors and third parties are accessible as necessary during implementation
services.
• Assume all responsibility for network connectivity, performance, and configuration issues
within the Customer environment.

Production Cutover

• Execute the communication plan to notify users of any service change.

• Customised the test plan to meet Customer security and testing requirements.
• Manage Customer change control processes.

Project Closure

• Ensure all project action items are complete.

• Complete any Proofpoint training required to maintain the deployed solutions.

9. Compliance Matrix
SN Description Comply Comment
1 To install, configure and Compliant
implement solution hosted
fully on-premises
2 The Solution must adopt Compliant
Operation Centric approach
3 Combat ransomware hidden in Compliant
attachment.
4 Supports Advanced Malware Compliant Traditional anti-spam solutions evaluate a
Protection (AMP) limited number of attributes and are
unable to decisively classify spam, which
leads to a low rate of effectiveness and a
high rate of false positives. Proofpoint
MLX™ technology leverages patent-
pending machine learning techniques to
provide a revolutionary threat detection
system. The Proofpoint solution employs
a full range of classification methods,
from legacy approaches such as

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 28

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

heuristics and Bayesian analysis to state-

of-the-art machine learning algorithms
(such as those used in genomic sequence
analysis) and proprietary image analysis
methods. Analyzing many millions of
messages each day, Proofpoint MLX
automatically adjusts its detection
algorithms to identify even the newest
spam attacks without manual tuning or
administrator intervention. As a result,
Proofpoint MLX is able to provide
continuous spam detection and content
filtering with a very high degree of
accuracy–typically on the order of 99.8%
or higher.

Details: Proofpoint MLX technology

examines the content and context of
messages using structural tests, English
and foreign language inspection, adult
content detection, malicious URL
detection (spyware/phishing/pharming),
image analysis, reputation analysis and
any custom policies defined by an
organization. With full support for double-
byte languages, Proofpoint MLX provides
outstanding protection against even hard-
to-detect Asian language spam.
Proprietary image analysis techniques
included in Proofpoint MLX identify image-
based spam that other solutions fail to
catch. Additionally, an organization’s
spam protection is always kept up-to-date,
ensuring maximum effectiveness at all
times (checks for updates occur every 5
minutes).

Proofpoint MLX automatically evolves

with new spamming techniques to
accurately stop new attacks, staying
highly effective over time. It is superior to
simple statistical techniques and doesn’t
rely on signatures or fingerprinting
techniques, allowing Proofpoint to provide
the most accurate spam detection.

Since Proofpoint MLX spam detection

does not rely primarily on reputation for its

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 29

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

effectiveness, it is uniquely suited to

protecting the outbound mail stream for
spam as well, in the event an internal
system is compromised by malware and
becomes a source of spam.

Different policies can easily be configured

for different groups of end users or
domains. All policies can be customized
at a global, group, or user level with full
integration to LDAP or Active Directory to
simplify on-going administration.
Additionally, messages that contain
suspected spam can also be temporarily
quarantined for a configurable period of
time or until a certain number of spam
updates have been received.

Proofpoint is the only vendor that has

successfully combined machine learning
techniques with traditional approaches to
achieve near-perfect spam detection.
Ongoing efforts by Proofpoint’s Attack
Response Center scientists secure
Proofpoint’s position as a technology
pioneer and industry leader in the fight
against spam.
5 Features Spam Quarantine and Compliant Phishing attempts may be quarantined to
Anti-Spam filtering the out-of-the-box “Phish” quarantine
folder, or to any administrator-created
folder. Quarantine folders have
configurable message expiration timing
(hours to months), and access may be
granted to specific administrators if
desired.

Proofpoint's MLX engine is capable of

categorizing different types of spam
including general spam, phish, bulk, and
more enabling quarantine into different
folders on a per rule basis. Access to
quarantine folders can be controlled on a
per folder basis.

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 30

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

6 High-performance virus Compliant Proofpoint employs both traditional anti-

scanning solution integrated at virus technologies as well as zero-hour
the gateway, The Solution threat detection. URL-based malware
provides a multilayered, detection is identified and prevented via
multivendor approach to virus the Malware Analysis Service as part of
filtering. Proofpoint Targeted Attack Protection
7 provide file reputation scoring Compliant The Targeted Attack Module (TAP) offers
and blocking, file sandboxing, after delivery protection by rewrittin URLs
and file retrospection for within suspicious emails. Every click
continuous analysis of threats. trriggers real time analysis and
Users can block more attacks, sandboxing to ensure the website is safe.
track suspicious files, mitigate
the scope of an outbreak, and
remediate quickly.
8 Drop emails with risky links Compliant Embedded links in email are scanned and
automatically or block access analyzed using multiple technologies (URL
to newly infected sites with reputation as well as Proofpoint Targeted
real-time URL analysis to Attack Protection).
protect against phishing.
9 Automatically encrypts email Compliant TLS based gateway to gateway encryption
communication between mail is supported. Gateway to end user
servers when possible, encryption is provided by the Proofpoint
ensuring email security during Encryption module.
transit.

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 31

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

10 Prevent brand abuse and Compliant Traditional anti-spam solutions evaluate a

sophisticated identity-based limited number of attributes and are
email attacks unable to decisively classify spam, which
leads to a low rate of effectiveness and a
high rate of false positives. Proofpoint
MLX™ technology leverages patent-
pending machine learning techniques to
provide a revolutionary threat detection
system. The Proofpoint solution employs
a full range of classification methods,
from legacy approaches such as
heuristics and Bayesian analysis to state-
of-the-art machine learning algorithms
(such as those used in genomic sequence
analysis) and proprietary image analysis
methods. Analyzing many millions of
messages each day, Proofpoint MLX
automatically adjusts its detection
algorithms to identify even the newest
spam attacks without manual tuning or
administrator intervention. As a result,
Proofpoint MLX is able to provide
continuous spam detection and content
filtering with a very high degree of
accuracy–typically on the order of 99.8%
or higher.

Details: Proofpoint MLX technology

examines the content and context of
messages using structural tests, English
and foreign language inspection, adult
content detection, malicious URL
detection (spyware/phishing/pharming),
image analysis, reputation analysis and
any custom policies defined by an
organization. With full support for double-
byte languages, Proofpoint MLX provides
outstanding protection against even hard-
to-detect Asian language spam.
Proprietary image analysis techniques
included in Proofpoint MLX identify image-
based spam that other solutions fail to
catch. Additionally, an organization’s
spam protection is always kept up-to-date,
ensuring maximum effectiveness at all
times (checks for updates occur every 5
minutes).

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 32

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

Proofpoint MLX automatically evolves

with new spamming techniques to
accurately stop new attacks, staying
highly effective over time. It is superior to
simple statistical techniques and doesn’t
rely on signatures or fingerprinting
techniques, allowing Proofpoint to provide
the most accurate spam detection.

Since Proofpoint MLX spam detection

does not rely primarily on reputation for its
effectiveness, it is uniquely suited to
protecting the outbound mail stream for
spam as well, in the event an internal
system is compromised by malware and
becomes a source of spam.

Different policies can easily be configured

for different groups of end users or
domains. All policies can be customized
at a global, group, or user level with full
integration to LDAP or Active Directory to
simplify on-going administration.
Additionally, messages that contain
suspected spam can also be temporarily
quarantined for a configurable period of
time or until a certain number of spam
updates have been received.

Proofpoint is the only vendor that has

successfully combined machine learning
techniques with traditional approaches to
achieve near-perfect spam detection.
Ongoing efforts by Proofpoint’s Attack
Response Center scientists secure
Proofpoint’s position as a technology
pioneer and industry leader in the fight
against spam.

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 33

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

11 Mailbox auto-remediation Compliant Proofpoint Threat Response Auto Pull

helps remediate breaches solution (TRAP) will help Organization to
faster and with less effort. remediate for delivered threats. TRAP
Customers simply set their retracts threats delivered to employee
email security solution to take inboxes and emails that turn malicious
automatic actions on those after delivery. It is also powerful solution
infected emails. to retract messages sent in error as well
as inappropriate, malicious or emails
containing compliance violations.
TRAP is designed to automate the
quarantine of malicious emails after an
alert from TAP or other security systems
and received. In nn-threat scenarious,
TRAP ingests a CSV file of message
information and programmatically reaches
out to each recipients mailbox, finds the
message, moves it to quarantine, then
looks for forwarded versions of the
message. TRAP repeats this process untill
all messages are retracted. All message
actions are documented along with the
read status of the messages.
12 Protects user against Compliant
malicious URLs with URL
filtering, scanning of URLs in
attachments, and managed
(shortened) URLs. Appropriate
policies are applied to the
messages based on the
reputation or category of the
URLs.
13 Have image analyzer Compliant Proofpoint employs image analysis
capability techniques as part of Proofpoint MLX
spam detection.
14 Spam Protection feature: Compliant
Blocks unwanted emails using
a multilayered scanning
architecture delivering the
highest spam catch rate of
greater than 99 percent.
15 Block unwanted email with Compliant
reputation filtering.
16 A reputation check is Compliant Embedded links in email are scanned and
performed on each embedded analyzed using multiple technologies (URL
hyperlink to verify the integrity reputation as well as Proofpoint Targeted
of the source. Attack Protection).

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 34

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

17 Forged Email Detection Compliant

feature that Helps block
customized attacks against
executives and higher
management and provides
detailed logs on all attempts
and actions taken.
18 prevent phishing emails from Compliant Phishing attempts may be quarantined to
being sent using MOCE the out-of-the-box “Phish” quarantine
domain. folder, or to any administrator-created
folder. Quarantine folders have
configurable message expiration timing
(hours to months), and access may be
granted to specific administrators if
desired.

Proofpoint's MLX engine is capable of

categorizing different types of spam
including general spam, phish, bulk, and
more enabling quarantine into different
folders on a per rule basis. Access to
quarantine folders can be controlled on a
per folder basis.
19 protects MOCE brand identity Compliant
as well as increases email
marketing effectiveness
20 Helps prevent phishing emails Compliant
from being sent using a
customer domain(s). It
automates the process of
implementing the DMARC
email authentication standard
to better protect employees,
customers, and suppliers from
phishing attacks using a
customer domain(s).
21 Adds a digital signature to Compliant DKIM signature generation and signing is
emails, which recipients can supported.
use to verify that the email has
not been altered in transit.
22 Near real-time email scanning Compliant
and threat detection with
minimal latency to avoid
disruptions in email
communications.

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 35

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

23 Graymail detection and safe Compliant Bulk mail can be treated separately from
unsubscribe feature: other types of spam – some users may
classifies and monitors want to receive their Bulk mail (per policy),
graymail entering the and others may not.
organization.
Protection against malicious
threats masquerading as
unsubscribe links.
A uniform interface for
managing all subscriptions
24 Outbreak filters features: - Compliant
Defend against emerging
threats and blended attacks. -
issue rules on any
combination of six
parameters, including file type,
file name, file size, and URLs in
a
message
25 Highly accurate threat Compliant
classification with minimal
false positives and false
negatives, ensuring that
legitimate emails are not
unnecessarily blocked.
26 Scalable architecture designed Compliant
to support MOCE's growth and
increasing email traffic
volumes without
performance degradation
27 The Email Security Gateway Compliant
should be able to consume
external threat information in
STIX format
communicated over TAXII
protocol.
28 The following is a list of STIX Compliant
Indicators of Compromise
(IOCs) should be supported: -
File Hash Watchlist (describes
a set of hashes for suspected
malicious files) - - -
IP Watchlist (describes a set
of suspected malicious IP
addresses)
Domain Watchlist (describes a
set of suspected malicious
domains)

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 36

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

URL Watchlist (describes a set

of suspected malicious URLs)
29 The Solution should Support Compliant
for Unified Common Event
Format (CEF)-based Logging:
‘Consolidated
Event Logs’ that summarizes
each message event in a
single log line
30 Manage all the exclusions Compliant
from the central console
31 The solution must provide an Compliant
intuitive management console
for policy configuration,
monitoring, and
forensic analysis of security
incidents.
32 The solution must ensure high Compliant
availability, and failover
capabilities, ensuring minimal
downtime in the
event of an outage
33 Seamless Integration with On- Compliant
Prem Active Directory, SIEM,
threat response platform, DLP
or any
required solutions
34 The proposed solution must Compliant
be capable of integrating
seamlessly with MOCE's
existing IT
infrastructure and security
ecosystem, offering real-time
threat intelligence and
automated response
capabilities
35 Support the detection of zero- Compliant
day malicious file/file-less
attacks, ransomware attacks,
and adopt
behavioural
analysis/intelligence in
carrying out detection
36 Provide or allow to create Compliant
custom detection rules +
exclusions

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 37

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

37 Provide email traffic statistics, Compliant

including the total number of
emails received, sent, blocked,
and filtered.
38 Provide detailed reporting on Compliant
email traffic, detected threats,
and security events
39 Document the threats to save Compliant
the investigation and enable
collaboration of information
among other
devices.
40 provide email continuity upon Compliant
server’s downtime by rerouting
email traffic to ensure
uninterrupted
communication.
41 Vendor to provide 24x7x365 Compliant
Premium Support
42 Regular security updates, Compliant
patches, and feature
enhancements to keep the
solution resilient against
emerging threats.
43 Number of Mailboxes covered Compliant
in the scope: 900+

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 38

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

10. EC Support & Escalation Matrix

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 39

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 40

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

11. Reference Sites

• Ministry of Interior

• Edge Group

• ADNOC

• ADIA

• Mubadala Group

• Etihad

• NCEMA

• Sharjah Digital Government

• Ajman Digital Government

• Fujairah Digital Government

• General Directorate of Residency and Foreigners Affairs

• ENOC

• Dubai Police

• Dubai Airports

• Fly Dubai

• ADCB, ENBD, RAK Bank, CBD, DIB, CBI, Arab Bank, UAB

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 41

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

12. Engineer Skill Matrix (System).

13. Engineer Skill Matrix (Networking)

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 42

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

14. Awards & Recognitions

➢ Literary Forum for Youth of Arab Universities - 2005

United Arab Emirates University

➢ The fourth annual forum to honor the distinguished – 2015.

Federal Authority for Identity, Citizens, Customs, and Port Security (ICP).

➢ The Third annual forum to honor the distinguished – 2015.

Ministry of Interior.

➢ The fourth annual forum to honor the distinguished – 2015.

Ministry of Interior.

15. Annexure 1: ISO Certificate

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 43

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

16. Annexure 2: Engineers CV’s

Network Engineer
CV's.pdf

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 44

 Abu Dhabi: P.O. Box 7222, U.A.E.
Telephone: +971 2 699 8000 - Fax: +971 2 641 3401
Website: www.emiratescomputers.ae

17. Terms & Conditions

The above proposal and the prices mentioned here

VALIDITY are valid for 30 days.

Software delivery: 1-2 weeks

DELIVERY TIME
PS: 2-3 weeks

EMIRATES COMPUTERS | TECHNICAL PROPOSAL Page | 45

EMIRATES COMPUTERS | TECHNICAL PROPOSAL