Disclosure Policy

VidyaSEC
May 27th, 2021
v1.0

Introduction

We at VidyaSEC are dedicated to protecting the global community from the effects of software and hardware vulnerabilities. In the course of investigation of malware, attack clients, and systems, we may find novel attack vectors in software or hardware publically sold by or distributed by individuals, businesses, or organizations (“Vendors”). In the interest of public safety, we distribute Advisories to the public to warn them of these vulnerabilities. However, we also understand that companies have their own restrictions and time constraints.

With that understanding in mind, we have implemented the following Policy to best balance the needs of the community and the company we are consulting. The policy outlined below was developed following industry best practices for responsible public disclosure of security vulnerabilities.

Policy

VidyaSEC will responsibly notify vendors of security vulnerabilities in their products or services.

Regardless of vendor acceptance or rejection of the vulnerability’s validity, the vulnerability’s details will be released to the public in forty-five (45) days following completion of the Vulnerability Disclosure Process Control section outlined below.

All decisions related to the public disclosure of vulnerabilities lie solely with VidyaSEC. Unless extraordinary circumstances arise, the public release of a vulnerability by VidyaSEC will follow our standard procedure.

VidyaSEC will make every effort to help vendors understand how the vulnerability works in the interest of getting it patched. In the event a vendor cannot or will not patch a vulnerability, VidyaSEC will attempt to work with the vendor in publishing a workaround with the vulnerability details. In no case, however, will VidyaSEC suppress a vulnerability from being published.

VidyaSEC will not release vulnerability details publically without first contacting the vendor. VidyaSEC will internally vet the vulnerabilities before sending them to the vendor.

Communications between the vendor and VidyaSEC may be made public once the vulnerability itself has been made public. VidyaSEC will notify the vendor with publication plans. Alternate publication schedules can be made at the discretion of VidyaSEC.

In the event a vendor does not respond, or refuses, is unable to, or makes unreasonable demands of remediation, VidyaSEC reserves the right to publically disclose security vulnerabilities within 15 business days of the initial notification, regardless of the existence or availability of fixes, patches, or other remediation. The final schedule of publication lies solely at VidyaSEC’s discretion.

Controls and Process

Vulnerabilities discovered by VidyaSEC have been identified by qualified security engineers and analyzed by our review board.
Upon discovery, we will check known public reporting databases for any duplicate reports.
Upon discovery, VidyaSEC’s first initial contact will be made through any appropriate contacts listed on the company’s website, or by sending an email to the appropriate point of contact (security@, support@, info@, secure@vendor.com, etc), with the pertinent information about the vulnerability. VidyaSEC will not use online forms to submit vulnerability information. However, VidyaSEC may use an online form to request a security point of contact. VidyaSEC will PGP-encrypt all emails exchanged with the vendor, provided vendor supports PGP and can provide a public key. During this initial email contact, VidyaSEC will notify vendor of its intention to publicate the vulnerability, and on which timeline. The vendor is encouraged to reply to the email and work with VidyaSEC to determine a resolution timeframe.
If the vendor fails to respond to the initial VidyaSEC contact email within five (5) business days, VidyaSEC will attempt to formally contact a representative at the vendor a second time. Should the vendor fail to respond for another five (5) business days, VidyaSEC may rely on an intermediary to establish contact. If VidyaSEC exhausts all possible means to contact the vendor, VidyaSEC will release the report after fifteen (15) days after the initial contact attempt.
In the event of a sufficiently severe breach (such as breach of personal information), VidyaSEC reserves the right to contact Carnegie Mellon’s Computer Emergency Response Team (CERT) or US-CERT, regardless of whether the vendor has responded to VidyaSEC or not.
VidyaSEC realizes that some issues may take longer to resolve than the allotted timeframe, and we are willing to work with vendors in resolving the problem within a reasonable time frame. If the vendor is unresponsive, unable, or unwilling to resolve the problem within a reasonable time frame without an acceptable statement as to why, VidyaSEC reserves the right to publish vulnerability details to the defensive community with or without notification to the vendor. VidyaSEC may grant additional time upon request, but will require proactive, regular updates regarding progress. Updates must be delivered within a month interval. If an expected update is not received, VidyaSEC will make three (3) attempts at contact before publishing the vulnerability.

Policy Management

VidyaSEC reserves the right to change this Policy as needed, with or without notification to vendors or the public. Vendors and contributors are encouraged to contact us should any questions about this policy arise.

Our contact email is: (base64-encoded)

Y29udGFjdEB2aWR5YXNlYy5vcmcgDQo=

The PGP key associated with this account has the fingerprint:

9F12 4D9F 059C B7AF E3B1 E4C1 AE15 9025 C9FA 2384

The full key, also available here, is:

Acknowledgements

This policy was derived from one by KoreLOGIC without permission, as we didn’t have a whole ton of other examples and guidance to crib from. Hopefully, they’re OK with it.