VAHLE policy on the responsible disclosure of vulnerabilities

VAHLE develops and supplies products and solutions that meet the highest standards of quality, reliability and cyber security. The VAHLE Computer Emergency Response Team (CERT) supports this objective by assisting in the identification, assessment and remediation of security vulnerabilities discovered in VAHLE products and solutions by security researchers, partners, customers or other external parties.

In the event of potential or confirmed security incidents, the VAHLE CERT coordinates the necessary measures with the relevant development, product and technical experts. This includes assessing the reported vulnerability, drawing up an appropriate action plan and maintaining regular communication with the reporter. VAHLE supports the principle of Coordinated Vulnerability Disclosure and therefore requests that reported vulnerabilities be treated as confidential until an appropriate solution or risk mitigation measure has been provided.

Regardless of service contracts or a product’s lifecycle, all individuals and organisations are invited to report identified security vulnerabilities. We welcome reports from security researchers, CERTs (Computer Emergency Response Teams), industry associations, partners, customers and all other responsible sources.

In doing so, VAHLE respects the interests and wishes of the reporter. Anonymous reports are also accepted.

VAHLE carefully reviews every report and will take appropriate action provided that the reported vulnerability is demonstrably related to a VAHLE product, VAHLE software or a VAHLE service.

Premature public disclosure may expose customers and systems to unnecessary risks. We therefore strongly recommend a coordinated approach to disclosure.

We ask reporters not to disclose unresolved security vulnerabilities to third parties or to make them public until a coordinated disclosure has taken place.

Provided this policy is adhered to, VAHLE CERT, in collaboration with the relevant specialist departments, will make reasonable efforts to:

• acknowledge receipt of a vulnerability report in a timely manner,
• assess the report and initiate its resolution,
• keep the reporter informed of significant progress,
• provide an estimated timeframe for the assessment and resolution, where possible,
• inform the reporter as soon as a solution, fix or other appropriate measure is available.

Status updates will be provided as soon as relevant information becomes available.

VAHLE will not take legal action against individuals or organisations acting in good faith who report security vulnerabilities responsibly, provided that the following conditions are met:

• No actions shall be taken that cause harm to VAHLE, its customers or third parties.
• The privacy, confidentiality and security of customer, corporate or personal data are respected at all times.
• The availability, integrity or security of systems and services must not be compromised.
• No applicable laws or regulations are breached.
• Information regarding the security vulnerability must not be published before a coordinated disclosure has taken place with VAHLE or VAHLE has confirmed that the issue has been resolved.

VAHLE values the work and commitment of security researchers, customers, partners and all other stakeholders who help to identify vulnerabilities and report them responsibly. Through this collaboration, we are making an important joint contribution to the security of our products, our customers and the entire connected industry.

We would like to thank you for your support in the ongoing improvement of cyber security at VAHLE.