The VAHLE CERT process

VAHLE develops and supplies products and solutions that meet the highest standards of quality, reliability and cyber security.

The VAHLE Computer Emergency Response Team (CERT) supports this objective by addressing security vulnerabilities identified and reported in VAHLE products by security researchers, customers, partners or other stakeholders.

The VAHLE CERT process is based on proven industry standards and comprises four phases:

1. Discovery
2. Triage
3. Remediation
4. Disclosure

Discovery

A potential security vulnerability in a product, piece of software or system is reported to VAHLE CERT. Every report is recorded and subjected to an initial assessment.

Triage

The VAHLE CERT works in collaboration with the relevant development and product experts to analyse, reproduce and assess the impact of the reported vulnerability. During the investigation, there is regular communication with the reporter, where necessary, to obtain additional information and to transparently communicate the status of the investigation. Where necessary, affected customers or their security teams are informed at an early stage of any relevant security risks.

Remediation

Once the analysis is complete, a decision is made on which measures are required to minimise the risk. This may include the development of a security update, the implementation of appropriate protective measures, or the provision of recommendations for action. Where possible, the VAHLE CERT works with the reporter to verify and validate the effectiveness of the measures developed. The necessary corrections are then prepared for deployment and distribution.

Disclosure

The VAHLE CERT coordinates the timing and scope of any potential publication with the reporter. If a public announcement is planned, VAHLE publishes a corresponding security advisory via the designated communication channels.

A security advisory usually contains the following information:

• Description of the vulnerability, including CVE reference and CVSS score (if available)
• Identification of affected products and relevant software and hardware versions
• Information on possible protective measures and workarounds
• Availability of security updates, patches or other remedial measures
• Timeline for processing and publication

By handling reported security vulnerabilities in a structured and transparent manner, VAHLE CERT helps to continuously improve the security of products and systems and to provide customers with the best possible support.