Responsible disclosure

We realise that, despite our best intentions and care, a vulnerability may occasionally arise in the security of our systems. If you discover a vulnerability in one of our systems, we would very much like to hear about it. We can then resolve the vulnerability. Vulnerabilities can be discovered in two ways: you may come across one by accident whilst using a digital environment as normal, or you may make a deliberate effort to find one.

Our responsible disclosure policy is not an invitation to actively and extensively scan our corporate network for vulnerabilities. We monitor our network ourselves. As a result, there is a high likelihood that a scan will be detected, that our Security Operations Centre (SOC) will investigate it, and that unnecessary costs may be incurred.

We would like to work with you to better protect researchers and our systems.

What do we ask?

• If you are investigating a vulnerability in one of our systems, please ensure the attack is proportionate. This principle of proportionality also applies when demonstrating the vulnerability itself. Do not view or alter more data than is strictly necessary to demonstrate the vulnerability.
• Do not exploit the vulnerability by, for example, downloading, altering or deleting data. We always take your report seriously and will investigate any suspected vulnerability, even without ‘proof’.
• Do not share the issue with others until it has been resolved.
• Do not use attacks on physical security, social engineering or hacking tools, such as vulnerability scanners.
• Provide us with sufficient information to reproduce the problem, so that we can resolve it as quickly as possible. Usually, the IP address or URL of the affected system and a description of the vulnerability are sufficient, but more may be required for more complex vulnerabilities.
• You must delete all confidential data obtained during your investigation immediately after we have resolved the vulnerability.

What we promise

• We will respond to your report with substantive details within ten working days, including the expected resolution timeframe. Naturally, we will also keep you regularly updated on the progress of resolving the issue.
• We will resolve the vulnerability as quickly as possible. Here too, proportionality plays an important role: the timeframe for resolving a vulnerability depends on various factors, including its severity and complexity.
• We will treat your report confidentially and will not share your personal data with third parties without your consent. An exception to this is the police and judicial authorities, in the event of a police report being filed or if data is requested by the authorities.
• Unfortunately, it is not possible to rule out legal action against you in advance. We wish to be able to assess each situation on a case-by-case basis. NWO will report the matter to the police if we suspect that the vulnerability or data is being misused, or that you have shared knowledge of the vulnerability with others. You can rest assured that an accidental discovery within our online environment will not lead to a police report.
• We believe it is important to give you the credit you deserve – and that you wish to receive. We will only mention your name in a publication about the vulnerability if you consent to this.
• As a thank you for your help, we offer a mention on our ‘Wall of Fame’ for every report of a security issue previously unknown to us. This is determined based on the severity of the vulnerability and the quality of the report.
• Should you find a vulnerability in software that we use, but which is produced by a third party, and that vulnerability falls under a bug bounty programme, you will be referred to that party and any reward will, of course, be yours.

Scope

The following vulnerabilities fall outside the scope of this responsible disclosure policy:

• HTTP 404 codes/pages or other non-200 HTTP codes/pages, and content spoofing or text injection on these pages.
• Fingerprinting of version banners on general/public services.
• Public files or folders, or non-sensitive information (e.g. robots.txt).
• Clickjacking and issues that can only be exploited via clickjacking.
• Absence of Secure/HTTPOnly flags for non-sensitive cookies.
• Enabled HTTP methods.
• Anything relating to HTTP security headers, for example: Strict-Transport-Security. X-Frame-Options. X-XSS-Protection. X-Content-Type-Options. Content-Security-Policy.
• Issues with SSL/TLS configuration and/or certificates, for example:
• SSL forward secrecy not enabled. Weak/insecure cipher suites. Host header injection.
• Issues with SPF, DKIM, DMARC and MTA-STS.
• Reporting of known vulnerabilities in older versions of software without proof of concept or a working exploit.
• Data leaks on publicly published NWO domains or in the metadata of published NWO documents.
• Vulnerabilities relating to DoS (Denial of Service) or DDoS (Distributed Denial of Service).
• Physical vulnerabilities or attacks utilising social engineering.
• Vulnerabilities relating to third-party software and/or (supply chain) suppliers.

We aim to resolve all issues as quickly as possible, keep all parties involved informed, and we would like to be involved in any publication regarding the issue once it has been resolved.

Reporting a vulnerability

Please report any vulnerability in one of our systems as soon as possible by sending an email to security@nwo.nl. Please include sufficient information in your report to enable us to reproduce and investigate the issue.