Policy Page Last Updated:

INTRODUCTION

TRIAD GSI is committed to ensuring the security of our digital assets and protecting user’s information.  TRIAD GSI welcomes feedback from security researchers to help improve its security. This policy is intended to give security researchers clear guidelines for conducting vulnerability discovery activities and to convey our preferences in how to submit discovered vulnerabilities to us.  This policy describes what systems and types of research are covered under this policy, how to send us vulnerability reports, and how long we ask security researchers to wait before publicly disclosing vulnerabilities.  We encourage you to contact us to report potential vulnerabilities in our systems.    If you believe you have discovered a vulnerability in any of our digital assets covered by this policy, we want to hear from you.

AUTHORIZATION

If you make a good faith effort to comply with this policy during your security research, we will consider your research to be authorized, will work with you to understand and resolve the issue quickly, and TRIAD GSI will not initiate or recommend legal action related to your research.

When conducting vulnerability research according to the guidelines and scope of this policy, we consider this research to be:

  • Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
  • Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;
  • Exempt from restrictions in any software Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and
  • You are expected, as always, to comply with all applicable laws.

GUIDELINES

Under this policy, “research” means activities in which you:

  • Notify us as soon as possible after you discover a real or potential security issue.
  • Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.
  • Only use exploits to the extent necessary to confirm a vulnerability’s presence. Do not use an exploit to compromise or exfiltrate data, establish persistent command line access, or use the exploit to pivot to other systems.
  • Provide us a reasonable amount of time to resolve the issue before you disclose it publicly.
  • Do not submit a high volume of low-quality reports.

Once you’ve established that a vulnerability exists or encounter any sensitive data (including personally identifiable information, financial information, or proprietary information or trade secrets of any party), you must stop your test, notify us immediately, and not disclose this data to anyone else.

SCOPE

This policy applies to all digital assets owned and operated by TRIAD GSI, including corporate IT networks and public facing websites. This policy does not give authorization to test state and local government election related networks or assets and researchers should follow guidance from those entities for security research opportunities and conditions. For TRIAD GSI products not owned or operated by TRIAD GSI, we will accept reports as a result of research under this policy.

*Note: TRIAD GSI may offer special security research projects involving developmental or preproduction products. Interested researchers may contact TRIAD GSI at vulnerability@triadgsi.com to learn more.

The following test types are not allowed:

  • Denial of service (DoS or DDoS) tests.
  • Defacement
  • Physical testing (e.g. office access, open doors, tailgating).
  • Social engineering (e.g. phishing, vishing).
  • Intentionally or potentially disruptive test types, including but not limited to DNS spoofing or DNS tunneling.
  • Functionality bugs, clickjacking, email spoofing, etc. are considered out of scope. Our intent is to work with researchers to identify software and systems vulnerabilities, not to identify low impact issues. Testers may report such issues, but they may not be handled as an issue subjected to this vulnerability disclosure process.

If you encounter any of the below on our systems while testing within the scope of this policy, stop your test and notify us immediately:

  • Personally identifiable information (Social Security numbers, driver’s license numbers)
  • Financial information (e.g., credit card or bank account numbers)

REPORTING A VULNERABILITY

In order to submit a vulnerability report, please email vulnerability@triadgsi.com.  The more details you provide, the easier it will be for us to triage and correct the issue.  We recommend that your reports:

  • Describe the location the vulnerability was discovered and the potential impact of exploitation.
  • Offer a detailed description of the steps needed to reproduce the vulnerability (proof of concept scripts or screenshots are helpful).
  • Be in English, if possible.

When you choose to share your contact information with us, we commit to coordinating with you as openly and as quickly as possible.  When working with us according to this policy, you can expect us to:

  • Acknowledge reports within 7 business days
  • Work in good faith with you to understand the details around the discovery of the vulnerability
  • Strive to keep you informed about the progress of remediating a vulnerability as it is processed
  • Work to remediate discovered vulnerabilities in a timely manner

QUESTIONS

Questions regarding this policy may be sent to vulnerability@triadgsi.com. We also invite you to contact us with suggestions for improving this policy.