Protecting the government from cyber threats is a collaborative effort. If you discover a security flaw in an ICT system belonging to the central government, following the responsible disclosure process is crucial. This guide explains how to report the vulnerability securely and what to expect from the government.
What to Do
- Report the vulnerability: Use the dedicated CVD-report form provided by the National Cyber Security Centre (NCSC).
- Provide details: Include enough information to reproduce the flaw, such as the computer’s IP address, the ICT system’s URL, and a clear description of the vulnerability.
- Leave your contact: Provide an email address or phone number so the government can reach you if needed.
- Report promptly: Act quickly after discovering the vulnerability.
- Maintain confidentiality: Don’t share details about the flaw publicly until it’s patched.
- Act responsibly: Limit your actions to demonstrating the vulnerability without causing harm.
What Not to Do
- Send malware: Avoid uploading harmful software to the system.
- Modify data: Refrain from copying, changing, or deleting data within the system.
- Alter the system: Don’t make unauthorized modifications to the system.
- Repeated access: Avoid repeatedly accessing or sharing access to the affected system.
- Brute force: Don’t attempt to bypass system security using brute force methods.
- Social engineering: Refrain from using social manipulation tactics to gain access.
What to Expect
By following these guidelines, your report is protected from legal consequences by the government. They will treat your disclosure with confidentiality and not share your information without permission. You have the option to be publicly acknowledged for your contribution, and you can expect:
- Acknowledgement: A receipt confirmation within one business day.
- Response: A detailed response within three business days, including an assessment of the vulnerability and projected patch date.
- Progress updates: Regular updates on the progress made towards fixing the issue.
- Patch timeline: The government aims to fix the vulnerability within 60 days from receiving the report.
- Collaboration: They will work with you to determine how to responsibly disclose the vulnerability after it’s fixed.
- Recognition: You will receive a reward (according to government guidelines) as a token of appreciation for your assistance.
