Responsible Vulnerability Disclosure Program

Vulnerability Disclosure Program Pakistan — **VULNERABILITY DISCLOSURE** **Pakistan**

WHAT IS RESPONSIBLE VULNERABILITY DISCLOSURE?

Responsible vulnerability disclosure is a process that allows security researchers to safely report and share found vulnerabilities in ICT system belonging to government and other business or private organisations operating in Pakistan, to our team.

If you are a cybersecurity researcher who wants to sell their cybersecurity research / 0day exploits than find out more about Exploit Acquisition Platform in Pakistan.

Our vulnerability disclosure program makes it easier for security researchers to know exactly how to share vulnerabilities in applications and infrastructure in a safe and efficient manner. We help Pakistani organisations by creating and managing a responsible disclosure program on their behalf which can help them improve their cyber security posture and protect the digital ecosystem in Pakistan.

MANAGED VULNERABILITY DISCLOSURE (MVD) – Pakistan

To help Pakistani organizations and businesses adopt responsible disclosure, we’ve developed an responsible disclosure policy your team can utilize for free. Implementing a responsible disclosure policy will lead to a higher level of security awareness for your team. Bringing the conversation of “what if” to your team will raise security awareness and help minimize the occurrence of an attack. Whether you have an existing disclosure program or are considering setting up your own, Tier3 works alongside with disclosure .pk – The largest hacking community in Pakistan. This helps us in analyzing the tactics, techniques, and procedures (TTPs) used by the potential threat actors to identify patterns of behavior and commonalities between different incidents that can help streamline submissions and manage your program for you.

Our Managed Vulnerability Disclosure Program amplifies and extends your security capabilities and reduces risk many fold. With a VDP, you invite the world to report critical vulnerabilities they find in your systems. Tier3 provides end-to-end management for vulnerability submission, triage, validation, SDLC integration, and remediation. In short,we remove virtually all the overhead for your security team so they can focus on resolving validated issues sooner.

COORDINATED VULNERABILITY DISCLOSURE (CVD) – Pakistan

Tier3 CVD program helps Pakistani organisations to coordinate the process of addressing and making public any newly discovered cybersecurity vulnerabilities in their products or services, working with the vendor or service provider affected. This includes vulnerabilities in industrial control systems, Internet of Things devices, medical devices, and traditional IT systems. The objective of the program is to ensure that Tier3, the vendor, and the person who reported the vulnerability all disclose the information simultaneously, providing clear and actionable guidance to users and administrators in a timely manner.

Our coordinated vulnerability disclosure process involves five basic steps:

Collection Of Information: Tier3 collects vulnerability reports in three ways: Tier3 vulnerability analysis, monitoring public sources of vulnerability information, and direct reports of vulnerabilities to Tier3 . After receiving a report, Tier3 performs an initial analysis to assess a vulnerability’s presence and compare with existing reports to identify duplicates. Tier3 then catalogs the vulnerability report, including all information that is known at that point.
Analysis of Vulnerability: Once the vulnerability reports are catalogued, vendor(s) and our analysts work to understand the vulnerabilities by examining the technical issue and the potential risk the vulnerability represents.
Mitigation and Coordination: After analyzing a vulnerability, we will continue to work with the affected vendor(s) for mitigation development and the issuance of patches or updates.
Application of Mitigation: When possible and where necessary, we may work with vendor(s) to facilitate sufficient time for affected end users to obtain, test, and apply mitigation strategies prior to public disclosure.
Disclosure: In coordination with the source of the vulnerability report and the affected vendor(s), we will take appropriate steps to notify users about the vulnerability via multiple channels. Tier3 strives to disclose accurate, neutral, objective information focused on technical remediation and mitigation for asset owners and operators. We will make references to available related information and correct misinformation where necessary.

Typical Vulnerabilities Accepted:

OWASP Top 10 vulnerability categories
Other vulnerabilities with demonstrated impact

Typical Out of Scope:

Theoretical vulnerabilities
Informational disclosure of non-sensitive data
Low impact session management issues
Self XSS (user defined payload)
Incomplete or missing SPF/DMARC/DKIM records
Issues related to password/credential strength, length, lockouts, or lack of brute-force/rate limiting protections

Additional specific vulnerability types considered out of scope due to low impact:

IIS Tilde File and Directory Disclosure
SSH Username Enumeration
WordPress Username Enumeration
SSL Weak Ciphers/ POODLE / Heartbleed
CSV Injection
PHP Info
Server-Status if it does not reveal sensitive information
Snoop Info Disclosures

Responsible Vulnerability Disclosure – Pakistan

We take the security of systems, products, employees and customers’ information in Pakistan seriously, and we value the security of our local Pakistani community. We appreciate and encourage security researchers to contact us to report potential vulnerabilities identified in any product, system, or asset belonging to Pakistani Corporate, Government Institutes and local Pakistani affiliate companies. If you believe you have identified a potential security vulnerability in ICT system belonging Pakistani Govt or Business entity operating or based in Pakistan, please submit it pursuant to our Responsible Disclosure Program.