Purpose
The security of CSIRO systems is important to us. While we work to keep our systems secure, vulnerabilities may still exist.
We welcome responsible disclosure of security vulnerabilities and encourage security researchers and members of the public to report potential vulnerabilities in CSIRO systems, services or products.
The purpose of this program is to receive, assess, and remediate reported security vulnerabilities.
This program is not intended for general enquiries, service request or support requests. We will only respond to submissions relating to potential security vulnerabilities.
Program Scope
This Vulnerability Disclosure Program applies to products and services owned or operated by CSIRO that you have lawful access to.
Disallowed Activities
To ensure the integrity and availability of CSIRO systems and services, the following activities are not permitted under this program:
- Social engineering or phishing.
- Denial of Service (DoS) or Distributed Denial of Service (DDoS) attacks.
- Physical attacks against CSIRO personnel, facilities or property.
- Attempts to modify, destroy or exfiltrate data.
- Accessing or attempting to access accounts or data that do not belong to you.
- Posting, transmitting, uploading, linking to, or sending malware.
- Any activity that violates Australian law.
- Testing of third-party websites, applications or services that integrate with CSIRO systems.
- Automated vulnerability scan reports submitted without evidence of a specific vulnerability.
Please do not report:
- Weak or insecure SSL/TLS ciphers or certificates.
- Misconfigured DNS records, including SPF, DKIM or DMARC records.
- Missing security HTTP headers.
- Security issues that are theoretical in nature and do not demonstrate a practical security impact.
- Missing security controls that are not directly exploitable.
How to Disclose a Vulnerability
If you believe you have identified a security vulnerability in a CSIRO system, service or product, please report it as soon as possible.
Reports should include sufficient information to enable CSIRO to understand, reproduce and validate the issue, including where possible:
- The affected system, service or URL.
- Details of the vulnerability.
- Steps required to reproduce the issue.
- Supporting evidence, screenshots or proof-of-concept information.
- The potential impact of the vulnerability.
- Your contact details.
Responsible Disclosure
CSIRO requests that information relating to a reported vulnerability remains confidential until the issue has been investigated, and appropriate remediation action has been completed.
Please do not publicly disclose details of a vulnerability until a disclosure timeframe has been agreed with CSIRO.
What Happens Next
When a vulnerability report is received, CSIRO will:
- Acknowledge receipt of the report.
- Assess and validate the reported vulnerability.
- Investigate and determine appropriate remediation actions.
- Contact the reporter if further information is required.
- Keep the reporter informed of progress where appropriate.
- Coordinate public disclosure where appropriate following remediation.
Not all reported issues will be assessed as security vulnerabilities. CSIRO will determine the validity, severity and remediation priority of all reports.
Acknowledgements
We will publish the names or aliases of people who contribute to our security Vulnerability Disclosure Program below with their permission.
Purpose
The security of CSIRO systems is important to us. While we work to keep our systems secure, vulnerabilities may still exist.
We welcome responsible disclosure of security vulnerabilities and encourage security researchers and members of the public to report potential vulnerabilities in CSIRO systems, services or products.
The purpose of this program is to receive, assess, and remediate reported security vulnerabilities.
This program is not intended for general enquiries, service request or support requests. We will only respond to submissions relating to potential security vulnerabilities.
Program Scope
This Vulnerability Disclosure Program applies to products and services owned or operated by CSIRO that you have lawful access to.
Disallowed Activities
To ensure the integrity and availability of CSIRO systems and services, the following activities are not permitted under this program:
- Social engineering or phishing.
- Denial of Service (DoS) or Distributed Denial of Service (DDoS) attacks.
- Physical attacks against CSIRO personnel, facilities or property.
- Attempts to modify, destroy or exfiltrate data.
- Accessing or attempting to access accounts or data that do not belong to you.
- Posting, transmitting, uploading, linking to, or sending malware.
- Any activity that violates Australian law.
- Testing of third-party websites, applications or services that integrate with CSIRO systems.
- Automated vulnerability scan reports submitted without evidence of a specific vulnerability.
Please do not report:
- Weak or insecure SSL/TLS ciphers or certificates.
- Misconfigured DNS records, including SPF, DKIM or DMARC records.
- Missing security HTTP headers.
- Security issues that are theoretical in nature and do not demonstrate a practical security impact.
- Missing security controls that are not directly exploitable.
How to Disclose a Vulnerability
If you believe you have identified a security vulnerability in a CSIRO system, service or product, please report it as soon as possible.
Reports should include sufficient information to enable CSIRO to understand, reproduce and validate the issue, including where possible:
- The affected system, service or URL.
- Details of the vulnerability.
- Steps required to reproduce the issue.
- Supporting evidence, screenshots or proof-of-concept information.
- The potential impact of the vulnerability.
- Your contact details.
Responsible Disclosure
CSIRO requests that information relating to a reported vulnerability remains confidential until the issue has been investigated, and appropriate remediation action has been completed.
Please do not publicly disclose details of a vulnerability until a disclosure timeframe has been agreed with CSIRO.
What Happens Next
When a vulnerability report is received, CSIRO will:
- Acknowledge receipt of the report.
- Assess and validate the reported vulnerability.
- Investigate and determine appropriate remediation actions.
- Contact the reporter if further information is required.
- Keep the reporter informed of progress where appropriate.
- Coordinate public disclosure where appropriate following remediation.
Not all reported issues will be assessed as security vulnerabilities. CSIRO will determine the validity, severity and remediation priority of all reports.
Acknowledgements
We will publish the names or aliases of people who contribute to our security Vulnerability Disclosure Program below with their permission.