Vulnerability Disclosure Policy

Potentially illegal actions

If you discover a weakness and investigate it, you should be aware that you might perform actions punishable by law. Provided you follow the rules and principles below when reporting weaknesses in our IT systems, NT-ware will not report your offense to the authorities and will not submit a claim.

However, you need to know that the public prosecutor's office – not NT-ware – may decide that you should be prosecuted, even if NT-ware has not reported your offense to the authorities i.e. NT-ware cannot guarantee that you will not be prosecuted if you commit a punishable offense when investigating a weakness.

The National Cyber Security Centre of the Ministry of Security and Justice Netherlands has created guidelines for reporting weaknesses in IT systems. NT-ware’s rules are based on these guidelines. (Home - National Cyber Security Centre)

General principles

Take responsibility and act with extreme caution. When investigating the matter, only use methods or techniques necessary to find or demonstrate weaknesses.

You must not:

• Violate any law or regulations.
• Access unnecessary, excessive or significant amounts of data.
• Copy more than you need. If one record is sufficient, do not go any further.
• Modify data in NT-ware's systems or services.
• Use high-intensity invasive or destructive scanning tools to identify vulnerabilities.
• Attempt or report any form of denial of service e.g. overwhelming a service with a high volume of requests.
• Disrupt or alter NT-ware's services, systems or information.
• Demand financial compensation in order to disclose any vulnerabilities.
• Publicly disclose any resolved vulnerability report without prior written consent from NT-ware.
• Use any weaknesses you detect for purposes other than your own research.
• Use social engineering to gain access to a system.
• Install any back doors – not even to demonstrate the vulnerability of a system - as they will weaken the system's security.
• Use brute force techniques e.g. repeatedly entering passwords to gain access to systems.
• Use Denial of Service (DoS) type of attack to gain access.

You must:

• Securely delete all data retrieved during your research as soon as it's no longer needed or within one month of resolving the vulnerability - whichever occurs first or as otherwise required by data protection law.
• Always comply with data protection rules and do not violate the privacy of NT-ware's users, staff, contractors, services or systems i.e. you must not share, redistribute or fail to properly secure data retrieved from the systems or services.
• Only infiltrate a system if it is really necessary to do so.
• Do not share access with others if you manage to infiltrate a system.