afmarulanda/wazuh-ansible
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Updated SECURITY.md file

Browse Source
This commit is contained in:
David Correa Rodríguez 2024-09-13 13:23:04 +02:00
parent 9d085237c2
commit 66524a71c3
No known key found for this signature in database
GPG Key ID: 8787C7C9FF271262
1 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
SECURITY.md
View File

@ -16,11 +16,15 @@ Please submit your findings as security advisories under the "Security" tab in t
## Vulnerability Disclosure Policy ## Vulnerability Disclosure Policy
Upon receiving a report of a potential vulnerability, our team will initiate an investigation. If the reported issue is confirmed as a vulnerability, we will take the following steps: Upon receiving a report of a potential vulnerability, our team will initiate an investigation. If the reported issue is confirmed as a vulnerability, we will take the following steps:
- Acknowledgment: We will acknowledge the receipt of your vulnerability report and begin our investigation. 1. Acknowledgment: We will acknowledge the receipt of your vulnerability report and begin our investigation.
- Validation: We will validate the issue and work on reproducing it in our environment.
- Remediation: We will work on a fix and thoroughly test it 2. Validation: We will validate the issue and work on reproducing it in our environment.
- Release & Disclosure: After 90 days from the discovery of the vulnerability, or as soon as a fix is ready and thoroughly tested (whichever comes first), we will release a security update for the affected project. We will also publicly disclose the vulnerability by publishing a CVE (Common Vulnerabilities and Exposures) and acknowledging the discovering party.
- Exceptions: In order to preserve the security of the Wazuh community at large, we might extend the disclosure period to allow users to patch their deployments. 3. Remediation: We will work on a fix and thoroughly test it.
4. Release & Disclosure: After 90 days from the discovery of the vulnerability, or as soon as a fix is ready and thoroughly tested (whichever comes first), we will release a security update for the affected project. We will also publicly disclose the vulnerability by publishing a CVE (Common Vulnerabilities and Exposures) and acknowledging the discovering party.
5. Exceptions: In order to preserve the security of the Wazuh community at large, we might extend the disclosure period to allow users to patch their deployments.
This 90-day period allows for end-users to update their systems and minimizes the risk of widespread exploitation of the vulnerability. This 90-day period allows for end-users to update their systems and minimizes the risk of widespread exploitation of the vulnerability.