Product Security Incident Response

Vulnerability Management

Thales pays a special attention in discovering and remediating potential vulnerabilities that may affect the security of Thales’ products and services.

In this context, Thales provides a contact point to people wishing to communicate potential vulnerabilities, practicing the Responsible Disclosure model. Such dedicated public entry point (psirt(at)thalesgroup[.]com) shall help reporters reaching out to the dedicated team. 
Thales PSIRT ensures proper triage of reports across the various entities of Thales.

Responsible disclosure

The Responsible Disclosure model implies the qualification and the impact assessment of the reported security issues.
Once confirmed, the reporter is informed of Thales’s investigation and an embargo period is agreed, to mitigate the risks for customers and end users.

Each reporter commits to the following:

• Do not take advantage of the security issue discovered, for example, by downloading more data than necessary to demonstrate the vulnerability, or by deleting/modifying data.
• Do not disclose the issue until it has been resolved and without Thales’s consent.
• Do not perform attacks like social engineering, denial of service, physical site intrusion, spam, or applications of third parties.

Confidentiality notice

Thales will handle the communicated information securely and will enforce industry standards to keep them confidential.

However, it is the reporter’s responsibility to assess the transmitted data to ensure it does not infringe any law or regulation that would apply to this data. In case of any doubt, Thales recommends not to transmit such information through this channel and to wait until Thales reply to jointly agree on such transmission.

The reporter’s personal data is only used for actions related to the reported security vulnerabilities. It will not be disclosed to third parties without the reporter's permission, unless required by law.