The Yokogawa Group Vulnerability Handling Policy

Purpose of the Policy

The purpose of this Policy is to explain the Yokogawa Group’s basic policy for the handling of vulnerabilities and its process to customers, computer emergency response team (CERT)(*1) organizations, vendors, researchers and other stakeholders. The Yokogawa Group is committed to responding to vulnerabilities in our products(*2) in accordance with this Policy.
The Yokogawa Group expresses its sincerest gratitude to stakeholders for collaboration in mitigating the risk of vulnerabilities, that are weakness to cyberattacks, with a view to ensuring the security of customers’ assets.

Basic Policy

The Yokogawa Group shall work to support ensuring the safety of our customers' assets with the recognition that continuous risk assessment and taking measures to cyber-threats are one of the most important tasks for customers’ asset management.
With respect to the handling of vulnerabilities, the Yokogawa Group will offer information and countermeasures regarding the vulnerabilities of our products with a view to supporting customers to manage associated risks.

Process

The process of handling vulnerabilities consists of the four steps described below.

1. Acceptance of information

The Yokogawa Group accepts information on vulnerabilities of our products from any party. Normally, the Group will contact the reporter regarding acceptance of the vulnerability information within one or two business days. The Group may ask for additional information.
Please report vulnerability information from the following:
https://contact.yokogawa.com/cs/gw?c-id=000983

Based on the concept of Coordinated Vulnerability Disclosure (CVD)(*3), the Yokogawa Group request to the reporter to report discovered vulnerabilities to the Yokogawa Group or CERT organizations in advance of disclosure.

 

2. Investigation of vulnerabilities

The Yokogawa Group will investigate products that will be affected by vulnerabilities, The Group will share the results with the reporter. It will rate the level of severity of the vulnerabilities under the Common Vulnerability Scoring System (CVSS)(*4).

 

3. Preparations for countermeasures

The Yokogawa Group will consider taking the following countermeasures and will make preparation in accordance with the level of severity of the vulnerabilities.
- Remediation: Patch, fix, upgrade and suchlike to either remove or mitigate a vulnerability
- Workaround: Actions and others aimed at reducing impacts of attacks that exploit vulnerabilities

 

4. Information offering

The Yokogawa Group will provide customers with the Yokogawa Security Advisory Report (YSAR), which includes information on vulnerabilities. Before doing so, it will coordinate the YSAR’s content and the timing of its provision with the reporter and with CERT organizations.
- Content of the YSAR
    The YSAR will include the following information.
    - Descriptions of vulnerabilities
    - Products and their versions affected by vulnerabilities
    - CVE ID
    - Level of severity (rated under the CVSS)
    - Details of countermeasures
    - Information about the reporter (if the reporter agrees)
    - Contact for inquiries
- Method of providing the YSAR
    The Yokogawa Group will provide the YSAR in the following manners.
    - Disclosure on the Yokogawa Group website
      https://www.yokogawa.com/library/resources/white-papers/yokogawa-security-advisory-report-list/
    - Provision of information in accordance with maintenance service agreements for individual products
- Timing of provision of the YSAR
    In principal, the Yokogawa Group will provide the information after it becomes ready to provide the remediation.However, it will consider offering information at the time it becomes ready to provide the workaround in a case where it is necessary to swiftly offer information to customers, such as cases where attacks exploiting the vulnerabilities have been already observed.

 

5. CVE ID

The Yokogawa Group can assign CVE IDs to vulnerabilities for our products as a CVE Numbering Authority (CNA)(*5).

 

---

(*1) Organizations that accepts and publishes vulnerabilities information and that gives alert, such as JPCERT/CC, CERT/CC and CISA
(*2) https://www.yokogawa.com/solutions/products-platforms/
(*3) A concept that the discoverer who discovered new vulnerabilities first discloses directly to the vendor or CERT organizations privately, then make the vendor prepare the countermeasures before the vulnerability information disclosure. It means each stakeholder cooperates to make a profit of product users a primary consideration.
Reference: https://blogs.technet.microsoft.com/msrc/2010/07/22/announcing-coordinated-vulnerability-disclosure/
(*4) A system of evaluation under which the level of severity of vulnerabilities is indicated on the scale from 0.0 to 10.0
Reference: Common Vulnerability Scoring System  https://www.first.org/cvss/
(*5) CVE
https://www.cve.org/About/Overview

---

 

Contact for Inquiries

For inquiries concerning the handling of vulnerabilities, please contact us at the following address.
https://contact.yokogawa.com/cs/gw?c-id=000498

 

Revision History

November 20, 2018: Established
October 25, 2023: Added "5. CVE ID"