Cybersecurity

Security Vulnerability Disclosure Policy

Policy 1

Security Vulnerability Response Centre (S-CERT)

Hanwha Vision’s S-CERT*1 department is a team dedicated to addressing security vulnerabilities in Hanwha Vision’s WISENET products and responding promptly (by analysing and preparing countermeasures) in the event of a security vulnerability.

If your product is experiencing symptoms of a security vulnerability, please contact S-CERT (secure.cctv@hanwha.com) with detailed product information and instructions on how to reproduce the symptoms.

※ S-CERT does not respond to requests related to homepage (https://www.hanwhavision.com/) vulnerability, product support and feature requests.

• S-CERT: Security-Computer Emergency Response Team

Policy 2

Security Vulnerability Response Process

Upon receipt of a security vulnerability report, a Security Breach Incident Response Council is convened immediately. Reporters of security vulnerabilities can expect an initial response within 2 business days, and a response regarding the manufacturer’s future actions and distribution plans related to the vulnerability within 10 business days.

Thereafter, until the reported case is closed, we will provide status updates whenever there is a change in progress, and in any case at least every 90 days, unless a different interval has been agreed with the reporter. We will notify the reporter of the outcome when the fix is completed or when the case is closed without remediation (e.g., determined not to be a vulnerability, or a decision not to remediate).

Firmware with improved vulnerabilities and vulnerability details will not be disclosed until 90 days from receipt or until a date mutually agreed upon with the informant. For transparent and efficient management of security vulnerabilities, starting in September 2023, Hanwha Vision is participating in the CVE programme as a CNA that can directly register and manage CVE vulnerabilities, and is operating a bug bounty programme for internal customers.

Policy 3

Security Vulnerability Notice Policy

The firmware with the vulnerability patch is uploaded to the website along with the Vulnerability Report.

Details of the vulnerability (vulnerability content, affected product information/firmware version, risk, countermeasures, etc.) are not disclosed until the patched firmware is released on the website to prevent zero-day attacks.

Information such as attack scenarios for the vulnerabilities is not disclosed to prevent imitation attacks.
If multiple products are affected by the vulnerability, the corresponding firmware patches will be released simultaneously.