Security

RFC 2350 Information about the Security Team

1 Document Information

1.1 Date of Last Update

September 11, 2024

1.2 Distribution List for Notifications

1.2.1 Advisories
Advisories are published in the CONTACT Community at the following address: https://community.contact-software.com/c/news-and-announcements/security/
You may register for e-mail notification within the forum software, to notice any new advisories.

1.3 Locations where this Document May Be Found

This document can be downloaded via HTTPS from the CONTACT Software GmbH homepage: https://www.contact-software.com/en/security

2 Contact information

2.1 Name of the Team

CONTACT Software Security Team

2.2 Address

Physical deliveries can be addressed to:

CONTACT Software GmbH
Security Team
Wiener Straße 1-3
28359 Bremen
GERMANY

2.3 Time Zone

The team operates in the timezone: Europe/Berlin Central European Time/Mitteleuropäische Zeit (CET/MEZ)
Usually accessible during typical business hours from Monday to Friday.

2.4 Telephone Number

The central office can be reached at: +49 421 20153-0
Ask to be put through to the security team.

2.5 Facsimile Number

Must not be used for security purposes, use email instead.

2.6 Other Telecommunication

None for security purposes.

2.7 Electronic Mail Address

security@contact-software.com

2.8 Public Keys and Encryption Information

The current public PGP can be fetched from the keyserver at https://keys.openpgp.org/ with the email address as listed in 2.7.
It is also listed here:

2.9 Team Members

No public information about team members is disclosed.

2.10 Points of Customer Contact

The preferred method for contacting the security team is via e-mail at <security@contact-software.com>. If it is not possible (or not advisable for security reasons) to use e-mail, the security team can be reached by telephone during regular office hours. The security teams' hours of operation are generally restricted to regular business hours (09:00am – 05:00pm, Monday to Friday except holidays).

3 Charter

3.1 Mission Statement

The purpose of the security team is, first, to help improve the security of the products made by CONTACT Software GmbH, and second to assist customers and partners in responding to incidents or vulnerabilities related to CONTACT Software GmbH products.

3.2 Constituency

The security team provides its services to the following groups. The amount of services varies by group and may be subject to support contracts.

Employees (especially development and support related) at CONTACT Software
Customers using CONTACT Software products
Partners of CONTACT Software

Topics relating to general operations, the web site or other security related topics relating to CONTACT Software GmbH may be handled on case by case judgement. Usually those will be forwarded to the responsible persons and not handled by the security team itself.

3.3 Sponsorship and/or Affiliation

The security team is affiliated to the software development (SD) department of CONTACT Software GmbH.

3.4 Authority

The security team has authority over the software development and release process at CONTACT Software GmbH.
It has NO authority over the deployed systems at customer sites and can only act in advising mode for those. It has also NO authority over the products based on CONTACT Software GmbH products but distributed and marketed by partners. It also has NO direct authority over the website or most other operational services used by CONTACT Software GmbH.

4 Policies

4.1 Types of Incidents and Level of Support

The focus of the security team on the product part instead of the operation of a deployed system reflects in the types of incidents handled and the support provided.
The security team will provide support for the following incidents and topics. The amount of support varies by topic and involved parties and may be subject to support contracts.

Handle reporting of vulnerabilities in CONTACT Software GmbH products
Handle the disclosure process for vulnerabilities and patches
Provide consulting support for teams inside CONTACT Software GmbH
Provide tools and documentation about security topics
Provide advice or assistance to customers CSIRT teams when resolving incidents related or involving CONTACT Software GmbH products
Provide limited consulting support for customers regarding secure deployment or operations practices of CONTACT Software GmbH products
Provide consulting support for partners for security topics related to CONTACT Software GmbH products

4.2 Co-operation, Interaction and Disclosure of Information

CONTACT Software GmbH Security Team regards cooperation and information sharing with other CERT/CSIRTs. Information is only passed depending on its classification and need-to-know basis unless we are required to by law. CONTACT Software GmbH Security Team supports responsible disclosure methodology (see OWASP Vulnerability Disclosure Cheat Sheet) with a usual timeframe of 30 days for security patches which might be extended to 90 days if needed.

4.3 Communication and Authentication

When using email communication via the security@contact-software.com mailing address, the messages will be signed with the security teams pgp key as listed in section 2.8. The current key may be retrieved from the keyservers at https://keys.openpgp.org/. All sensitive communication to CONTACT Software GmbH Security Team should be encrypted with our public PGP key. Senders should sign their messages if possible.

5 Services

5.1 Incident Response

All incidents related to **products** of CONTACT Software GmbH will be evaluated. Incidents related to CONTACT Software GmbH services/other topics will be forwarded to the responsible business units. Senders are encouraged to use typical points of contact (if known) for those interactions as CONTACT Software Security Team is only a fallback for operational concerns. If necessary in-depth analysis is provided by technical experts.

5.1.1 Incident Triage

Incoming incident reports are evaluated, priorized and compared to ongoing incidents.
Incidents are:
– checked whether they are comprehensible using given information
– classified with a severity and scope

5.1.2 Incident Coordination

Incident related information objects (e.g. logfiles, ...) will be classified with respect to information disclosure policy.
All other involved internal and external parties will be notified on a need-to-know basis respecting our information disclosure policy unless we are required to by law.

5.1.3 Incident Resolution

The cause of the incident will be determined and its effects will be mitigated.
Possibly analysis of compromised systems.

5.2 Proactive Activities

Security Trainings for CONTACT Employees
Security Reviews in the secure (product) development lifecycle (SDL)
Secure Deployment Guides / Best practise guides
Development of security configuration tools
Introduction of new security requirements into product roadmap
Publication of Security Advisories
In-House Penetration testing & investigation of penetration testing results of customers
Continuous Integration / Continuous Deployment with static code analysis
Post-Mortem analysis to learn from the past

6 Incident Reporting Forms

No special incident reporting form is necessary. Please use the email address listed in section 2.7. Please include the following information with your reports.

Contact Details
name of person
name and address of organization
email address, telephone number, pgp key information if available
Short summary of the incident
Systems affected:
– Product Names and Versions involved
– Additional information
– Details of observations that led to discovery (i.e. logfiles, screenshots, etc.)

If possible please sign your message with your PGP private key, to establish a secure communications channel.

7 Disclaimers

While every precaution will be taken in the preparation of information, notifications and alerts, CONTACT Software GmbH assumes no responsibility for errors or omissions, or for damages resulting from the use of the information contained within.