Department of Energy
Southwestern Power Administration One West Third Street
Tulsa, Oklahoma 74103-3502
Vulnerability Disclosure Policy
Southwestern Power Administration 03/01/2021
Introduction
Southwestern Power Administration (Southwestern) is committed to ensuring the security of the American public by protecting the public’s information. The Vulnerability Disclosure Policy (VDP) is intended to give security researchers clear guidelines for conducting vulnerability discovery activities and to convey Southwestern’s preferences in how to submit discovered vulnerabilities.
Southwestern’s VDP describes: (1) what systems and types of research are covered; (2) how to send Southwestern vulnerability reports; (3) and how long Southwestern asks security researchers to wait before publicly disclosing vulnerabilities.
Southwestern encourages researchers to contact us to report potential vulnerabilities in our systems.
Authorization
Good faith efforts to comply with the VDP during security research will be considered to be authorized. In the context of the VDP, “good faith” means security research conducted with the intent to follow the VDP without malicious motive. Southwestern may evaluate a researcher’s intent on multiple bases, including by the researcher’s actions, statements, and the results of the researcher’s actions.
Good faith security research is considered to be accessing a computer or software solely for purpose of testing or investigating a security flaw or vulnerability and disclosing those findings in alignment with the VDP. A researcher’s actions should be consistent with an attempt to improve security and to avoid doing harm, either by unwarranted invasions of privacy or causing damage to property.
Southwestern will work with researchers to understand and resolve issues identified during the course of researcher’s good faith efforts and will not recommend or pursue legal action related to the research. Should legal action be initiated by a third party against a researcher for activities that were conducted in accordance with this VDP, Southwestern will make this authorization known.
Guidelines
Under this VDP, “research” means activities in which the researcher:
· Notifies Southwestern as soon as possible after a real or potential security issue is discovered.
· Makes every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.
· Only uses exploits to the extent necessary to confirm a vulnerability’s presence and does not use an exploit to compromise or exfiltrate data, establish persistent command line access, or pivot to other systems.
· Provides Southwestern a reasonable amount of time to resolve issues before disclosing them publicly.
· Does not submit a high volume of low-quality reports.
Once a researcher has established that a vulnerability exists or encounters any sensitive data (including personally identifiable information, financial information, or proprietary information/trade secrets of any party), the researcher must stop their test, notify Southwestern immediately, and refrain from disclosing the discovered data to any other party.
Test methods
The following test methods are not authorized:
· Network denial of service (DoS or DDoS) tests or other tests that impair access to or damage a system or data.
· Physical testing (e.g., office access, open doors, tailgating), social engineering (e.g., phishing, vishing), or any other non-technical vulnerability testing.
Before the start of any testing, the researcher should provide the following information to the Southwestern VDP team at VDP@swpa.gov:
· Dates/Times of testing
· The IP address(es) that will be used for testing.
· What assets will be tested (see scope below)
Providing this information beforehand will ensure any benign testing is not treated as a cyber security incident by Southwestern.
Scope
This policy applies to the following systems and services:
· swpa.gov services, including the following hostnames:
o svpn.swpa.gov
o tvpn.swpa.gov
o nvpn.swpa.gov
o titan.swpa.gov
o hyperion.swpa.gov
Any service not expressly listed above, such as any connected services, are excluded from scope and ARE NOT AUTHORIZED for testing. Additionally, vulnerabilities found in systems from Southwestern’s vendors fall outside of the scope of this VDP and should be reported directly to the vendor according to the vendor’s disclosure policy (if applicable). If a researcher is unsure whether a system is in scope, the researcher should contact Southwestern’s VDP team at VDP@swpa.gov before starting the research.
Though Southwestern develops and maintains other internet-accessible systems or services, we ask that active research and testing only be conducted on the systems and services covered by the scope of this VDP. If there is a particular system not in scope that a researcher thinks merits testing, please contact Southwestern to discuss it first. Southwestern reserves the right to increase or decrease the scope of this VDP at any time.
Reporting a vulnerability
Information submitted under this VDP will be used for defensive purposes only – to mitigate or remediate vulnerabilities. If a researcher’s findings include newly discovered vulnerabilities that affect all users of a product or service and not solely Southwestern, we may share your report with the Cybersecurity and Infrastructure Security Agency, where it will be handled under their coordinated vulnerability disclosure process. Southwestern will not share your name or contact information without express permission.