Product security

Biosite believes that the disclosure of vulnerabilities is essential for improving the quality of our products and services, safety of our customers that rely on them, and awareness as to their choices relative to preserving their specific interests. Biosite values insight from the security research community and welcomes disclosure and collaboration with this community.

Biosite values the insight and commitment of security researchers and other vulnerability investigators to make the world a safer place by discovering vulnerabilities of security solutions and providing mechanisms to privately report them with legitimacy and integrity.

Responsible disclosure ensures that security access infrastructure is tested and proven reliable. Moreover, the commitment to mitigate vulnerabilities is reassuring for our customers and the security industry as a whole.

The following is Biosite’s responsible disclosure policy:

• Biosite will disclose known vulnerabilities and their fixes to its customers in a manner that protects Biosite and its customers. Disclosures made by Biosite will include credit to the person who first identified the vulnerability, unless otherwise requested by the one who reported it.
• Biosite is open to communication and working with security researchers who come to Biosite with a shared interest to improve security and coordinate the distribution of information that includes both the vulnerability and the solution that addresses it.
• Biosite will publicly acknowledge in a written advisory the work of a security researcher who brings the company valid information about a vulnerability privately and then works with Biosite to coordinate the public announcement after a fix or patch has been developed and fully tested within a reasonable amount of time to be effective and deployed by Biosite and its customers.
• Security researchers are permitted to post a link to the Biosite advisory on their own web sites as recognition for minimising risks for the greater good and helping end-users protect themselves.

We ask the security researcher community to work with Biosite to coordinate the public disclosure of a vulnerability. Prematurely revealing a vulnerability publicly without first notifying Biosite could harm organisations, exposing sensitive information and putting people and organisations at risk of malicious attacks.

This is why Biosite strongly advocates a two-step process: first, private disclosure of a potential vulnerability to Biosite. Once the vulnerability is validated, resolved and Biosite and its customers provided a reasonable time to deploy, Biosite coordinates the public disclosure, which includes the recognition of the security researcher’s discovery, confirming that credit is given to the right person(s).

We also ask for researchers to recognise that our action to investigate, validate and remediate reported vulnerabilities varies based on complexity and severity. We will communicate expected timelines, changes and collaborate where possible. In addition, we request that researchers do not perform Denial of Service mechanisms, compromise Biosite user infrastructure or personal information.

Like other leading companies, Biosite applies industry best practices for coordinated disclosure of vulnerabilities to protect the security ecosystem, ensure that customers get the highest quality information, and drive public discourse about ways to improve products, protocols, methodologies, standards and solutions.

CALL TO ACTION

If you believe you have discovered a vulnerability, follow the reporting guidelies below.