KORE Responsible Disclosure Policy

Introduction

If you have discovered a vulnerability in a system, network, or application of the KORE Group (which includes the parent entity and all affiliates and subsidiaries), we would like to know about it so we can take appropriate action to remediate the issue as soon as possible. We will outline the rules of engagement below, which both KORE and you must follow. 

Policy

At KORE we take information security very seriously. We understand no system can ever be fully secure and therefore we always keep in mind that vulnerabilities may exist in our systems. Because we consider the confidentiality and integrity of our customer information a top priority, we would like you to notify us in case a vulnerability has been identified within our systems.

Our Responsible Disclosure Policy consists of a set of rules that both KORE and the person reporting the vulnerability should adhere to. Please note that KORE does not have a so-called “bug bounty program” by which it may provide (high amounts of) financial rewards to the identifier of a vulnerability.

What will KORE do?

• We will always investigate and respond to every notification.
• We will respond to a notification within 3 working days and we will treat the finder’s personal information as confidential.
• If we confirm the existence of a vulnerability, then we will keep the finder informed about the reasonable timeframe within which we wish to resolve the issue.
• If we decide to make the vulnerability public, then we will consult the person who found the vulnerability. We will provide public recognition to the finder if the finder appreciates this.
• If this policy is adhered to, then KORE will refrain from reporting (attempted) hacking activities to the police.

What we require of you

• You will report the identified vulnerability exclusively to KORE and therefore not to any 3rd party.
• Your report should contain as much information as possible to enable the identification of the vulnerability. This information includes, among others: IP-Addresses, Log files, URLs, timestamps, screenshots, etc.
• You will see to it that your actions during and after the process of identifying vulnerabilities will all be made in good faith, meaning you will:
• Not use or exploit the vulnerability for any other purpose than to verify the existence of the vulnerability;
• Not copy, change, move or remove any information from the relevant system;
• Will not make any changes to the relevant system itself; and
• Will not, in any way or form, provide or help provide access to the relevant system.
• The finder may report the identified vulnerability anonymously. However, for the purposes of follow-up communication, we will need a valid email address of yours.

How to report?

To be able to report an identified vulnerability in any of our systems to us, you should contact security@korewireless.com. To safeguard the confidentiality and integrity of the information we would like you to encrypt the information. Our public key is listed below or can be retrieved from usual PGP key servers. Our key ID is 1BAF317C, 4096 bits RSA, created on 2019-05-03, expires 2027-07-02, with key fingerprint:

The easiest way to retrieve our key:

Below is our public key:

When you do not adhere to the rules of engagement

In case you hack one of our systems and you do not adhere to the rules of engagement as outlined in this procedure, then KORE will always report the incident to the Police.