Pentest Library: Our articles and papers

White Paper

You want to know more about our services and our approach in detail? In our white paper, you will find an in-depth description of how we will perform a test in your company, which tools we are going to use, and which circumstance are necessary in order to realize an efficient and successful security assessment. If you would like to receive our white paper in print, do not hesitate to send an e-mail to info@syss.de, including your name and postal address.

SySS Responsible Disclosure Policy: Research and Responsibility

SySS GmbH deals with security issues in a responsible way. In the form of a security advisory, we report security vulnerabilities which are not in products of our customers and which are not excluded from public disclosure due to contractual agreements with vendors.

The security advisory contains detailed information about the found vulnerability that allows the vendor to reproduce and further investigate the reported security issue. Vulnerabilities will be disclosed to the public if a solution was published by the vendor or 45 days after the initial report by SySS GmbH, regardless of the vulnerability status, for example if there is a patch or workaround from the affected vendor. In well-founded, exceptional cases, this standard procedure may not be followed and an alternative, adjusted publication schedule will be negotiated with the vendor. 

The goal of our Responsible Disclosure Policy is, to weigh up the need of the public to know of security vulnerabilities against the vendor’s time to remedy all security issues effectively. The final publication schedule will be based on the best interests of the community overall, considering both positions. Prior to the responsible disclosure of a security vulnerability, SySS GmbH gives vendors the opportunity to analyze reported security issues, develop effective countermeasures, and test them thoroughly.