Security Advisories

Content on this page

Vulnerability Disclosure Policy

PSIRT

Optima's Product Security Incident Response Team (PSIRT) is responsible for responding to reported vulnerabilities and security incidents related to the machinery and other digital products sold by Optima. The PSIRT is an overarching team that manages the receipt, investigation, assessment, treatment and public disclosure of information about security vulnerabilities and incidents related to the digital products.

Product security incident response procedure

The following steps illustrate the general PSIRT process at Optima and provide an overview of the vulnerability lifecycle, disclosure, and resolution process.

Vulnerability Capture
PSIRT receives reports about vulnerabilities and security incidents.
Vulnerability Analysis
PSIRT examines the facts of the case and assesses the criticality and impact.
Vulnerability Mitigation
PSIRT coordinates the mitigation measures involving the relevant experts.
Communication of Security Advisories
PSIRT defines Security Advisories as well as communication plan, and notifies customers and public authorities.

Report a security issue

Report a suspected security vulnerability or request support

Anyone can submit information about potential security vulnerabilities to the Optima PSIRT via e-mail. Whether you are a customer or anybody else, we kindly ask you to inform us of any security vulnerabilities discovered.

Please contact the Optima PSIRT via e-mail:

data-security@optima-packaging.com

To work with us on vulnerability disclosure, you don't need a non-disclosure agreement (NDA) or any other contract. Our goal is to work professionally with vulnerability reporters in dealing with any suspected vulnerabilities related to Optima products.
We greatly appreciate coordinated vulnerability reports from members of the security community, whether from business partners, CERTs, security researchers, or other sources. We ask you to coordinate the disclosure of information with us beforehand. This is to prevent this information from being released until our development teams have created an appropriate action to fix or mitigate the vulnerability.

Please provide us with the following information in your email to speed up the process:

Reporter's name: If you wish to remain anonymous, we will respect your interests.
Contact details: E-mail address and phone number at which we can reach you.
Affiliation: What is your organization affiliation (if any)?
Type of the vulnerability: How do you describe the nature of the vulnerability?
Vulnerability triggers: Can you provide malicious code that can be used to prove that the vulnerability was triggered? Alternatively, you can also submit network traces (e.g. pcaps) or a description of how the vulnerability could be triggered.
Impact of the vulnerability: Have you observed any effects that arise or are caused by the security gap?
Affected products: In which products, solutions or services did you find the vulnerability? Please include all the information available to you, such as product family and group, firmware or software version. For services, enter the respective location (e.g. URL).
Vulnerability confidentiality: Has the vulnerability already been disclosed or do you have specific plans for disclosure?

Please note that only e-mails in English or German can be processed.

The Optima PSIRT generally acknowledges receipt of new vulnerability reports within two business days.

We cordially thank all reporters for their efforts to work with us to improve the security situation. However, Optima does not provide compensation for disclosed security vulnerabilities.

Optima Security Advisories

We investigate all reports of security issues reported to us and publish security advisories on validated security vulnerabilities that affect our products and require an update, upgrade, or other action.

The publication of Optima Security Advisories (OSA) takes place within the myOPTIMA portal:

myoptima.optima-group.services

The Optima Security Advisories are presented by means of the standardized CSAF format (Common Security Advisory Framework).

Download the content of this page as PDF:

Vulnerability Disclosure Policy security.txt