1. Introduction
The security of Tierra S.p.A.’s products and services is a priority. No product is immune to vulnerabilities: for this reason, Tierra welcomes reports from anyone who identifies a possible security issue and wishes to communicate it responsibly.
This policy describes how to report a vulnerability to Tierra, what the reporter can expect in response, and the rules to be followed. We invite you to read it in full before submitting a report and to always act in compliance with its provisions.
2. Scope
This policy covers security vulnerabilities affecting:
- telematic devices and related firmware produced by Tierra;
- Tierra’s telematic platform and cloud services;
- Tierra’s websites and web services.
Vulnerabilities in third-party components integrated into Tierra’s products or services are included within the scope, limited to their presence in such products or services.
The following are indicatively out of scope: denial-of-service attacks; social engineering against Tierra personnel or customers; physical attacks; reports generated solely by automated tools without demonstration of a concrete impact; purely theoretical vulnerabilities without proof of concept; third-party products and services not managed by Tierra.
3. How to report a vulnerability
Reporting channel: security@tierratelematics.com
The updated reporting details are also published in Tierra’s security.txt file, at https://www.tierratelematics.com/.well-known/security.txt. For reports containing sensitive information, a public key for encrypted communication is available and indicated in the same file.
Tierra accepts anonymous reports; providing contact details is optional, but useful for any clarifications. Each report received is assigned a unique reference that allows both parties to track its status.
To allow a quick and accurate assessment, the report should include:
- Affected product or service — product name, web address, or IP address where the vulnerability can be observed (mandatory);
- Title — a concise title of the vulnerability (mandatory);
- Description — summary of the issue, steps to reproduce it in a benign and non-destructive manner, any supporting files, and possible mitigations (mandatory);
- Impact — what an attacker could achieve by exploiting the vulnerability (mandatory);
- type of weakness (e.g., CWE) and estimated severity (e.g., CVSS score) (optional);
- reporter’s contact details — name and e-mail address (optional).
4. What to expect from Tierra
Tierra undertakes to:
- acknowledge receipt of the report within 5 working days;
- complete an initial assessment (triage) within 10 working days, establishing whether the vulnerability is confirmed and its severity;
- keep the reporter informed of progress, with periodic updates for longer-running activities;
- inform the reporter once the issue has been resolved; the reporter may, if they wish, verify the effectiveness of the correction.
Resolution times depend on the severity and complexity of the vulnerability; as a rule, Tierra aims to make a corrective or mitigation measure available within 90 days from confirmation.
5. Coordinated disclosure
Tierra adopts a coordinated disclosure approach. We ask the reporter to:
- not publicly disclose the vulnerability before a fix is available or before a date agreed with Tierra;
- coordinate any publication with Tierra, so as to provide users with consistent and accurate information.
Once the vulnerability has been resolved, Tierra normally publishes a security advisory intended for users and stakeholders. If the vulnerability concerns a third-party component, Tierra may securely share the relevant information with the component supplier, solely for resolution purposes.
Tierra may also be required, pursuant to legal obligations, to notify certain vulnerabilities to the competent authorities.
6. Acknowledgement
Tierra does not offer financial rewards for reports. Upon the reporter’s request, and subject to agreement on the content, Tierra is pleased to publicly acknowledge their contribution, for example in the security advisory relating to the resolved vulnerability.
7. Rules of conduct and protection of the reporter
When conducting research and submitting a report, the reporter must not:
- violate applicable laws or regulations;
- access data to an extent beyond what is strictly necessary to demonstrate the vulnerability, or modify or delete data;
- use invasive or destructive scanning tools;
- attempt or carry out denial-of-service attacks;
- interrupt or degrade Tierra’s services and systems;
- disclose information about the vulnerability to third parties in breach of section 5.
Provided that the research is conducted in good faith and in compliance with this policy, Tierra considers such activity authorized and welcome, and will not initiate or support legal action against the reporter in relation to the report made. This protection does not derogate from third-party rights or mandatory legal obligations.
8. Review and contacts
This policy is reviewed at least annually and updated according to regulatory and operational developments. For any questions about the policy: security@tierratelematics.com
