Aspose Vulnerability Management Policy

Last updated: 11 December 2024

Introduction

Aspose Pty Ltd (Aspose) is a market-leading software development company that offers award-winning APIs for creating, editing, converting, and rendering various file formats such as Office, OpenOffice, PDF, Images, ZIP, CAD, XPS, EPS, and PSD. Our APIs support multiple platforms, including .NET, Java, C++, Python, PHP, Xamarin, and Android, along with reporting solutions for Microsoft SharePoint and rendering extensions for SQL Server Reporting Services and JasperReports.

Aspose follows a comprehensive vulnerability management strategy to protect its software products and services. This policy defines the roles, responsibilities, and standards for identifying, assessing, managing, and remediating vulnerabilities across all Aspose products. It establishes protocols that all Aspose personnel involved in software development, testing, and deployment must adhere to, supporting a proactive and systematic approach to risk management.

1. Purpose

The purpose of this policy is to establish a structured and effective approach to managing vulnerabilities within Aspose’s software products. This policy aims to ensure timely identification, assessment, and mitigation of security risks, safeguarding the security and integrity of Aspose’s offerings and protecting customers’ data and privacy.

2. Scope

This policy applies to all software products and services developed, tested, or deployed by Aspose. It covers Aspose employees, contractors, and partners involved in any aspect of software development, testing, or deployment, including protocols for vulnerability identification, assessment, remediation, and reporting.

3. Roles and Responsibilities

3.1. IT Infrastructure and Security Team

Responsible for monitoring, assessing, and managing vulnerabilities in Aspose products. This includes tracking identified issues, ensuring timely remediation, and coordinating the release of security patches.

3.2. Development Teams

Responsible for following secure coding standards, fixing vulnerabilities identified in their code, and collaborating with QA to test these fixes.

3.3. Quality Assurance (QA) Team

Responsible for testing patches and updates for known vulnerabilities and verifying that security standards are met before release.

3.4. Sales Team and Technical Support Team

Acts as the first point of contact for customer-reported vulnerabilities, alerts the relevant teams, and ensures that vulnerabilities are resolved in a timely manner. Communicates vulnerability resolution status to customers when necessary.

3.5. Executive Management

  • Approve and oversee the implementation of the policies.
  • Allocate resources to support security initiatives, training, and technology upgrades.
  • Promote a culture of security awareness and accountability across the organization.

4. Vulnerability Identification and Assessment

Vulnerability Scanning: Aspose uses automated vulnerability scanning tools, specifically SONARQube, for each software release (monthly) to assess code for OWASP Top 10, SANS Top 25, and CWE security issues.

Code Review: All code is subject to regular code reviews and secure coding practices to minimize potential vulnerabilities. Code is analyzed against OWASP and SANS standards.

Third-Party Vulnerabilities: Aspose products may include third-party components, primarily native C++ libraries ported to C#. Customer-reported issues with these third-party components are reviewed and assessed, though they may sometimes trigger false positives in scanning tools.

5. Vulnerability Prioritization and Risk Assessment

Severity Rating: Vulnerabilities are classified as Critical, High, Medium, or Low based on their impact and exploitability. Critical vulnerabilities are prioritized for immediate action and patching.

Risk Assessment: Vulnerabilities are assessed based on risk factors, including potential impact on product security, data protection, and customer safety. This prioritization informs the remediation process and timelines.

6. Remediation and Mitigation

Patch Development and Testing: For critical issues, patches are developed and tested by the Development and QA teams. Patches for critical issues are released as quickly as possible, either as hotfixes or as part of the next scheduled release.

Update Distribution: Updates and patches are distributed via NuGet, PyPI, NPM, Packagist, and Aspose’s official website. Customers are informed about updates through release notes and direct download links.

Temporary Mitigations: If immediate patching is not feasible, temporary mitigation measures are implemented, such as advising customers on configuration changes or security practices until a patch is available.

7. Third-Party Library and Dependency Management

Dependency Inventory: Aspose maintains a list of all third-party components in its products. This list is regularly reviewed to ensure prompt updates for any known vulnerabilities.

Customer Reports: Issues reported by customers, especially those using Red or BlackDuck scanners, are reviewed and addressed as needed to correct misidentified vulnerabilities.

8. Remote Access Security and Endpoint Management

Endpoint Security: All employees working remotely must ensure that their devices are secure, with up-to-date antivirus protection, operating system updates, and firewalls enabled.

Secure Access: Access to Aspose’s systems requires multi-factor authentication and secure VPN connections to prevent unauthorized access to source code or sensitive information.

9. Incident Response and Vulnerability Disclosure

Incident Response: In case of a vulnerability being actively exploited, the incident response process is initiated, and the vulnerability is addressed as a critical priority. All affected customers are notified as needed.

Vulnerability Disclosure: Aspose discloses all fixed vulnerabilities in the release notes associated with each release, ensuring transparency with customers and stakeholders.

10. Monitoring, Reporting, and Documentation

Ongoing Monitoring: Continuous monitoring for potential vulnerabilities is conducted through SONARQube and regular review against industry standards.

External Monitoring: Aspose subscribes to market leading security reporting websites such as nvd.nist.gov and cvs.mitre.org.

Internal Reporting: For any detected vulnerabilities, a ticket is created and prioritized within the development team. Status updates are documented and tracked. For Critical issues, a company wide notification will be made.

Customer Reporting: Blog posts sharing the issues and resolutions in detail. Our Customer Support Forums where we will also share the issues and resolutions. Release notes, made available to customers, contain details of resolved vulnerabilities for each new release. This documentation ensures that customers are informed about security improvements and updates.

Direct Customer Contact: For Critical issues, Aspose will endeavor to contact customers directly to alert them to the need for potential action.

Aspose is committed to complying with all applicable legal, regulatory, and industry requirements related to this policy. Where specific regulations or standards apply, Aspose will ensure alignment to protect customer data, meet business obligations, and maintain operational integrity.

11.1. Compliance Principles

  • Adherence: Aspose follows all relevant legal and regulatory requirements applicable to its operations and systems.
  • Alignment with Standards: While Aspose may not hold formal certifications, it aligns its practices with recognized industry frameworks and best practices to ensure compliance.

11.2. Ongoing Compliance Monitoring

Aspose regularly reviews its internal processes, policies, and product offerings to ensure ongoing compliance with relevant laws and industry standards.

Compliance audits and reviews are conducted periodically to ensure the effectiveness of security and privacy controls.

12. Employee Training and Security Awareness

Aspose ensures that all employees are well-prepared to identify, report, and address vulnerabilities across its products. Training programs are designed to support a proactive and security-conscious approach to vulnerability management.

12.1. Security Training Programs

  • Onboarding Training: All new employees are introduced to the principles of vulnerability management, including secure coding practices, identifying potential risks, and reporting procedures.
  • Ongoing Awareness: Regular sessions and updates ensure employees remain informed about vulnerability-related processes, emerging security risks, and mitigation strategies.

12.2. Security Role-Specific Training

Certain employees in key roles receive specialized training to fulfill their responsibilities effectively:

  • Developers: Training on secure coding practices and vulnerability remediation using guidelines such as OWASP.
  • Quality Assurance (QA) Team: Training to test and validate patches, identify vulnerabilities, and ensure secure release processes.
  • IT Infrastructure and Security Team: Advanced training on vulnerability scanning tools (e.g., SONARQube), risk prioritization, and incident response processes.
  • Sales Team and Technical Support Team: Guidance on identifying and reporting customer-reported vulnerabilities and escalating them to relevant teams.

12.3. Vulnerability-Conscious Culture

Aspose fosters a culture where vulnerability management is a shared responsibility. This includes:

  • Regular communication on the importance of identifying and addressing vulnerabilities.
  • Encouraging employees to report potential issues promptly through clear, secure reporting channels.
  • Reinforcing leadership’s commitment to secure software development and vulnerability mitigation.

12.4. Continuous Improvement

Employee feedback on training programs is actively encouraged to ensure relevance and effectiveness.

Post-Incident Debriefing: Following vulnerability-related incidents, teams participate in debriefing sessions to analyze root causes and identify improvements in training or processes.

13. Policy Compliance and Enforcement

To ensure the effectiveness of vulnerability management, compliance with this policy is mandatory for all employees, contractors, and third-party partners.

13.1. Vulnerability Management Policy Compliance

Mandatory Adherence: All personnel must follow the Vulnerability Management Policy, including timely identification, reporting, and remediation of vulnerabilities.

Policy Acknowledgment: Employees must formally acknowledge their responsibilities regarding vulnerability management upon onboarding and whenever significant policy updates occur.

Periodic Reviews and Updates: This policy will be reviewed regularly to ensure alignment with evolving industry standards, security threats, and business needs. Stakeholders will be notified of updates, and retraining will be conducted as needed.

13.2. Monitoring and Auditing

Vulnerability Reviews: Regular audits and assessments will ensure vulnerabilities are identified, prioritized, and remediated in line with the policy.

Automated Monitoring: Automated tools, such as SONARQube and other vulnerability scanning solutions, continuously monitor code and systems for new vulnerabilities.

Self-Assessments: Development and IT teams are encouraged to regularly assess their processes and systems to identify potential gaps and ensure adherence to secure coding practices.

13.3. Non-Compliance Consequences

Violation of Policy: Non-compliance with the Vulnerability Management Policy will result in disciplinary actions, including but not limited to:

  • Corrective Actions: Retraining, formal warnings, or additional oversight of development and patching processes.
  • Access Restrictions: Temporary or permanent restrictions on access to development tools and systems if misuse or negligence is identified.
  • Termination: Severe or repeated policy violations may result in termination of employment or contractual relationships..
  • Legal Action: Intentional negligence or failure to address critical vulnerabilities that result in breaches may lead to legal consequences.

13.4. Accountability and Enforcement

Incident Management: Vulnerability-related incidents will be managed following incident response protocols, including immediate containment, root cause analysis, and remediation. Unintentional violations due to lack of understanding will prioritize retraining.

Disciplinary Process: Team Leads and IT Security teams will investigate non-compliance incidents and determine appropriate corrective actions.

Escalation Procedures: Critical breaches, repeated non-compliance, or delays in addressing vulnerabilities will be escalated to senior management for review and further action.

13.5. Continuous Improvement

Feedback Loop: Aspose encourages feedback from employees and stakeholders to continuously enhance the Vulnerability Management Policy and associated processes. Regular reviews help identify gaps, improve vulnerability identification, and streamline remediation efforts.

Training and Awareness: Non-compliance due to a lack of understanding or awareness will be addressed through enhanced training programs and updated communication channels to ensure all employees are fully aware of their responsibilities under the policy.

14. Periodic Review and Policy Updates

Periodic Review: This Vulnerability Management Policy will be reviewed periodically or as required to address emerging threats, regulatory changes, or Aspose’s evolving operational needs. This ensures the policy remains aligned with current access control best practices and business requirements.

Policy Updates: Updates to the policy will be communicated to all employees, contractors, and relevant stakeholders. Any significant changes will be accompanied by training or guidance to ensure continued adherence to access control principles.

15. Approval

This Vulnerability Management Policy was approved by the Board of Directors of Aspose Pty Ltd on 2024.12.01.