Product Security and PSTI Compliance

Weak passwords like ‘Admin 123’ that can be guessed or easily compromised are banned. Compliant products must have a unique password to be legally sold or made available as part of a service in the UK. This applies to both new and refurbished products placed on the market and devices made available as part of a solution or service, such as a Managed Print Service.

The regulations force manufacturers to take responsibility to maintain the products they sell by requiring them to publish a Vulnerability Disclosure Policy. Manufacturers will need to identify and flag any product security vulnerabilities and provide a mechanism for third parties to report identified risks.

The regulations require the minimum length of time that products will be supported with security updates to be published. This will help inform purchasing decisions.

All products made available to the market must be accompanied by a statement of compliance.

Further details on PSTI and how it could affect UTAX devices and those selling them, can be found here.

Once a vulnerability is discovered, UTAX focuses on responding promptly and appropriately, including responding to customers based on security vulnerability information. PSIRT (*1) generally proceeds in the following four steps: (1) gathering and sharing security vulnerability information, (2) investigating security issues and analysing their impact on our products, (3) taking security measures against vulnerabilities, and (4) announcing to the public.

(1) Gathering and sharing security vulnerability information

UTAX checks security information using official open databases of vulnerability information such as CVE, JPCERT and gathers security information from the press, such as newspapers and the Internet. More information is also provided by contacting the customer’s nearest sales company or by inter-office members.

CVE: Common Vulnerabilities and Exposures JPCERT: Japan Computer Emergency Response Team

(2) Investigating security issues and analysing their impact on our products

We investigate and analyse the phenomenon’s effects when a vulnerability is exploited and the difficulty and conditions when a malicious attacker tries to exploit a vulnerability.

(3) Taking security measures against vulnerabilities

After the investigation and analysis, if the results indicate that there is an impact, the development division continues to prepare technical and operational measures, such as applying security patches.

(4) Announcing to the public

We announce our security measures on the UTAX website, the PSIRT contact window, sales companies, or a service person.

We value dialogue with vulnerability reporters, handle reported vulnerability information in good faith, and fulfil our responsibility by disclosing vulnerability information in a timely and appropriate manner.

Circumstances

The Vulnerability Disclosure Policy is applied to include the following circumstances:

A potential vulnerability affecting products is disclosed to the public.

A potential vulnerability existing in products is reported by an external third party.

A vulnerability impacting released products is discovered internally.

Vulnerability Handling Scope

UTAX considers any individual issues caused by including some weakness in coding or configuration that leads to your vulnerable design are not our vulnerability. We value vulnerability information submitted by reporters. However, whether the reported vulnerability information applies to the vulnerability handling scope will be determined by UTAX PSIRT.

We encourage you to report vulnerability information that can provide us with significant information that helps improve the security of products for customers. Before submission of a vulnerability report, please read this Vulnerability Disclosure Policy thoroughly and follow the process described in the following section (i.e., What to expect) in compliance with this policy. Please also note that we do not have a bug bounty program, so you cannot request monetary compensation based upon acknowledgment of the reported vulnerability.

Contact

If a vulnerability is discovered in our products, submit your vulnerability report using the reporting form below. However, if you do not wish to directly contact UTAX, we recommend submitting your report through the Coordination Centre in your country (i.e., CERT/CC) (*2).

Content

If possible, please submit your report containing the following detailed information:

Reporter’s name and contact information

Name of the product that contains the potential vulnerability

The product version that contains the potential vulnerability

Type of the potential vulnerability (e.g., Information Disclosure, Privilege Escalation, Remote Code Execution, etc.)

Impact of the potential vulnerability

Steps in the specific and detailed process to reproduce the potential vulnerability

The circumstance that an attacker requires to exploit the vulnerability

Proof-of-concept code

Public, third-party reports of vulnerabilities (i.e., references)

Date when you have discovered the vulnerability

Others, additional information

^{(*2) The Coordination Center coordinates incident response related to stakeholders in your country in the event of an incident.}

After a vulnerability is reported to UTAX PSIRT, we acknowledge receipt of the vulnerability report. We handle the process according to the following phases:

Receipt

In the receipt phase, a vulnerability reporter receives acknowledgement within 3 of our working days. The next correspondence is determined upon completion of our initial investigation. We will keep you informed of our vulnerability analysis status.

Verification

In the verification phase, we need to confirm with the respective development divisions for any reported vulnerability. We investigate and analyse the phenomenon’s effects when a vulnerability is exploited and the difficulty and conditions when a vulnerability is exploited. We ask that you provide us with a reasonable amount of time (at least 90 days from the acknowledgement) to resolve the issue before you disclose it publicly.

Remediation

In the remediation phase, the respective development divisions complete vulnerability analysis, such as the vulnerability’s potential impact on our products, possible effects when the vulnerability is exploited, and the difficulty and conditions when a malicious attacker attempts to exploit the vulnerability and validate software remediation, mitigation, and workaround. Based upon the results, the timeline will be determined so we can take temporary and permanent security measures, respectively. If a vulnerability significantly impacts the global markets and takes time to remediate, alternative mitigation measures will be offered to customers. We will provide customers with adequate security measures as soon as possible and be as transparent as possible about the steps we take during the remediation process, including on issues or challenges that may delay resolution. We will communicate closely with the vulnerability reporter.

Publication

We are responsible for the appropriate disclosure of vulnerability information and extend the same responsibility to reporters. If UTAX PSIRT determines that the vulnerability information is critical to customers, like when there is a possibility of personal information leaks, we will publish security-related information (i.e., the advisory) on our security page of the UTAX company global website and UTAX Group company website in your country. For any public release, please coordinate with UTAX PSIRT or Computer Emergency Response Team Coordination Center (CERT/CC) (in case you contact CERT/CC in your country). Note that we create the disclosure contents based on the coordination.

You must not:

Violate laws/regulations/standards enacted in respective countries/regions.

Share or re-distribute any data obtained through our products to third parties.

Submit the report by using a product obtained improperly through a malicious person.

Attempt to contact us utilizing vulnerable communication.

Report any vulnerabilities related to Denial of Services (DoS or DDoS).

Submit the report on products that are not brought in line with best practices.

Submit the report on TLS configuration weaknesses e.g., TLS1.0 support.

Use social engineering attacks.

Demand monetary compensation to disclose any vulnerabilities.

You must:

Be compliant with all relevant laws/acts, standards, data protection, and privacy laws.

Securely delete all data used during your vulnerability investigation/analysis/research as soon as it is no longer required (*3).

^{(*3) Reference: Article 17 General Data Protection Regulation (GDPR) Right to erasure (‘right to be forgotten’)}

UTAX does not claim any ownership rights to the information included in the reported Vulnerability Disclosure under this Policy, including, but not limited to, any data, text, material, program code, suggestion and recommendation received from the reporter (“Reported Vulnerability Information”).

By providing any Reported Vulnerability Information to UTAX, the reporter

grants us the following non-exclusive, irrevocable, perpetual, royalty-free, worldwide, sub-licensable license to the intellectual property in the Reported Vulnerability Information:

to use, review, assess, test, and otherwise analyse the Reported Vulnerability Information; and

to reproduce, modify, distribute, display and perform publicly, and commercialize and create derivative works of the Reported Vulnerability Information and all its content, in whole or in part, for the purpose of fixing the reported vulnerabilities, improving Products, and marketing, sale and promotion of such improved Products;

agrees to sign any documentation that may be required for us or our designees to confirm the rights the reporter granted above;

understands and acknowledges that we may have developed or commissioned materials similar or identical to the Reported Vulnerability Information, and the reporter waives any claims or rights it may have resulting from any similarities to the Reported Vulnerability Information;

understands and acknowledges that it is not guaranteed any compensation or credit for Reported Vulnerability Information; and

represents and warrants that it hasn’t included any of personal data in Reported Vulnerability Information, it hasn’t used any information or intellectual property owned by a third party in violation of legal or contractual requirements, and that the reporter has the legal right to provide the Reported Vulnerability Information to us subject to this Policy.