Product Security

The goal of our Product Security Incident Response Team (PSIRT) is to minimize customers’ risk associated with security vulnerabilities by providing timely information, guidance and remediation of vulnerabilities in our products, including software and applications, hardware and devices, services and solutions. This team manages the receipt, investigation, internal coordination, remediation and disclosure of security vulnerability information related to Honeywell offerings. 

We take security concerns seriously and work to quickly evaluate and address them. Once a security concern is reported, we commit the appropriate resources to analyze, validate, and address the issue. 

Reporting a Potential Security Vulnerability

We welcome reports from independent researchers, industry organizations, vendors, and customers. To find out more information on how to report a potential vulnerability, please visit  Vulnerability Reporting.

Bug Bounty Program

At the moment, Honeywell does not participate in a bug bounty program or provide any monetary incentives for discovering vulnerabilities. Honeywell does recognize reporters and security researchers on our public acknowledgement page.

In this phase, an incident owner is assigned to the case.

The analysis phase entails assessing and validating the security concern by conducting thorough analysis.

We use the Common Vulnerability Scoring System version 3.1 (CVSS v3.1) to evaluate the severity level of identified vulnerabilities. This enables a common scoring method and a common language to communicate the characteristics and impacts of vulnerabilities and allows responders to prioritize responses and resources according to the threat.

Severity rating scale as shown in the table below:

When and where applicable, Honeywell will provide the CVSS v3.1 Base Score.

We recommend consulting a security or IT professional to evaluate the risk of your specific configuration and we encourage users to compute the environmental score based on their network parameters. We also recommend leveraging a security or IT professional’s assessment of the issue to prioritize responses in your own environment.

Different base scores

There may be instances where NVD’s score and Honeywell's score may differ. If so, this is because as owners of the product we are able to account for configurations, build, and other nuisances of the product. In the event the score differs, please use the Honeywell base score.

Remediation timelines will depend on many factors, including: the severity, the product affected, the current development cycle, QA cycles, and whether the issue can only be updated in a major release. 

Remediation may take one or more of the following forms: 

1. A new release 
2. A Honeywell-provided patch 
3. Instructions to download and install an update or patch from a third-party 
4. A workaround to mitigate the vulnerability 

Notwithstanding the foregoing, we do not guarantee a specific resolution for issues and not all issues identified may be fixed. 

Communication and Notification  

At this point in time a communication plan is determined. Below are various forms of communication. 

Notifying Customers of Vulnerability

We take responsibility to ensure that our customers are notified, when necessary, in an efficient manner. Most communication will be posted after patches or workaround has been released on our Security Notice site.

We will not provide additional information about the specifics of vulnerability or how to reproduce. We do not distribute exploit or proof of concept code for identified vulnerabilities. 

In accordance with industry practices, we do not share our findings from internal security testing or other types of security activities with external entities. It is important to note that any unauthorized scan of our services and production systems will be considered an attack.  

Coordinated Vulnerability Disclosure

Coordinated Vulnerability Disclosure (CVD) is indeed a crucial process in managing and mitigating vulnerabilities in hardware, software, and services. Honeywell's approach to CVD involves engaging with various stakeholders such as partners, vendors, researchers, and community coordinators to ensure that newly discovered vulnerabilities are disclosed in a controlled and coordinated manner. Multi-party coordination is essential because it helps in understanding the different parties' vulnerability disclosure policies, handling policies, and contractual agreements, which in turn fosters trusted communication and collaboration. 

By increasing transparency between parties, vendors can better understand and manage the risks posed by vulnerabilities. This transparency also facilitates engagements with other parties, ensuring that everyone involved is on the same page. The primary aim of CVD is to provide timely and consistent guidance to all parties and customers, helping them protect themselves effectively. 

Honeywell follows a similar approach to CVD. They encourage independent reporters who discover vulnerabilities to contact them directly, allowing Honeywell to investigate and remediate the vulnerabilities before they are publicly disclosed. The Product Security Incident Response Team (PSIRT) coordinates with the reporter throughout the investigation and provides updates on progress. Once an update or mitigation information is publicly released, the reporter is welcome to discuss the vulnerability publicly.

This process not only helps in protecting customers but also ensures that public disclosures are coordinated appropriately, and reporters are acknowledged for their findings. If a reported vulnerability involves a vendor product, the PSIRT will notify the vendor directly, coordinate with the reporter, or engage a third-party coordination center.

For more information on CVD, please review the information provided in the following links: 

• Guidelines and Practices for Multi-Party Vulnerability Coordination and Disclosure
• The CERT Guide to Vulnerability Disclosure
• PSIRT Services Framework