NIC Vulnerability Reporting Procedure

DOWNLOAD NIC PGP KEY

The Network Solutions Department (NIC.LV) of the Institute of Mathematics and Computer Science at the University of Latvia provides top-level domain .lv registry and electronic numbering system services. NIC.LV places special emphasis on the security of its information system and data, and encourages security researchers and other interested parties to report any identified security vulnerability responsibly.

If you have identified a potential vulnerability in NIC.LV services, we encourage you to inform us so that we can assess and remediate it as quickly as possible.

1. How to Report a Vulnerability

   1. A vulnerability can be reported by:

      1. sending an email to security@nic.lv. We encourage you to use our public PGP key to encrypt and protect the transmitted information.

      2. using the vulnerability disclosure platform –cvd.cert.lv.

   2. A vulnerability report should preferably include:

      1. a description of the vulnerability;

      2. the method of exploiting the vulnerability (if known);

      3. the address of the affected resource (URL);

      4. steps to reproduce the vulnerability;

      5. screenshots or other supporting evidence;

      6. the researcher’s contact information (name, email);

      7. a public PGP key (if available).

2. Vulnerabilities to Report

   1. We encourage reporting vulnerabilities in NIC.LV services, including but not limited to authentication or authorization flaws, access control issues, data protection and encryption weaknesses, logic errors with potential security impact, vulnerabilities in web interfaces and APIs, as well as any other vulnerabilities that may affect the confidentiality, integrity, or availability of systems.

   2. The reporting mechanism is not intended for:

      1. reporting typographical or content errors;

      2. general questions about services;

      3. customer support requests.

3. NIC.LV Actions After Receiving a Report

   1. NIC.LV will acknowledge receipt of the report, evaluate the submitted information, and, if necessary, contact the reporter to clarify the provided details. NIC.LV will inform the reporter (hereinafter – the security researcher) about the vulnerability remediation process and will notify them once the vulnerability has been resolved.

   2. If the security researcher wishes, after the vulnerability has been resolved NIC.LV may acknowledge the researcher’s contribution to improving security by providing positive recognition and publicity. No financial rewards are offered for reported vulnerabilities.

4. Principles for Security Researchers

   1. NIC.LV encourages security researchers to follow responsible vulnerability disclosure principles and to:

      1. not exploit a vulnerability to access information that does not belong to them;

      2. not obtain, modify, or delete data;

      3. not perform actions that may affect the availability of services (for example, denial-of-service attacks);

      4. not conduct social engineering attacks;

      5. not disclose information about the vulnerability before it has been resolved.

5. Reporting Vulnerabilities in Other .lv Resources

   1. 5.1. If a vulnerability is identified in .lv top-level domain resources that are not managed by NIC.LV, we encourage you to check the vulnerability disclosure platform https://cvd.cert.lv:

      1. if a vulnerability disclosure program is registered for the relevant resource, please use that program.

      2. if no program is available, please report the vulnerability in the platform’s ALL section.

6. NIC PGP Key

   1. F001 A02A AB43 3FB5 B911 4083 F4B4 95CF 4AD6 3B4A