Responsible disclosure

Last update: 15/10/2020

DOBCO Medical Systems considers it important that its information and systems are secure.

Despite our concern for the security of these systems, it may occur that there is still a vulnerability.

If you have found a vulnerability in one of our systems, please let us know so that we can take measures as quickly as possible. We would like to work with you to protect our data, our users and our systems in a better way.

We have therefore opted for a policy of coordinated disclosure of vulnerabilities (also known as the ‘Responsible Disclosure Policy’) so that you can inform us when you discover a vulnerability.

This Responsible Disclosure Policy applies to the following systems, maintained by DOBCO Medical Systems:

In any case of doubt, please contact us to clarify matters via infosec@dobcomed.com

What we ask of you

If you discover a vulnerability in one of our systems, we ask you to:

Reporting the vulnerability

  • Report the vulnerability as soon as possible after discovery. Mail your findings to infosec@dobcomed.com.
  • Provide sufficient information to reproduce the vulnerability so that we can solve the problem as quickly as possible. Usually the URL of the affected system and a description of the vulnerability is sufficient, but for more complex vulnerabilities more may be needed.
  • Leave your contact details, so that DOBCO Medical Systems can contact you to work together for a safe result. Leave at least your name, e-mail address and/or telephone number. Reporting under a pseudonym is possible, but make sure that we can contact you if we should have additional questions.
  • Confirm that you have acted and will continue to act in accordance with this Responsible Disclosure Policy.

Rules you must follow

Don’t disclose the vulnerability until we have been able to correct it. See below for possible publication.

  • Don’t exploit the vulnerability by unnecessarily copying, deleting, adapting or viewing data. Or, for example, by downloading more data than is necessary to demonstrate the vulnerability.
  • Don’t apply the following actions:
    • Placing malware (virus, worm, Trojan horse, etc.).
    • Copying, modifying or deleting data in a system.
    • Making changes to the system.
    • Repeatedly accessing the system or sharing access with others.
    • Using automated scanning tools.
    • Using the so-called "brute force" of access to systems.
    • Using denial-of-service or social engineering (phishing, vishing, spam,...).
  • Don’t use attacks on physical security, social engineering, distributed denial of service, spam or third-party applications.
  • Immediately erase all data obtained through vulnerability as soon as it is reported to DOBCO Medical Systems.
  • Don’t perform actions that could have an impact on the proper functioning of the system, both in terms of availability and performance, but also in terms of confidentiality and integrity of the data.

Acts under this Responsible Disclosure Policy should be limited to conducting tests to identify potential vulnerabilities, and sharing this information with DOBCO Medical Systems.

If, after the vulnerability has been removed, you wish to publish information about the vulnerability, we ask you to notify us at least one month before publication, and to give us the opportunity to respond. Identifying us in a publication is only possible after we have given our explicit approval.

What we promise

If you have complied with the above terms of the Responsible Disclosure Policy and have not committed any other breaches,

  • we will not take any legal action against you.
  • we will respond to your report within a short period of time, if possible within 10 working days, with our review of the report and any expected date for resolution.
  • we will treat your report confidentially and will not share your personal data with third parties without your consent unless this is necessary to comply with a legal obligation.
  • we will keep you informed of the progress of solving the problem.
  • we want to thank you for reporting a security problem that is not yet known to us by offering the opportunity to be listed in our "Hall Of Fame".
  • we strive to solve all problems within a short period of time.

We may however choose to ignore low quality reports.

If you have any questions, we encourage you to address them to infosec@dobcomed.com

In case of doubt about the applicability of this policy, please contact us first via this e-mail address, to ask for explicit permission.

We reserve the right to change the content of this Policy at any time, or to terminate the Policy.

This text is a derivative work of "Responsible Disclosure" by Floor Terra, used under a Creative Commons Attribution license 3.0.

Support

If you have a problem or question, please consult our support page.

Only during technical support:
Click here to start TeamViewer

Company information

DOBCO Medical Systems N.V.

Nachtegaalstraat 6 W05

9240 Zele, Belgium

Website: www.dobcomed.com

Software identification

PACSonWEB V3.3.100

Release date: 2020-11-07

User manuals

http://manuals.pacsonweb.com/display/MANPOW3

or download the PDF

Revision date: 2020-11-07

ref: NO25

The browser that you are currently using is no longer supported.


PACSonWEB is built using the latest technology. This makes PACSonWEB faster and easier to use in your benefit.


Unfortunately, your browser does not support all these technologies. Download the latest version of one of the following browsers to ensure the best user experience. In the near future it will be impossible to use PACSonWEB with your current browser.



You are currently in a demonstration environment. This functionality is not supported in the demonstration environment.

We make use of cookies on this website. A cookie is a small file that is sent along with pages of this website and stored by your browser on your hard drive of your computer. We use cookies to facilitate the use of our website. You can disable these cookies via the browser, but this may negatively affect the functioning of our website.