pcf-security.html.md.erb

---
title: Pivotal Cloud Foundry® Security Overview and Policy
owner: Security
---

<strong><%= modified_date %></strong>

This document outlines our security policy and is addressed to operators deploying [Pivotal Cloud Foundry&reg;](https://network.pivotal.io/products/pivotal-cf) (PCF) using Pivotal Cloud Foundry&reg; Operations Manager.

For a comprehensive overview of the security architecture of each PCF component, refer to the [Cloud Foundry Security](../concepts/security.html) topic.

##<a id='monitor'></a>How Pivotal Monitors for Security Vulnerabilities ##

Pivotal receives private reports on vulnerabilities from customers and from field personnel via our secure disclosure process. We also monitor public repositories of software security vulnerabilities to identify newly discovered
vulnerabilities that might affect one or more of our products.

###<a id='report'></a>How to Report a Vulnerability ###

Pivotal encourages users who become aware of a security vulnerability in our products to contact Pivotal with details of the vulnerability. Please send descriptions of any vulnerabilities found to security@pivotal.io. Please include details on the software and hardware configuration of your system so that we can reproduce the issue.

<p class="note"><strong>Note</strong>: We encourage use of encrypted email. Our public PGP key is located at <a href="http://www.pivotal.io/security">http://www.pivotal.io/security</a>.</p>


##<a id='notification-policy'></a>Notification Policy ##

PCF has many customer stakeholders who need to know about security updates. When there is a possible security vulnerability identified for a PCF component, we do the following:

1. Assess the impact to PCF.
1. If the vulnerability would affect a PCF component, we schedule an update for the impacted component(s).
1. Update the affected component(s) and perform system tests.
1. Announce the fix publicly via the following channels:
  1. Automated notification to end users who have downloaded or subscribed to a PCF product on [Pivotal Network](https://network.pivotal.io) when a new, fixed version is available.
  1. Adding a new post to [http://www.pivotal.io/security](http://www.pivotal.io/security).

##<a id='classes'></a>Classes of Vulnerabilities ##

Attackers can exploit vulnerabilities to compromise user data and processing resources. This can affect data confidentiality, integrity, and availability to different degrees. For vulnerabilities related to Ubuntu provided packages, Pivotal follows [Canonical's priority levels](http://people.canonical.com/~ubuntu-security/cve/priority.html). For other vulerabilities, Pivotal follows [Common Vulnerability Scoring System v3.0 standards](https://www.first.org/cvss/specification-document) when assessing severity.

Pivotal reports the severity of vulnerabilities using the following severity classes:

###<a id='high'></a>High ###

High severity vulnerabilities are those that can be exploited by an unauthenticated or authenticated attacker, from the Internet or those that break the guest/host Operating System isolation. The exploitation could result in the complete compromise of confidentiality, integrity, and availability of user data and/or processing resources without user interaction. Exploitation could be leveraged to propagate an Internet worm or execute arbitrary code between Virtual Machines and/or the Host Operating System. This rating also applies to those vulnerabilities that could lead to the complete compromise of availability when the exploitation is by a remote unauthenticated attacker from the Internet or through a breach of virtual machine isolation.

###<a id='moderate'></a>Moderate ###

Moderate vulnerabilities are those in which the ability to exploit is mitigated to a significant degree by configuration or difficulty of exploitation, but in certain deployment scenarios could still lead to the compromise of
confidentiality, integrity, or availability of user data and/or processing resources.

###<a id='low'></a>Low ###

Low vulnerabilities are all other issues that have a security impact. These include vulnerabilities for which exploitation is believed to be extremely difficult, or for which successful exploitation would have minimal impact.

##<a id='release-policy'></a>Release Policy ##

PCF schedules regular releases of software in the PCF Suite to address Low / Medium severity vulnerability exploits. These patch releases take place during the first week each month. When High severity vulnerability exploits are identified, PCF releases fixes to software in the PCF Suite on-demand, with as fast a turnaround as possible.

##<a id='alerts'></a>Alerts/Actions Archive

[http://www.pivotal.io/security](http://www.pivotal.io/security)