Cybersecurity for Critical Infrastructure
Product Security for Critical Power Systems
Electrical power systems are critical infrastructure, and their secure operation depends on product security integrated into the design, validation, and operation of systems. At OMICRON, security is built into solutions for protection testing, high-voltage diagnostics, and power system monitoring from the start. It’s developed in close collaboration with utilities, industrial operators, and cybersecurity experts – aligned with real operating conditions. Security is applied continuously throughout the entire product lifecycle, from development to long-term support, enabling engineers to manage risks, maintain secure operation, and make informed decisions in critical environments.
Product Security Governance
A Dedicated Product Security Team
Vulnerability management
We identify, assess, and manage potential vulnerabilities affecting our products with structured security processes.
Risk assessment & remediation
Validated issues are analyzed for impact and addressed with coordinated remediation and testing.
Responsible disclosure
We work closely with development, quality assurance, and external partners to ensure transparent and responsible vulnerability handling.
Vulnerability Reporting Process
Responsible Vulnerability Reporting and Handling
OMICRON welcomes reports of potential security vulnerabilities affecting our products. Every submission is handled confidentially and processed through a structured and secure intake procedure. Reported issues are technically validated, analyzed for impact, and assessed in coordination with development and quality teams. Appropriate remediation measures are defined, implemented, and tested based on this evaluation. OMICRON follows a coordinated vulnerability disclosure approach to protect critical power system operators. We request that identified vulnerabilities not be made public before remediation measures are available.
Security Process
The Disclosure Process
We encourage you to report security vulnerabilities in OMICRON products. We’ve established a comprehensive, systematic process that ensures relevant security issues are disclosed reliably and efficiently.
Report
Submit and document vulnerabilities.
Analysis
Identify root cause and impact.
Assessment
Evaluate risk and priority.
Treatment
Define and implement solutions.
Disclosure
Inform customers and provide guidance.
Inside the Process
What Happens in Detail
Understand how each step is handled, from reporting and analysis to remediation and responsible disclosure.
Report
Security vulnerabilities can be reported to our Product Security team, which handles all submissions confidentially. Issues can also be reported anonymously, and if you’d like, we can credit you in our security advisory.
Please include:
- The affected OMICRON product with details
- A Clear description of the vulnerability issue
- The Available exploit code or step-by-step approach used to find the vulnerability (if possible)
- Information about potential public disclosure plans
Analysis
After receiving your report, we perform a detailed analysis to reproduce the issue and identify its root cause.
This allows us to understand the technical context of your issue and prepare appropriate mitigation measures.
Assessment
Once the issue is analyzed, we will assess its likelihood and potential impact on customer systems. This enables us to prioritize actions and define appropriate response measures.
Treatment
Based on the assessment, we define and implement mitigation measures, which may include providing patches, coordinating fixes, and preparing a structured and responsible disclosure.
Disclosure
We take our responsibilities seriously and ensure that affected customers are informed about relevant vulnerabilities that affect OMICRON products in a timely manner to avoid potential damage. Every reported security issue is carefully evaluated and handled accordingly.
We provide the following disclosure information:
- Vulnerability description
- Affected products and versions
- Severity rating (CVSS)
- CVE reference (if applicable)
- Recommended remediation steps
- Credits (if desired by the reporter)
OMICRON Product Security Team
Reporting a Security Vulnerability
At OMICRON, a dedicated product security team is responsible for managing security issues and coordinating disclosure processes. They are available to support you with any questions related to OMICRON product vulnerabilities. For secure communication, we recommend using encrypted email whenever possible.
- You can reach the team at product.security@omicronenergy.com.
- A PGP public key is available and can be downloaded below for encrypted communication.
PGP public key
Fingerprint: 90F2 6F91 6186 22EA AFF1 06A0 F014 F4B8 C72E C818
Vulnerability Disclosure
Security Advisories
OMICRON established a structured process for handling and disclosing product security vulnerabilities in 2021. Below are all Security Advisories published to date, including validated vulnerabilities and recommended remediation measures.
How does OMICRON handle reported security vulnerabilities?
Reported vulnerabilities are handled through a structured and confidential process. Each submission is validated, analyzed for potential impact, and assessed in coordination with development and quality teams. Based on this evaluation, appropriate remediation measures are defined, implemented, and tested before disclosure.
How can I report a vulnerability affecting an OMICRON product?
Security vulnerabilities can be reported directly to our product security team via email or secure reporting channels. We recommend including the product name, version, a detailed description, and reproduction steps. Anonymous submissions are also accepted.
What information is included in a security advisory?
Security advisories include validated information about identified vulnerabilities, their potential impact, and recommended remediation measures. They provide guidance to help users assess risks and take appropriate action to maintain secure system operation.
Does the company follow a coordinated vulnerability disclosure process?
Yes, OMICRON follows a coordinated vulnerability disclosure process. Vulnerabilities are not made public until appropriate remediation measures are available, thereby helping protect critical power system operators.
How is Product Security integrated into development?
Product security is integrated throughout the entire product lifecycle, from design and development to testing, deployment, and long-term maintenance. Structured security processes ensure that potential risks are identified and addressed early, and that they are monitored continuously.
Are OMICRON products used in critical infrastructure environments?
Yes, OMICRON solutions are used in critical infrastructure environments worldwide, including power generation, transmission, and distribution systems. Security practices are developed in collaboration with utilities, industrial operators, and cybersecurity experts to meet these requirements.
How often are security advisories updated?
Security advisories are updated whenever validated vulnerabilities are identified and assessed. Updates are published as needed to provide timely and relevant information for maintaining secure system operation.
How does the company protect customers during the remediation process?
During the remediation process, OMICRON follows a controlled and coordinated approach to ensure that vulnerabilities are addressed before public disclosure. This helps protect customers by reducing exposure to risk while solutions are being developed and tested.