An organization discovers significant vulnerabilities in a recently purchased commercial off-the-shelf software product which will not be corrected…

The risk manager’s best course of action when discovering significant vulnerabilities in a commercial

off-the-shelf software product is to review the risk of implementing versus postponing with

stakeholders. This means that the risk manager should assess the potential impact and likelihood of

the vulnerabilities being exploited, as well as the benefits and costs of using the software product.

The risk manager should also consult with the relevant stakeholders, such as the business owners,

the IT department, the security team, and the vendor, to understand their perspectives,

expectations, and requirements. Based on this analysis, the risk manager should decide whether to

proceed with the implementation, delay it until the next release,or look for alternative solutions. The

risk manager should also document and communicate the decision and the rationale behind it, and

monitor the situation for any changes or new developments.

The other options are not the best course of action, because:

Running vulnerability testing tools to independently verify the vulnerabilities is a useful step to

confirm the existence and severity of the vulnerabilities, but it is not sufficient to address the risk.

The risk manager still needs to evaluate the trade-offs between implementing and postponing the

software product, and involve the stakeholders in the decision-making process.

Reviewing the software license to determine the vendor’s responsibility regarding vulnerabilities is

an important step to understand the contractual obligations and liabilities of the vendor, but it is not

enough to mitigate the risk. The risk manager still needs to consider the impact and likelihood of the

vulnerabilities, and the benefits and costs of the software product, and consult with the stakeholders

to decide the best course of action.

Requiring the vendor to correct significant vulnerabilities prior to installation is an unrealistic and

impractical option, as the vendor has already stated that the vulnerabilities will not be corrected

until the next release. The risk manager cannot force the vendor to change their schedule or

priorities, and may risk damaging the relationship with the vendor. The risk manager should instead

work with the vendor to understand the nature and scope of the vulnerabilities, and the expected

timeline and features of the next release, and use this information to inform the risk assessment and

decision-making process.