Recently it was discovered that one of the open source packages we were using in our software was deemed vulnerable many years ago. It is no longer maintained. It is also too costly to remove and replace. I informed my Product Manager who responded with “What do you want me to do about it?” My response was that I was informing you because it will have to be reported up the chain. The response back was “Again, what do you want me to do about it?” Weeks later and the manager is still ambivalent. It is a product that is used worldwide. After the manager’s second reply, I stopped responding. We are not able to make changes without the product managers approval.

What would be the correct response in this situation? I showed the response to a coworker and his response was that the manager was in the wrong and shouldn’t have responded that way.

Don't in general go to managers with problems unless you also have a solution.

"This is no longer supported and is buggy" is less useful then "this is no longer supported and is buggy, but I have had a look and cooking up a patch to fix the library will take X days, replacing the library with a more modern one Y days (but then we won't have to keep patching), and doing nothing costs nothing but exposes us to the risks A, B & C, which option would you like me to do?".

Try very hard to never go to manglement with a problem without also offering solutions, it is mostly pointless.

Regards, Dan.

Be honest. Tell your manager that you don’t expect him to do anything, you just want to be able to honestly say that you informed your superior about this issue on a regular basis in the event that using the product as-is results in a breach of some sort. That you understand that it’s not your job to do cost/benefit analysis for fixing, switching or ignoring the issue, but you do feel it is your job to keep management informed of such issues as they become apparent to you.

This probably won’t endear you to your manager...

Assess the vulnerability and the cost of implementing fixes or workarounds.

You say that this is an open-source projects that is no longer maintained. You can therefore:

• Check to see if a maintained fork exists. A 'fork' is where someone took the original code and maintains/updates it as a seperate product.




• Create a fork and address the security concerns yourself as a company. Bear in mind that if the original code was licensed under the GPL (any version or derivative), you legally cannot keep the code in-house if the software package is being distributed outside of your company.

I would do number one first, then entertain number two. Either way, you have a solution you can give to your project manager.

I currently work as an analyst on the IT security team at my company, formerly having transferred as an security auditor. I will provide a framework that I think you can use, and for which I have used on numerous occasions with success in my current role.

Analyze the vulnerability found

Your first task prior to escalation should be to analyze the vulnerability. In this step, your goal is to gain as much understanding about the security weakness as possible and to brainstorm how about it may be exploited. Threat modeling would be very useful exercise to do. Some answers that you would want to know are listed below. This list is by no means exhaustive.

1. Who are the threat actors that could exploit this vulnerability discovered?


2. How targeted do you believe the threat actors are - I.e: Are they aiming specifically for your company?
   


3. What are the pre - conditions necessary for this vulnerability to be exploited?


4. What adverse impact could result, assuming the vulnerability is exploited? - I.e: what is the inherent security risk? E.g: sensitive data exfiltration

Rank the severity of the vulnerability using a accepted metric such as MITRE CVSS score

Use well known and accepted sources of information for vulnerability ranking and management to increase your authority when presenting to the product manager.

Evaluate security controls currently present to mitigate likelihood of vulnerability being exploited or impact if exploited

Now that you have a good idea of the inherent security risk by evaluating both likelihood and adverse impact of exploitation, you analyze the current security controls and their effectiveness. I am not sure of your role or whether your company has a IT Security function, but work with them to understand what security processes are currently in place. Security controls is a broad term but in general includes detective, administrative, corrective, and preventative controls.

Establish reasonable residual risk ranking using accepted sources and methodology

Your goal in this step is to arrive at a reasonable ranking for residual risk - the risk remaining (business risk, data risk etc.) after application of in - place security controls. In other words, quantity the value of the in-place security controls. A source I have found useful when performing this step is NIST publication SP-800 30 Revision 1.

Translate analysis into business value

From the message the product owner gave you, it seems he is unsure / reluctant to proceed. It is important that you be able to translate the impact of the vulnerability into monetary terms - loss of current revenue, loss of prospective revenue due to customer attrition as a result of reputational damage in case of vulnerability exploitation etc. Assuming the product owner is rational, cares about the product, and is concerned about negative effect on customers, he / she should approve appropriate action such as to update the software.

It is also important to note that one form of management response is to accept the risk. Management may decide that remediation of the vulnerability is too costly relative to its likelihood of exploitation / impact of exploitation. While this may not be what you prefer, it is a valid approach nonetheless.

Use past examples to illustrate what the consequences are for inadequate attention to cybersecurity

Past incidents provide concrete evidence that shoddy / inadequate cybersecurity have are real and have a business cost. Money is the language of business and lost money will usually catch management's attention.

Work with your security folks (if your company has such a team) or do some own research on your own to determine needs to be done to remediate vulnerability.

The product manager has basically asked you for a proposed solution. It would look real good if you did some research, drafted a planned remediation plan, and analyzed costs to help the product manager. Help him / her to help you. You always want to present a solution, when faced with a obstacle in your work.