← VCE Software Development U4O2

Risks of software acquired from third parties

Risk from software bought, outsourced or downloaded, as you cannot fully see or control how it was built and maintained (poor code, backdoors, no support, licence issues).

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 43

Understanding Risks of software acquired from third parties in VCE Software Development U4O2

What it does: This checks the licence and ownership sub-theme: software used against its licence terms can create legal problems for the organisation. The organisation cannot see how the code was built, so it scans and tests the module itself to find poor quality or vulnerabilities. When vendor support ends, security patches stop, so known weaknesses stay open to attackers. Software from untrusted sources may carry hidden malware. Trusted sources and code signing reduce this risk. Limited visibility means weaknesses cannot be independently reviewed, so the organisation must trust the vendor.

Common mistakes: Python Booleans are capitalised. 'true' is not defined and causes a NameError, so the flag showing the vendor has ended support never gets set. It should be support_ended = True. The print call is missing its closing bracket, which is a syntax error. The warning about a licence problem would never run. It should be print("Licence problem").

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Risks of software acquired from third parties to a class →

This module's key terms are also in a printable crossword (Modules 23–47) and word search (Modules 1–47).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

A company downloads a free library and uses it without reading its code. What is the main risk?

The code quality is unknown, so it may contain bugs or vulnerabilitiesThe library is guaranteed to be secure because it is free

Matches

deploy(vendor_app) # trusted, so no testing needed

↓

Assuming bought software is safe without testing it. Third-party code may have poor quality, hidden backdoors or malware, so it should be scanned and tested before deployment.

Applying

Meanings

Term

third-party software risk

Meaning

Risk from software bought, outsourced or downloaded, as you cannot fully see or control how it was built and maintained (poor code, backdoors, no support, licence issues).

Practice

vendorSupport ← "ended"

Testing

Gaps

IF supportEndDate today THEN

Check Answer

Spots

1support_ended = true

2if support_ended:

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A company downloads a free library and uses it without reading its code. What is the main risk?

A. The library is guaranteed to be secure because it is free

B. The code quality is unknown, so it may contain bugs or vulnerabilities ✓

The organisation cannot fully see how third-party code was built or tested, so hidden flaws are possible.

2. Which is a risk of buying software from a vendor that has stopped supporting it?

A. New vulnerabilities will not be patched ✓

B. The software will automatically become more secure over time

When vendor support ends, security patches stop, so known weaknesses stay open to attackers.

3. Which statement describes a hidden backdoor in third-party software?

A. Secret code that lets an attacker access the system without normal authentication ✓

B. A button in the interface that lets users log in faster

A backdoor is hidden access placed in the code. The buyer may not find it because they cannot fully review the source.

4. An outsourced developer builds an app and the contract does not say who owns the code. What kind of third-party risk is this?

A. Malware infection through a backdoor

B. Licence and ownership problem ✓

Unclear ownership or licence terms can stop an organisation from modifying, reusing or selling the software.

5. Which is the best example of malware risk from downloaded software?

A. An installer from an unofficial site that secretly installs spyware ✓

B. An installer from the vendor that has been code signed and verified

Software from untrusted sources may carry hidden malware. Trusted sources and code signing reduce this risk.

Match the Pairs

vendor_support_end = "2024-06-30" → The vendor will stop providing patches after this date, so new vulnerabilities in the bought software will stay unfixed.

pip install unknown-pdf-tool → Downloads and runs code from an unverified third party, which could contain malware, a hidden backdoor or poor quality code.

Before accepting third-party software, check its licence terms because ownership and permitted use may be restricted. → if licence_allows_commercial_use == False: reject(package)

Unknown code quality can be reduced by testing third-party software yourself before it goes into production. → run_security_scan(vendor_module)

deploy(vendor_app) # trusted, so no testing needed → Assuming bought software is safe without testing it. Third-party code may have poor quality, hidden backdoors or malware, so it should be scanned and tested before deployment.

use_free_library(code) # no need to read the licence → Ignoring the licence. A downloaded library may have terms that limit commercial use or claim ownership, creating legal problems. The licence must be read first.

Key Term

third-party software risk

Risk from software bought, outsourced or downloaded, as you cannot fully see or control how it was built and maintained (poor code, backdoors, no support, licence issues).

Fill in the Blanks

1. IF supportEndDate < today THEN DISPLAY "Vendor support has ended" END IF

Hint: Type the comparison operator that is true when the support end date is earlier than today.

2. IF downloadHash ≠ publishedHash THEN DISPLAY "Do not install" END IF

Hint: Type the operator meaning 'is not equal to', so a mismatched hash could signal tampering or malware.

3. IF licence = "GPL" AND isCommercial THEN DISPLAY "Licence conflict" END IF

Hint: Type the logical operator that needs both conditions to be true before the licence warning shows.

4. FOR EACH library IN thirdPartyLibraries IF library.supportEnded = TRUE THEN FLAG library

Hint: Type the loop variable name that is used on the lines below to check each third-party library.

5. IF NOT vendorIsTrusted THEN RUN securityScan END IF

Hint: Type the logical operator that reverses the condition, so an untrusted vendor's software gets scanned.

Spot the Error

Question 1

A support_ended = true

B if support_ended:

C print("No more patches")

Line A — Python Booleans are capitalised. 'true' is not defined and causes a NameError, so the flag showing the vendor has ended support never gets set. It should be support_ended = True.

Question 2

A licence = "GPL"

B allowed = ["MIT", "Apache"]

C if licence not in allowed:

D print("Licence problem"

Line D — The print call is missing its closing bracket, which is a syntax error. The warning about a licence problem would never run. It should be print("Licence problem").

Question 3

A def scan(package)

B if package in BAD_LIST:

C return "Block"

D return "Review"

Line A — A function definition must end with a colon. Without it the scan check for risky third-party packages is a syntax error. It should be def scan(package):

Question 4

A status = ["active", "ended"]

B for s in status:

C if s = "ended":

D print("New vendor")

Line C — A single = assigns a value, but an if statement needs the comparison operator ==. The check for ended vendor support would fail. It should be if s == "ended":

Question 5

A source = "random website"

B trusted = False

C if trusted:

D print("Scan for malware")

Line C — This is a logic error. Software from an untrusted source is the one that needs scanning for malware or backdoors, but this condition only scans trusted software. It should be if not trusted:

Student with a class code? Join your class →