Risks of software acquired from third parties

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A company downloads a free library and uses it without reading its code. What is the main risk?

A The library is guaranteed to be secure because it is free

B The code quality is unknown, so it may contain bugs or vulnerabilities

2. Which is a risk of buying software from a vendor that has stopped supporting it?

A New vulnerabilities will not be patched

B The software will automatically become more secure over time

3. Which statement describes a hidden backdoor in third-party software?

A Secret code that lets an attacker access the system without normal authentication

B A button in the interface that lets users log in faster

4. An outsourced developer builds an app and the contract does not say who owns the code. What kind of third-party risk is this?

A Malware infection through a backdoor

B Licence and ownership problem

5. Which is the best example of malware risk from downloaded software?

A An installer from an unofficial site that secretly installs spyware

B An installer from the vendor that has been code signed and verified

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1vendor_support_end = "2024-06-30"		AAssuming bought software is safe without testing it. Third-party code may have poor quality, hidden backdoors or malware, so it should be scanned and tested before deployment.
2pip install unknown-pdf-tool		Brun_security_scan(vendor_module)
3Before accepting third-party software, check its licence terms because ownership and permitted use may be restricted.		CThe vendor will stop providing patches after this date, so new vulnerabilities in the bought software will stay unfixed.
4Unknown code quality can be reduced by testing third-party software yourself before it goes into production.		Dif licence_allows_commercial_use == False: reject(package)
5deploy(vendor_app) # trusted, so no testing needed		EDownloads and runs code from an unverified third party, which could contain malware, a hidden backdoor or poor quality code.
6use_free_library(code) # no need to read the licence		FIgnoring the licence. A downloaded library may have terms that limit commercial use or claim ownership, creating legal problems. The licence must be read first.

Definitions

third-party software risk

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF supportEndDate _ today THEN DISPLAY "Vendor support has ended" END IF

IF downloadHash _ publishedHash THEN DISPLAY "Do not install" END IF

IF licence = "GPL" ___ isCommercial THEN DISPLAY "Licence conflict" END IF

FOR EACH _______ IN thirdPartyLibraries IF library.supportEnded = TRUE THEN FLAG library

IF ___ vendorIsTrusted THEN RUN securityScan END IF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A support_ended = true

B if support_ended:

C print("No more patches")

Question 2

A licence = "GPL"

B allowed = ["MIT", "Apache"]

C if licence not in allowed:

D print("Licence problem"

Question 3

A def scan(package)

B if package in BAD_LIST:

C return "Block"

D return "Review"

Question 4

A status = ["active", "ended"]

B for s in status:

C if s = "ended":

D print("New vendor")

Question 5

A source = "random website"

B trusted = False

C if trusted:

D print("Scan for malware")

Answer Key

Risks of software acquired from third parties

Section A: Quick Questions

B — The code quality is unknown, so it may contain bugs or vulnerabilities

A — New vulnerabilities will not be patched

A — Secret code that lets an attacker access the system without normal authentication

B — Licence and ownership problem

A — An installer from an unofficial site that secretly installs spyware

Section B: Match the Pairs

vendor_support_end = "2024-06-30" → The vendor will stop providing patches after this date, so new vulnerabilities in the bought software will stay unfixed.

pip install unknown-pdf-tool → Downloads and runs code from an unverified third party, which could contain malware, a hidden backdoor or poor quality code.

Before accepting third-party software, check its licence terms because ownership and permitted use may be restricted. → if licence_allows_commercial_use == False: reject(package)

Unknown code quality can be reduced by testing third-party software yourself before it goes into production. → run_security_scan(vendor_module)

deploy(vendor_app) # trusted, so no testing needed → Assuming bought software is safe without testing it. Third-party code may have poor quality, hidden backdoors or malware, so it should be scanned and tested before deployment.

use_free_library(code) # no need to read the licence → Ignoring the licence. A downloaded library may have terms that limit commercial use or claim ownership, creating legal problems. The licence must be read first.

Section C: Definitions

third-party software risk — Risk from software bought, outsourced or downloaded, as you cannot fully see or control how it was built and maintained (poor code, backdoors, no support, licence issues).

Section D: Fill in the Blanks

IF supportEndDate < today THEN
    DISPLAY "Vendor support has ended"
END IF

IF downloadHash ≠ publishedHash THEN
    DISPLAY "Do not install"
END IF

IF licence = "GPL" AND isCommercial THEN
    DISPLAY "Licence conflict"
END IF

FOR EACH library IN thirdPartyLibraries
    IF library.supportEnded = TRUE THEN
        FLAG library

IF NOT vendorIsTrusted THEN
    RUN securityScan
END IF

Section E: Spot the Error

A — Python Booleans are capitalised. 'true' is not defined and causes a NameError, so the flag showing the vendor has ended support never gets set. It should be support_ended = True.

D — The print call is missing its closing bracket, which is a syntax error. The warning about a licence problem would never run. It should be print("Licence problem").

A — A function definition must end with a colon. Without it the scan check for risky third-party packages is a syntax error. It should be def scan(package):

C — A single = assigns a value, but an if statement needs the comparison operator ==. The check for ended vendor support would fail. It should be if s == "ended":

C — This is a logic error. Software from an untrusted source is the one that needs scanning for malware or backdoors, but this condition only scans trusted software. It should be if not trusted: