A software vendor in Dublin licenses its proprietary platform to a German bank under a perpetual licence with a confidentiality clause and a clause prohibiting reverse engineering. A penetration test commissioned by the bank uncovers a critical flaw in the vendor's encryption library. The bank's CISO wants to publish a detailed write-up at a security conference and ship a runtime patch developed by reverse engineering the affected DLL. Which course of action should the CISO take FIRST?
- AShip the in-house reverse-engineered patch to production immediately, relying on the EU Software Directive's interoperability exception to defeat the no-reverse-engineering clause.
- BPublish the full technical write-up at the conference because responsible disclosure norms override contractual restrictions in the security community.
- CNotify the vendor under the licence's confidentiality and coordinated disclosure terms, provide proof of the vulnerability, and agree a remediation timetable before any disclosure or self-patching. Correct
- DTreat the discovery as proprietary intelligence, withhold it from the vendor, and use it as leverage in the next licence renegotiation.
Why A is wrong: The Directive 2009/24/EC interoperability carve-out is narrow and applies only where information is indispensable for interoperability and not readily available; security patching of a vendor library does not fit this exception.
Why B is wrong: Community norms are not a defence to breach of contract or trade secret misappropriation; publishing without vendor coordination exposes the bank to litigation and reputational damage with regulators.
Why C is correct: Contractual obligations of confidentiality and any coordinated vulnerability disclosure clauses bind the bank; engaging the vendor first preserves the bank's legal position, lets the vendor issue an authorised patch, and aligns with ISO/IEC 29147 disclosure practice.
Why D is wrong: Withholding a known critical vulnerability conflicts with the bank's prudential obligations under DORA and with fiduciary duties to customers; it also risks breach of the duty of good faith implied in many contracts.