I currently work as an analyst on the IT security team at my company, formerly having transferred as an security auditor. I will provide a framework that I think you can use, and for which I have used on numerous occasions with success in my current role.
Analyze the vulnerability found
Your first task prior to escalation should be to analyze the vulnerability. In this step, your goal is to gain as much understanding about the security weakness as possible and to brainstorm how about it may be exploited. Threat modeling would be very useful exercise to do. Some answers that you would want to know are listed below. This list is by no means exhaustive.
- Who are the threat actors that could exploit this vulnerability discovered?
- How targeted do you believe the threat actors are - I.e: Are they aiming specifically for your company?
- What are the pre - conditions necessary for this vulnerability to be exploited?
- What adverse impact could result, assuming the vulnerability is exploited? - I.e: what is the inherent security risk? E.g: sensitive data exfiltration
Rank the severity of the vulnerability using a accepted metric such as MITRE CVSS score
Use well known and accepted sources of information for vulnerability ranking and management to increase your authority when presenting to the product manager.
Evaluate security controls currently present to mitigate likelihood of vulnerability being exploited or impact if exploited
Now that you have a good idea of the inherent security risk by evaluating both likelihood and adverse impact of exploitation, you analyze the current security controls and their effectiveness. I am not sure of your role or whether your company has a IT Security function, but work with them to understand what security processes are currently in place. Security controls is a broad term but in general includes detective, administrative, corrective, and preventative controls.
Establish reasonable residual risk ranking using accepted sources and methodology
Your goal in this step is to arrive at a reasonable ranking for residual risk - the risk remaining (business risk, data risk etc.) after application of in - place security controls. In other words, quantity the value of the in-place security controls. A source I have found useful when performing this step is NIST publication SP-800 30 Revision 1.
Translate analysis into business value
From the message the product owner gave you, it seems he is unsure / reluctant to proceed. It is important that you be able to translate the impact of the vulnerability into monetary terms - loss of current revenue, loss of prospective revenue due to customer attrition as a result of reputational damage in case of vulnerability exploitation etc. Assuming the product owner is rational, cares about the product, and is concerned about negative effect on customers, he / she should approve appropriate action such as to update the software.
It is also important to note that one form of management response is to accept the risk. Management may decide that remediation of the vulnerability is too costly relative to its likelihood of exploitation / impact of exploitation. While this may not be what you prefer, it is a valid approach nonetheless.
Use past examples to illustrate what the consequences are for inadequate attention to cybersecurity
Past incidents provide concrete evidence that shoddy / inadequate cybersecurity have are real and have a business cost. Money is the language of business and lost money will usually catch management's attention.
Work with your security folks (if your company has such a team) or do some own research on your own to determine needs to be done to remediate vulnerability.
The product manager has basically asked you for a proposed solution. It would look real good if you did some research, drafted a planned remediation plan, and analyzed costs to help the product manager. Help him / her to help you. You always want to present a solution, when faced with a obstacle in your work.
