Key Strategies for Tackling Third-party Software Vulnerabilities