A Grounded Theory of the Role of Coordination in Software Security Patch Management
This addresses the problem of delayed patch application for software security, which can lead to disastrous attacks, but it is incremental as it builds on existing patch management research by focusing on coordination aspects.
The study investigated the causes of delays in applying security security patches by examining socio-technical coordination issues, resulting in a grounded theory with four dimensions (causes, breakdowns, constraints, and mechanisms) to explain these delays.
Several disastrous security attacks can be attributed to delays in patching software vulnerabilities. While researchers and practitioners have paid significant attention to automate vulnerabilities identification and patch development activities of software security patch management, there has been relatively little effort dedicated to gain an in-depth understanding of the socio-technical aspects, e.g., coordination of interdependent activities of the patching process and patching decisions, that may cause delays in applying security patches. We report on a Grounded Theory study of the role of coordination in security patch management. The reported theory consists of four inter-related dimensions, i.e., causes, breakdowns, constraints, and mechanisms. The theory explains the causes that define the need for coordination among interdependent software and hardware components and multiple stakeholders' decisions, the constraints that can negatively impact coordination, the breakdowns in coordination, and the potential corrective measures. This study provides potentially useful insights for researchers and practitioners who can carefully consider the needs of and devise suitable solutions for supporting the coordination of interdependencies involved in security patch management.