一句话：用扎根理论揭示安全补丁管理中协调的成因、约束、断裂与机制，解释补丁延迟的社会技术因素。
该论文关注软件安全补丁管理中导致补丁应用延迟的社会技术因素。已有研究与实践中，漏洞识别和补丁开发自动化受到较多关注，但相互依赖活动的协调及补丁决策如何造成延迟仍缺乏深入理解。作者开展扎根理论研究，提出一个由成因、断裂、约束和机制四个相互关联维度组成的理论。该理论解释了为何需要在相互依赖的软件/硬件组件与多利益相关者决策之间进行协调，哪些约束会负面影响协调，协调中会出现哪些断裂，以及可采取哪些潜在纠正措施。研究为研究人员和实践者理解并支持安全补丁管理中的依赖协调提供了启示。
Several disastrous security attacks can be attributed to delays in patching software vulnerabilities. While researchers and practitioners have paid significant attention to automate vulnerabilities identification and patch development activities of software security patch management, there has been relatively little effort dedicated to gain an in-depth understanding of the socio-technical aspects, e.g., coordination of interdependent activities of the patching process and patching decisions, that may cause delays in applying security patches. We report on a Grounded Theory study of the role of coordination in security patch management. The reported theory consists of four inter-related dimensions, i.e., causes, breakdowns, constraints, and mechanisms. The theory explains the causes that define the need for coordination among interdependent software/hardware components and multiple stakeholders’ decisions, the constraints that can negatively impact coordination, the breakdowns in coordination, and the potential corrective measures. This study provides potentially useful insights for researchers and practitioners who can carefully consider the needs of and devise suitable solutions for supporting the coordination of interdependencies involved in security patch management.
@inproceedings{paperbot6468,
title = {A grounded theory of the role of coordination in software security patch management},
author = {Nesara Dissanayake and Mansooreh Zahedi and Asangi Jayatilaka and Muhammad Ali Babar},
booktitle = {FSE},
year = {2021},
doi = {10.1145/3468264.3468595}
}