一句话：通过对医疗领域17名从业者的访谈，揭示安全补丁管理自动化的实践现状、局限与真实需求并提出建议。
已有研究表明，为安全补丁管理流程的各个环节提供自动化支持，有望显著减少补丁安装的延迟；然而，自动化在实践中的实际使用方式、其在满足真实需求方面的局限以及从业者真正需要什么，尚未得到实证考察。本文采用半结构化访谈方法，对来自医疗领域三家机构的17名从业者开展实证研究，系统分析自动化在安全补丁管理中的角色，刻画实践中的自动化现状（as-is）、当前自动化支持存在的不足、如何增强自动化以有效满足从业者需求，以及人在自动化流程中应扮演的角色。基于访谈发现，作者提炼出一组建议，为未来面向安全补丁管理的自动化支持研发指明方向。
Several studies have shown that automated support for different activities of the security patch management process has great potential for reducing delays in installing security patches. However, it is also important to understand how automation is used in practice, its limitations in meeting real-world needs and what practitioners really need, an area that has not been empirically investigated in the existing software engineering literature. This paper reports an empirical study aimed at investigating different aspects of automation for security patch management using semi-structured interviews with 17 practitioners from three different organisations in the healthcare domain. The findings are focused on the role of automation in security patch management for providing insights into the as-is state of automation in practice, the limitations of current automation, how automation support can be enhanced to effectively meet practitioners’ needs, and the role of the human in an automated process. Based on the findings, we have derived a set of recommendations for directing future efforts aimed at developing automated support for security patch management.
@inproceedings{paperbot7152,
title = {An Empirical Study of Automation in Software Security Patch Management},
author = {Nesara Dissanayake and Asangi Jayatilaka and Mansooreh Zahedi and Muhammad Ali Babar},
booktitle = {ASE},
year = {2022},
doi = {10.1145/3551349.3556969}
}