A grounded theory of the role of coordination in software security patch management

Abstract

Several disastrous security attacks can be attributed to delays in patching software vulnerabilities. While researchers and practitioners have paid significant attention to automate vulnerabilities identification and patch development activities of software security patch management, there has been relatively little effort dedicated to gain an in-depth understanding of the socio-technical aspects, e.g., coordination of interdependent activities of the patching process and patching decisions, that may cause delays in applying security patches. We report on a Grounded Theory study of the role of coordination in security patch management. The reported theory consists of four inter-related dimensions, i.e., causes, breakdowns, constraints, and mechanisms. The theory explains the causes that define the need for coordination among interdependent software/hardware components and multiple stakeholders' decisions, the constraints that can negatively impact coordination, the breakdowns in coordination, and the potential corrective measures. This study provides potentially useful insights for researchers and practitioners who can carefully consider the needs of and devise suitable solutions for supporting the coordination of interdependencies involved in security patch management. CCS CONCEPTS• Software and its engineering → System administration; • Security and privacy → Software security engineering; Vulnerability management; Social aspects of security and privacy.

Why, How and Where of Delays in Software Security Patch Management: An Empirical Investigation in the Healthcare Sector

“…Concerning the coordination challenges, Dissanayake et. al [12] have proposed a grounded theory of the role of coordination in security patch management explaining the causes that create the need for coordinating in the security patch management process, constraints for effective coordination, breakdowns resulting from ineffective handling of the coordination causes and constraints, and mechanisms for managing the causes while mediating the constraints. Although several approaches have been proposed to improve the patch management process to reduce delays, the reasons why such delays occur and how to mitigate them remain unexplored.…”

“…Concerning the complexity of patches, the patch interdependencies consisting of software, hardware, and firmware presented a major reason for delays in patch testing and deployment tasks. We identify that such complexities emerge from the existing dependencies in the source code, for example, function-level or library-level dependencies [12].…”

“…Patch interdependencies (30) Faulty patches (12) Extensive monitoring for faulty patch fixes (8) Patch heterogeneity (5) Increasing rate of patch release (2)…”

“…in the collaborative process of dealing with third-party vulnerabilities and vendor patches [12,27,51]. As a result, organisations struggle to apply timely patches often leaving myriad vulnerabilities open to exploits.…”

“…Further, another set of studies have attempted to optimise the patch management process by synchronising the organisational patch cycle with the vendor [4,5,37]. Focused on the coordination aspect, our previous study [12] presented a grounded theory of the role of coordination in security patch management based on observations of 51 patch meetings between two case organisations over nine months. The theory explains the causes that define the need for coordination in the process (i.e., the socio-technical dependencies), constraints that can hinder effective coordination, the breakdowns resulting from ineffective coordination of the causes and constraints, and the mechanisms to manage the causes, constraints and breakdowns.…”