A Grounded Theory of the Role of Coordination in Software Security Patch Management

TL;DR

This paper develops a grounded theory explaining how coordination among stakeholders and components influences delays in software security patch management, highlighting causes, constraints, and breakdowns.

Contribution

It introduces a novel grounded theory framework that elucidates the socio-technical coordination factors affecting patching delays in security management.

Findings

Identifies causes of coordination needs in patch management

Highlights constraints impacting effective coordination

Describes breakdowns and corrective measures in coordination processes

Abstract

Several disastrous security attacks can be attributed to delays in patching software vulnerabilities. While researchers and practitioners have paid significant attention to automate vulnerabilities identification and patch development activities of software security patch management, there has been relatively little effort dedicated to gain an in-depth understanding of the socio-technical aspects, e.g., coordination of interdependent activities of the patching process and patching decisions, that may cause delays in applying security patches. We report on a Grounded Theory study of the role of coordination in security patch management. The reported theory consists of four inter-related dimensions, i.e., causes, breakdowns, constraints, and mechanisms. The theory explains the causes that define the need for coordination among interdependent software and hardware components and multiple stakeholders' decisions, the constraints that can negatively impact coordination, the breakdowns in coordination, and the potential corrective measures. This study provides potentially useful insights for researchers and practitioners who can carefully consider the needs of and devise suitable solutions for supporting the coordination of interdependencies involved in security patch management.