{"id":"https://openalex.org/W4384948700","doi":"https://doi.org/10.1109/sp46215.2023.10179447","title":"No One Drinks From the Firehose: How Organizations Filter and Prioritize Vulnerability Information","display_name":"No One Drinks From the Firehose: How Organizations Filter and Prioritize Vulnerability Information","publication_year":2023,"publication_date":"2023-05-01","ids":{"openalex":"https://openalex.org/W4384948700","doi":"https://doi.org/10.1109/sp46215.2023.10179447"},"language":"en","primary_location":{"id":"doi:10.1109/sp46215.2023.10179447","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp46215.2023.10179447","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://ris.utwente.nl/ws/files/287018421/main.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5109245207","display_name":"Stephanie de Smale","orcid":null},"institutions":[{"id":"https://openalex.org/I4210165920","display_name":"European Network for Cyber Security","ror":"https://ror.org/0584wbt59","country_code":"NL","type":"nonprofit","lineage":["https://openalex.org/I4210165920"]},{"id":"https://openalex.org/I98358874","display_name":"Delft University of Technology","ror":"https://ror.org/02e2c7k09","country_code":"NL","type":"education","lineage":["https://openalex.org/I98358874"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Stephanie de Smale","raw_affiliation_strings":["National Cyber Security Centre,The Netherlands","Delft University of Technology","National Cyber Security Centre, The Netherlands"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National Cyber Security Centre,The Netherlands","institution_ids":["https://openalex.org/I4210165920"]},{"raw_affiliation_string":"Delft University of Technology","institution_ids":["https://openalex.org/I98358874"]},{"raw_affiliation_string":"National Cyber Security Centre, The Netherlands","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5015131991","display_name":"Rik van Dijk","orcid":"https://orcid.org/0000-0001-6149-8779"},"institutions":[{"id":"https://openalex.org/I4210165920","display_name":"European Network for Cyber Security","ror":"https://ror.org/0584wbt59","country_code":"NL","type":"nonprofit","lineage":["https://openalex.org/I4210165920"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Rik van Dijk","raw_affiliation_strings":["National Cyber Security Centre,The Netherlands","National Cyber Security Centre, The Netherlands"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National Cyber Security Centre,The Netherlands","institution_ids":["https://openalex.org/I4210165920"]},{"raw_affiliation_string":"National Cyber Security Centre, The Netherlands","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5029707704","display_name":"Xander Bouwman","orcid":"https://orcid.org/0009-0005-7430-8942"},"institutions":[{"id":"https://openalex.org/I98358874","display_name":"Delft University of Technology","ror":"https://ror.org/02e2c7k09","country_code":"NL","type":"education","lineage":["https://openalex.org/I98358874"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Xander Bouwman","raw_affiliation_strings":["Delft University of Technology"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Delft University of Technology","institution_ids":["https://openalex.org/I98358874"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5036733211","display_name":"Jeroen van der Ham","orcid":"https://orcid.org/0000-0002-5685-8714"},"institutions":[{"id":"https://openalex.org/I4210165920","display_name":"European Network for Cyber Security","ror":"https://ror.org/0584wbt59","country_code":"NL","type":"nonprofit","lineage":["https://openalex.org/I4210165920"]},{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Jeroen van der Ham","raw_affiliation_strings":["National Cyber Security Centre,The Netherlands","National Cyber Security Centre, The Netherlands","University of Twente"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National Cyber Security Centre,The Netherlands","institution_ids":["https://openalex.org/I4210165920"]},{"raw_affiliation_string":"National Cyber Security Centre, The Netherlands","institution_ids":[]},{"raw_affiliation_string":"University of Twente","institution_ids":["https://openalex.org/I94624287"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5012946294","display_name":"Michel van Eeten","orcid":"https://orcid.org/0000-0002-0338-2812"},"institutions":[{"id":"https://openalex.org/I98358874","display_name":"Delft University of Technology","ror":"https://ror.org/02e2c7k09","country_code":"NL","type":"education","lineage":["https://openalex.org/I98358874"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Michel van Eeten","raw_affiliation_strings":["Delft University of Technology"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Delft University of Technology","institution_ids":["https://openalex.org/I98358874"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":2.9101,"has_fulltext":true,"cited_by_count":9,"citation_normalized_percentile":{"value":0.92605547,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"1980","last_page":"1996"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9965999722480774,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.993399977684021,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.7451666593551636},{"id":"https://openalex.org/keywords/information-security-management","display_name":"Information security management","score":0.5899666547775269},{"id":"https://openalex.org/keywords/vulnerability-assessment","display_name":"Vulnerability assessment","score":0.5721462368965149},{"id":"https://openalex.org/keywords/accountability","display_name":"Accountability","score":0.5399655103683472},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5235393047332764},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.49813055992126465},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.4377751350402832},{"id":"https://openalex.org/keywords/government","display_name":"Government (linguistics)","score":0.4207383394241333},{"id":"https://openalex.org/keywords/business","display_name":"Business","score":0.4017714858055115},{"id":"https://openalex.org/keywords/knowledge-management","display_name":"Knowledge management","score":0.3881341516971588},{"id":"https://openalex.org/keywords/security-information-and-event-management","display_name":"Security information and event management","score":0.19145196676254272},{"id":"https://openalex.org/keywords/psychology","display_name":"Psychology","score":0.17867371439933777},{"id":"https://openalex.org/keywords/political-science","display_name":"Political science","score":0.11834126710891724},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.11410045623779297},{"id":"https://openalex.org/keywords/social-psychology","display_name":"Social psychology","score":0.10631614923477173}],"concepts":[{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.7451666593551636},{"id":"https://openalex.org/C148976360","wikidata":"https://www.wikidata.org/wiki/Q1662500","display_name":"Information security management","level":5,"score":0.5899666547775269},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.5721462368965149},{"id":"https://openalex.org/C2776007630","wikidata":"https://www.wikidata.org/wiki/Q2798912","display_name":"Accountability","level":2,"score":0.5399655103683472},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5235393047332764},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.49813055992126465},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.4377751350402832},{"id":"https://openalex.org/C2778137410","wikidata":"https://www.wikidata.org/wiki/Q2732820","display_name":"Government (linguistics)","level":2,"score":0.4207383394241333},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.4017714858055115},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.3881341516971588},{"id":"https://openalex.org/C103377522","wikidata":"https://www.wikidata.org/wiki/Q3493999","display_name":"Security information and event management","level":4,"score":0.19145196676254272},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.17867371439933777},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.11834126710891724},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.11410045623779297},{"id":"https://openalex.org/C77805123","wikidata":"https://www.wikidata.org/wiki/Q161272","display_name":"Social psychology","level":1,"score":0.10631614923477173},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C137176749","wikidata":"https://www.wikidata.org/wiki/Q4105337","display_name":"Psychological resilience","level":2,"score":0.0},{"id":"https://openalex.org/C184842701","wikidata":"https://www.wikidata.org/wiki/Q370563","display_name":"Cloud computing security","level":3,"score":0.0}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.1109/sp46215.2023.10179447","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp46215.2023.10179447","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"},{"id":"pmh:oai:ris.utwente.nl:openaire/83323cc7-0155-4d09-abb1-2542c15ff7c0","is_oa":true,"landing_page_url":"https://research.utwente.nl/en/publications/83323cc7-0155-4d09-abb1-2542c15ff7c0","pdf_url":"https://ris.utwente.nl/ws/files/287018421/main.pdf","source":{"id":"https://openalex.org/S4406922991","display_name":"University of Twente Research Information","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"de Smale, S, van Dijk, R, Bouwman, X, van der Ham, J & van Eeten, M 2023, No One Drinks From the Firehose : How Organizations Filter and Prioritize Vulnerability Information. in 2023 IEEE Symposium on Security and Privacy (SP). Proceedings - IEEE Symposium on Security and Privacy, vol. 2023-May, IEEE, pp. 203-219, 44th IEEE Symposium on Security & Privacy, S &P 2023, San Francisco, California, United States, 22/05/23. https://doi.org/10.1109/SP46215.2023.00012","raw_type":"info:eu-repo/semantics/conferenceObject"},{"id":"pmh:oai:tudelft.nl:uuid:2b18580e-d12a-492b-8486-a1bb81dd8678","is_oa":true,"landing_page_url":"http://resolver.tudelft.nl/uuid:2b18580e-d12a-492b-8486-a1bb81dd8678","pdf_url":"https://repository.tudelft.nl/file/File_086efcad-fba3-4f6e-b2ce-21d5d6ef33d6","source":{"id":"https://openalex.org/S4306400906","display_name":"Research Repository (Delft University of Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I98358874","host_organization_name":"Delft University of Technology","host_organization_lineage":["https://openalex.org/I98358874"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"conference paper"},{"id":"pmh:oai:ris.utwente.nl:publications/83323cc7-0155-4d09-abb1-2542c15ff7c0","is_oa":true,"landing_page_url":"https://research.utwente.nl/files/287018421/main.pdf","pdf_url":null,"source":{"id":"https://openalex.org/S4406922991","display_name":"University of Twente Research Information","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"de Smale, S, van Dijk, R, Bouwman, X, van der Ham, J & van Eeten, M 2023, No One Drinks From the Firehose : How Organizations Filter and Prioritize Vulnerability Information. in 2023 IEEE Symposium on Security and Privacy (SP). Proceedings - IEEE Symposium on Security and Privacy, vol. 2023-May, IEEE, pp. 203-219, 44th IEEE Symposium on Security & Privacy, S &P 2023, San Francisco, California, United States, 22/05/23. https://doi.org/10.1109/SP46215.2023.00012","raw_type":"info:eu-repo/semantics/conferenceObject"}],"best_oa_location":{"id":"pmh:oai:ris.utwente.nl:openaire/83323cc7-0155-4d09-abb1-2542c15ff7c0","is_oa":true,"landing_page_url":"https://research.utwente.nl/en/publications/83323cc7-0155-4d09-abb1-2542c15ff7c0","pdf_url":"https://ris.utwente.nl/ws/files/287018421/main.pdf","source":{"id":"https://openalex.org/S4406922991","display_name":"University of Twente Research Information","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"de Smale, S, van Dijk, R, Bouwman, X, van der Ham, J & van Eeten, M 2023, No One Drinks From the Firehose : How Organizations Filter and Prioritize Vulnerability Information. in 2023 IEEE Symposium on Security and Privacy (SP). Proceedings - IEEE Symposium on Security and Privacy, vol. 2023-May, IEEE, pp. 203-219, 44th IEEE Symposium on Security & Privacy, S &P 2023, San Francisco, California, United States, 22/05/23. https://doi.org/10.1109/SP46215.2023.00012","raw_type":"info:eu-repo/semantics/conferenceObject"},"sustainable_development_goals":[{"score":0.4099999964237213,"display_name":"Industry, innovation and infrastructure","id":"https://metadata.un.org/sdg/9"}],"awards":[{"id":"https://openalex.org/G4929325685","display_name":"Theseus: Making patching happen","funder_award_id":"NWA.1215.18.006","funder_id":"https://openalex.org/F4320321800","funder_display_name":"Nederlandse Organisatie voor Wetenschappelijk Onderzoek"}],"funders":[{"id":"https://openalex.org/F4320321800","display_name":"Nederlandse Organisatie voor Wetenschappelijk Onderzoek","ror":"https://ror.org/04jsz6e67"},{"id":"https://openalex.org/F4320331774","display_name":"Ministerie van Binnenlandse Zaken en Koninkrijksrelaties","ror":"https://ror.org/01at1x128"}],"has_content":{"pdf":true,"grobid_xml":false},"content_urls":{"pdf":"https://content.openalex.org/works/W4384948700.pdf"},"referenced_works_count":26,"referenced_works":["https://openalex.org/W150078352","https://openalex.org/W2004584049","https://openalex.org/W2108246235","https://openalex.org/W2207457333","https://openalex.org/W2766411424","https://openalex.org/W2889665541","https://openalex.org/W2947608454","https://openalex.org/W2983519477","https://openalex.org/W2997993688","https://openalex.org/W3000586292","https://openalex.org/W3006025933","https://openalex.org/W3017863658","https://openalex.org/W3048335302","https://openalex.org/W3084558590","https://openalex.org/W3136969503","https://openalex.org/W3163835525","https://openalex.org/W4212942508","https://openalex.org/W4249761288","https://openalex.org/W4289676926","https://openalex.org/W6637554470","https://openalex.org/W6753911286","https://openalex.org/W6754597433","https://openalex.org/W6767406509","https://openalex.org/W6781159446","https://openalex.org/W6781614840","https://openalex.org/W6784322674"],"related_works":["https://openalex.org/W1883246888","https://openalex.org/W2370114625","https://openalex.org/W2947584067","https://openalex.org/W2062873522","https://openalex.org/W3118510577","https://openalex.org/W3157230915","https://openalex.org/W1756374135","https://openalex.org/W4390540899","https://openalex.org/W2789975780","https://openalex.org/W2007895524"],"abstract_inverted_index":{"The":[0],"number":[1],"of":[2,16,86,137,199,219],"published":[3],"software":[4,31,80,188],"vulnerabilities":[5,114],"is":[6,72,89,154],"increasing":[7],"every":[8],"year.":[9],"How":[10],"do":[11],"organizations":[12,57,69,126],"stay":[13],"in":[14,58,67,96,119,144,155],"control":[15],"their":[17,21,135],"attack":[18],"surface":[19],"despite":[20],"limited":[22],"staff":[23],"resources?":[24],"Prior":[25],"work":[26],"has":[27],"analyzed":[28],"the":[29,70,103,158,197,217],"overall":[30],"vulnerability":[32,138,166,200,235],"ecosystem":[33],"as":[34,36,227,229],"well":[35,228],"patching":[37],"processes":[38],"within":[39],"organizations,":[40],"but":[41],"not":[42,94],"how":[43],"these":[44,68,145],"two":[45],"are":[46],"connected.We":[47],"investigate":[48],"this":[49],"missing":[50,183],"link":[51],"through":[52],"semi-structured":[53],"interviews":[54],"with":[55,157,182],"22":[56],"critical":[59,120],"infrastructure":[60,121],"and":[61,76,82,99,129,140,149,221],"government":[62],"services.":[63],"We":[64,123],"analyze":[65],"where":[66],"responsibility":[71,220],"allocated":[73],"to":[74,133,163,204],"collect":[75,164],"triage":[77],"information":[78,92,111,167,184,201],"about":[79,168,216],"vulnerabilities,":[81],"find":[83],"that":[84,110,125,179],"none":[85],"our":[87,151],"respondents":[88,172],"acquiring":[90],"such":[91],"comprehensively,":[93],"even":[95,118],"a":[97,176,186,209],"reduced":[98],"aggregated":[100],"form":[101],"like":[102],"National":[104],"Vulnerability":[105],"Database":[106],"(NVD).":[107],"This":[108,190],"means":[109],"on":[112,185],"known":[113,187],"will":[115],"be":[116,207],"missed,":[117],"organizations.":[122],"observe":[124],"apply":[127],"implicit":[128],"explicit":[130],"coping":[131],"mechanisms":[132],"reduce":[134],"intake":[136,198],"information,":[139],"identify":[141],"three":[142],"trade-offs":[143],"strategies:":[146],"independence,":[147],"pro-activeness":[148],"formalization.Although":[150],"respondents\u2019":[152],"behavior":[153],"conflict":[156],"widely":[159],"accepted":[160],"security":[161,177],"advice":[162],"comprehensive":[165],"active":[169],"systems,":[170,226],"no":[171],"recall":[173],"having":[174],"experienced":[175],"incident":[178],"was":[180],"associated":[181],"vulnerability.":[189],"suggests":[191],"that,":[192],"given":[193],"scarce":[194],"resources,":[195],"reducing":[196],"by":[202],"up":[203],"95%":[205],"can":[206],"considered":[208],"rational":[210],"strategy.":[211],"Our":[212],"findings":[213],"raise":[214],"questions":[215],"allocation":[218],"accountability":[222],"for":[223],"finding":[224],"vulnerable":[225],"suggest":[230],"changing":[231],"expectations":[232],"around":[233],"collecting":[234],"information.":[236]},"counts_by_year":[{"year":2025,"cited_by_count":6},{"year":2024,"cited_by_count":3}],"updated_date":"2026-08-01T09:00:35.917206","created_date":"2025-10-10T00:00:00"}