{"id":"https://openalex.org/W3173382863","doi":"https://doi.org/10.1145/3468264.3468595","title":"A grounded theory of the role of coordination in software security patch management","display_name":"A grounded theory of the role of coordination in software security patch management","publication_year":2021,"publication_date":"2021-08-18","ids":{"openalex":"https://openalex.org/W3173382863","doi":"https://doi.org/10.1145/3468264.3468595","mag":"3173382863"},"language":"en","primary_location":{"id":"doi:10.1145/3468264.3468595","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3468264.3468595","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["arxiv","crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2106.03458","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5041959990","display_name":"Nesara Dissanayake","orcid":"https://orcid.org/0000-0002-2873-137X"},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Nesara Dissanayake","raw_affiliation_strings":["University of Adelaide, Australia"],"raw_orcid":"https://orcid.org/0000-0002-2873-137X","affiliations":[{"raw_affiliation_string":"University of Adelaide, Australia","institution_ids":["https://openalex.org/I5681781"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5049386320","display_name":"Mansooreh Zahedi","orcid":"https://orcid.org/0000-0001-6276-9956"},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Mansooreh Zahedi","raw_affiliation_strings":["University of Adelaide, Australia"],"raw_orcid":"https://orcid.org/0000-0001-6276-9956","affiliations":[{"raw_affiliation_string":"University of Adelaide, Australia","institution_ids":["https://openalex.org/I5681781"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5032038453","display_name":"Asangi Jayatilaka","orcid":"https://orcid.org/0000-0003-2051-030X"},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Asangi Jayatilaka","raw_affiliation_strings":["University of Adelaide, Australia"],"raw_orcid":"https://orcid.org/0000-0003-2051-030X","affiliations":[{"raw_affiliation_string":"University of Adelaide, Australia","institution_ids":["https://openalex.org/I5681781"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5103075476","display_name":"Muhammad Ali Babar","orcid":"https://orcid.org/0000-0001-9696-3626"},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Muhammad Ali Babar","raw_affiliation_strings":["University of Adelaide, Australia"],"raw_orcid":"https://orcid.org/0000-0001-9696-3626","affiliations":[{"raw_affiliation_string":"University of Adelaide, Australia","institution_ids":["https://openalex.org/I5681781"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I5681781"],"apc_list":null,"apc_paid":null,"fwci":1.7901,"has_fulltext":false,"cited_by_count":12,"citation_normalized_percentile":{"value":0.86111425,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"793","last_page":"805"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10430","display_name":"Software Engineering Techniques and Practices","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/interdependence","display_name":"Interdependence","score":0.8983672261238098},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6135309934616089},{"id":"https://openalex.org/keywords/grounded-theory","display_name":"Grounded theory","score":0.5990648865699768},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.589396059513092},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.5623427033424377},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5252013802528381},{"id":"https://openalex.org/keywords/risk-analysis","display_name":"Risk analysis (engineering)","score":0.5147026181221008},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.4971640408039093},{"id":"https://openalex.org/keywords/process-management","display_name":"Process management","score":0.4942050278186798},{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.4791076183319092},{"id":"https://openalex.org/keywords/security-management","display_name":"Security management","score":0.4733579158782959},{"id":"https://openalex.org/keywords/theory-of-constraints","display_name":"Theory of constraints","score":0.4418320059776306},{"id":"https://openalex.org/keywords/knowledge-management","display_name":"Knowledge management","score":0.413818359375},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.27621155977249146},{"id":"https://openalex.org/keywords/business","display_name":"Business","score":0.2688143253326416},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.159823477268219},{"id":"https://openalex.org/keywords/operations-management","display_name":"Operations management","score":0.1510361135005951},{"id":"https://openalex.org/keywords/security-service","display_name":"Security service","score":0.14954471588134766},{"id":"https://openalex.org/keywords/qualitative-research","display_name":"Qualitative research","score":0.10082367062568665}],"concepts":[{"id":"https://openalex.org/C185874996","wikidata":"https://www.wikidata.org/wiki/Q269699","display_name":"Interdependence","level":2,"score":0.8983672261238098},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6135309934616089},{"id":"https://openalex.org/C156325361","wikidata":"https://www.wikidata.org/wiki/Q1152864","display_name":"Grounded theory","level":3,"score":0.5990648865699768},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.589396059513092},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.5623427033424377},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5252013802528381},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.5147026181221008},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.4971640408039093},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.4942050278186798},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.4791076183319092},{"id":"https://openalex.org/C83163435","wikidata":"https://www.wikidata.org/wiki/Q3954104","display_name":"Security management","level":2,"score":0.4733579158782959},{"id":"https://openalex.org/C161036016","wikidata":"https://www.wikidata.org/wiki/Q956095","display_name":"Theory of constraints","level":2,"score":0.4418320059776306},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.413818359375},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.27621155977249146},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.2688143253326416},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.159823477268219},{"id":"https://openalex.org/C21547014","wikidata":"https://www.wikidata.org/wiki/Q1423657","display_name":"Operations management","level":1,"score":0.1510361135005951},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.14954471588134766},{"id":"https://openalex.org/C190248442","wikidata":"https://www.wikidata.org/wiki/Q839486","display_name":"Qualitative research","level":2,"score":0.10082367062568665},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C36289849","wikidata":"https://www.wikidata.org/wiki/Q34749","display_name":"Social science","level":1,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C59822182","wikidata":"https://www.wikidata.org/wiki/Q441","display_name":"Botany","level":1,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C144024400","wikidata":"https://www.wikidata.org/wiki/Q21201","display_name":"Sociology","level":0,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3468264.3468595","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3468264.3468595","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2106.03458","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2106.03458","pdf_url":"https://arxiv.org/pdf/2106.03458","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2106.03458","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2106.03458","pdf_url":"https://arxiv.org/pdf/2106.03458","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.6800000071525574}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":50,"referenced_works":["https://openalex.org/W606806371","https://openalex.org/W1482707767","https://openalex.org/W1490011260","https://openalex.org/W1503496369","https://openalex.org/W1509986753","https://openalex.org/W1527053175","https://openalex.org/W1603882355","https://openalex.org/W1646679479","https://openalex.org/W1969618572","https://openalex.org/W1971342410","https://openalex.org/W1985399396","https://openalex.org/W1991756463","https://openalex.org/W2047401676","https://openalex.org/W2055063347","https://openalex.org/W2058638038","https://openalex.org/W2058847904","https://openalex.org/W2064068790","https://openalex.org/W2089628081","https://openalex.org/W2115497642","https://openalex.org/W2122626138","https://openalex.org/W2123059002","https://openalex.org/W2146691185","https://openalex.org/W2147018965","https://openalex.org/W2177864412","https://openalex.org/W2329395632","https://openalex.org/W2353739181","https://openalex.org/W2394809607","https://openalex.org/W2523100100","https://openalex.org/W2620593348","https://openalex.org/W2738083230","https://openalex.org/W2766411424","https://openalex.org/W2790351125","https://openalex.org/W2883188794","https://openalex.org/W2885290579","https://openalex.org/W2889665541","https://openalex.org/W2947362543","https://openalex.org/W3003663372","https://openalex.org/W3022364011","https://openalex.org/W3049077356","https://openalex.org/W3090212251","https://openalex.org/W3105662788","https://openalex.org/W3107698292","https://openalex.org/W3107708718","https://openalex.org/W3109980583","https://openalex.org/W3197290425","https://openalex.org/W3214913126","https://openalex.org/W4213212995","https://openalex.org/W4229565728","https://openalex.org/W4229669668","https://openalex.org/W4250201092"],"related_works":["https://openalex.org/W1546533203","https://openalex.org/W2054080977","https://openalex.org/W1511554945","https://openalex.org/W2015439768","https://openalex.org/W4361008414","https://openalex.org/W3040823075","https://openalex.org/W2092147963","https://openalex.org/W2620765995","https://openalex.org/W1535784397","https://openalex.org/W3173382863"],"abstract_inverted_index":{"Several":[0],"disastrous":[1],"security":[2,31,68,83,164],"attacks":[3],"can":[4,122,146],"be":[5],"attributed":[6],"to":[7,21,41],"delays":[8,65],"in":[9,66,82,128,163],"patching":[10,57,60],"software":[11,30],"vulnerabilities.":[12],"While":[13],"researchers":[14,142],"and":[15,25,59,98,115,130,143,152],"practitioners":[16,144],"have":[17],"paid":[18],"significant":[19],"attention":[20],"automate":[22],"vulnerabilities":[23],"identification":[24],"patch":[26,32,84,165],"development":[27],"activities":[28,54],"of":[29,46,52,55,77,80,90,151,160],"management,":[33],"there":[34],"has":[35],"been":[36],"relatively":[37],"little":[38],"effort":[39],"dedicated":[40],"gain":[42],"an":[43],"in-depth":[44],"understanding":[45],"the":[47,56,78,103,107,119,126,131,149,158],"socio-technical":[48],"aspects,":[49],"e.g.,":[50],"coordination":[51,81,110,159],"interdependent":[53,112],"process":[58],"decisions,":[61,118],"that":[62,105,121],"may":[63],"cause":[64],"applying":[67],"patches.":[69],"We":[70],"report":[71],"on":[72],"a":[73],"Grounded":[74],"Theory":[75],"study":[76,136],"role":[79],"management.":[85,166],"The":[86,100],"reported":[87],"theory":[88,101],"consists":[89],"four":[91],"inter-related":[92],"dimensions,":[93],"i.e.,":[94],"causes,":[95],"breakdowns,":[96],"constraints,":[97],"mechanisms.":[99],"explains":[102],"causes":[104],"define":[106],"need":[108],"for":[109,141,156],"among":[111],"software/hardware":[113],"components":[114],"multiple":[116],"stakeholders\u2019":[117],"constraints":[120],"negatively":[123],"impact":[124],"coordination,":[125,129],"breakdowns":[127],"potential":[132],"corrective":[133],"measures.":[134],"This":[135],"provides":[137],"potentially":[138],"useful":[139],"insights":[140],"who":[145],"carefully":[147],"consider":[148],"needs":[150],"devise":[153],"suitable":[154],"solutions":[155],"supporting":[157],"interdependencies":[161],"involved":[162]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":2},{"year":2022,"cited_by_count":2},{"year":2021,"cited_by_count":1}],"updated_date":"2026-08-05T07:39:15.569665","created_date":"2021-07-05T00:00:00"}