{"id":"https://openalex.org/W4294978736","doi":"https://doi.org/10.1145/3555087","title":"Why, How and Where of Delays in Software Security Patch Management: An Empirical Investigation in the Healthcare Sector","display_name":"Why, How and Where of Delays in Software Security Patch Management: An Empirical Investigation in the Healthcare Sector","publication_year":2022,"publication_date":"2022-11-07","ids":{"openalex":"https://openalex.org/W4294978736","doi":"https://doi.org/10.1145/3555087"},"language":"en","primary_location":{"id":"doi:10.1145/3555087","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3555087","pdf_url":null,"source":{"id":"https://openalex.org/S4210183893","display_name":"Proceedings of the ACM on Human-Computer Interaction","issn_l":"2573-0142","issn":["2573-0142"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Human-Computer Interaction","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5041959990","display_name":"Nesara Dissanayake","orcid":"https://orcid.org/0000-0002-2873-137X"},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Nesara Dissanayake","raw_affiliation_strings":["The University of Adelaide, Adelaide, SA, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"The University of Adelaide, Adelaide, SA, Australia","institution_ids":["https://openalex.org/I5681781"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5049386320","display_name":"Mansooreh Zahedi","orcid":"https://orcid.org/0000-0001-6276-9956"},"institutions":[{"id":"https://openalex.org/I165779595","display_name":"The University of Melbourne","ror":"https://ror.org/01ej9dk98","country_code":"AU","type":"education","lineage":["https://openalex.org/I165779595"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Mansooreh Zahedi","raw_affiliation_strings":["The University of Melbourne, Melbourne, VIC, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"The University of Melbourne, Melbourne, VIC, Australia","institution_ids":["https://openalex.org/I165779595"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5032038453","display_name":"Asangi Jayatilaka","orcid":"https://orcid.org/0000-0003-2051-030X"},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Asangi Jayatilaka","raw_affiliation_strings":["The University of Adelaide, Adelaide, SA, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"The University of Adelaide, Adelaide, SA, Australia","institution_ids":["https://openalex.org/I5681781"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5103075476","display_name":"Muhammad Ali Babar","orcid":"https://orcid.org/0000-0001-9696-3626"},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Muhammad Ali Babar","raw_affiliation_strings":["The University of Adelaide, Adelaide, SA, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"The University of Adelaide, Adelaide, SA, Australia","institution_ids":["https://openalex.org/I5681781"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":4.6461,"has_fulltext":false,"cited_by_count":18,"citation_normalized_percentile":{"value":0.95256743,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":"6","issue":"CSCW2","first_page":"1","last_page":"29"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10430","display_name":"Software Engineering Techniques and Practices","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10430","display_name":"Software Engineering Techniques and Practices","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9980000257492065,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9980000257492065,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.7108208537101746},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.5850330591201782},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.5836279988288879},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.5575369000434875},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.5463006496429443},{"id":"https://openalex.org/keywords/process-management","display_name":"Process management","score":0.5171534419059753},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5041948556900024},{"id":"https://openalex.org/keywords/health-care","display_name":"Health care","score":0.4767930507659912},{"id":"https://openalex.org/keywords/risk-analysis","display_name":"Risk analysis (engineering)","score":0.47559913992881775},{"id":"https://openalex.org/keywords/business","display_name":"Business","score":0.4474669098854065},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.4409993588924408},{"id":"https://openalex.org/keywords/security-management","display_name":"Security management","score":0.42284488677978516},{"id":"https://openalex.org/keywords/political-science","display_name":"Political science","score":0.08661219477653503}],"concepts":[{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.7108208537101746},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.5850330591201782},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.5836279988288879},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.5575369000434875},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5463006496429443},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.5171534419059753},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5041948556900024},{"id":"https://openalex.org/C160735492","wikidata":"https://www.wikidata.org/wiki/Q31207","display_name":"Health care","level":2,"score":0.4767930507659912},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.47559913992881775},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.4474669098854065},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.4409993588924408},{"id":"https://openalex.org/C83163435","wikidata":"https://www.wikidata.org/wiki/Q3954104","display_name":"Security management","level":2,"score":0.42284488677978516},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.08661219477653503},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3555087","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3555087","pdf_url":null,"source":{"id":"https://openalex.org/S4210183893","display_name":"Proceedings of the ACM on Human-Computer Interaction","issn_l":"2573-0142","issn":["2573-0142"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Human-Computer Interaction","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.4399999976158142,"id":"https://metadata.un.org/sdg/17","display_name":"Partnerships for the goals"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":33,"referenced_works":["https://openalex.org/W606806371","https://openalex.org/W1244076508","https://openalex.org/W1482707767","https://openalex.org/W1490011260","https://openalex.org/W1919636199","https://openalex.org/W1969618572","https://openalex.org/W2085744143","https://openalex.org/W2097146584","https://openalex.org/W2111256197","https://openalex.org/W2117600460","https://openalex.org/W2123059002","https://openalex.org/W2153470826","https://openalex.org/W2157557193","https://openalex.org/W2162739315","https://openalex.org/W2165611922","https://openalex.org/W2167514255","https://openalex.org/W2295687471","https://openalex.org/W2460117687","https://openalex.org/W2561664829","https://openalex.org/W2608014122","https://openalex.org/W2617798520","https://openalex.org/W2889665541","https://openalex.org/W2899117127","https://openalex.org/W2963311060","https://openalex.org/W3003663372","https://openalex.org/W3022364011","https://openalex.org/W3049077356","https://openalex.org/W3107416433","https://openalex.org/W3109980583","https://openalex.org/W3173382863","https://openalex.org/W3214913126","https://openalex.org/W4229669668","https://openalex.org/W4288086169"],"related_works":["https://openalex.org/W96612179","https://openalex.org/W2770234245","https://openalex.org/W2987774938","https://openalex.org/W2566006169","https://openalex.org/W4256492088","https://openalex.org/W632915154","https://openalex.org/W4229499248","https://openalex.org/W2593162800","https://openalex.org/W2357829688","https://openalex.org/W2351319320"],"abstract_inverted_index":{"Numerous":[0],"security":[1,18,39,227],"attacks":[2],"that":[3,104,113],"resulted":[4],"in":[5,15,41,77,107,125,174,193],"devastating":[6],"consequences":[7],"can":[8,47],"be":[9,48],"traced":[10],"back":[11],"to":[12,96,122,185,213,222],"a":[13,17,61,91,131,147,225],"delay":[14],"applying":[16,38],"patch.":[19],"Despite":[20],"the":[21,45,78,114,126,137,143,153,160,165,194],"criticality":[22],"of":[23,63,68,93,118,133,149],"timely":[24,203,226],"patch":[25,69,127,138,176,195,228],"application,":[26],"not":[27],"much":[28],"is":[29,120,191],"known":[30],"about":[31],"why":[32],"and":[33,43,66,81,84,99,130,170,188,198,218],"how":[34,44],"delays":[35,46,106,119,124,134,169],"occur":[36,135],"when":[37],"patches":[40],"practice,":[42],"mitigated.":[49],"Based":[50],"on":[51],"longitudinal":[52],"data":[53,86],"collected":[54],"from":[55,74],"132":[56],"delayed":[57],"patching":[58],"tasks":[59],"over":[60],"period":[62],"four":[64],"years":[65],"observations":[67],"meetings":[70],"involving":[71],"eight":[72],"teams":[73],"two":[75],"organisations":[76],"healthcare":[79],"domain,":[80],"using":[82],"quantitative":[83],"qualitative":[85],"analysis":[87],"approaches,":[88],"we":[89,145],"identify":[90],"set":[92,148],"reasons":[94,167],"relating":[95],"technology,":[97],"people":[98],"organisation":[100],"as":[101,159],"key":[102],"explanations":[103],"cause":[105,117],"patching.":[108],"Our":[109,178],"findings":[110,179,210],"also":[111],"reveal":[112],"most":[115],"prominent":[116],"attributable":[121],"coordination":[123],"management":[128,196,229],"process":[129,197],"majority":[132],"during":[136],"deployment":[139],"phase.":[140],"Towards":[141],"mitigating":[142],"delays,":[144],"describe":[146],"strategies":[150,173],"employed":[151],"by":[152],"studied":[154],"practitioners.":[155],"This":[156],"research":[157],"serves":[158],"first":[161],"step":[162],"toward":[163],"understanding":[164],"practical":[166],"for":[168,183],"possible":[171],"mitigation":[172],"vulnerability":[175],"management.":[177],"provide":[180],"useful":[181],"insights":[182],"practitioners":[184],"understand":[186],"what":[187],"where":[189],"improvement":[190],"needed":[192],"guide":[199],"them":[200],"towards":[201],"taking":[202],"actions":[204],"against":[205],"potential":[206],"attacks.":[207],"Also,":[208],"our":[209],"help":[211],"researchers":[212],"invest":[214],"effort":[215],"into":[216],"designing":[217],"developing":[219],"computer-supported":[220],"tools":[221],"better":[223],"support":[224],"process.":[230]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":6},{"year":2024,"cited_by_count":5},{"year":2023,"cited_by_count":3},{"year":2022,"cited_by_count":1}],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2022-09-08T00:00:00"}