2020/12/01 by Nesara Dissanayake, Dissanayake, Nesara, Asangi Jayatilaka +5 · 3 citations
Computer Science · #FOS: Computer and information sciences #Software Engineering (cs.SE) #Software Engineering Research #Software Reliability and Analysis Research
paper · pdf · doi:10.48550/arxiv.2012.00544
openalex publication_date 2020/12/01 · openalex created_date 2022/07/25 · openalex updated_date 2026/07/28
Context: Software security patch management purports to support the process\nof patching known software security vulnerabilities. Given the increasing\nrecognition of the importance of software security patch management, it is\nimportant and timely to systematically review and synthesise the relevant\nliterature on this topic.\n Objective: This paper aims at systematically reviewing the state of the art\nof software security patch management to identify the socio-technical\nchallenges in this regard, reported solutions (i.e., approaches, tools, and\npractices), the rigour of the evaluation and the industrial relevance of the\nreported solutions, and to identify the gaps for future research.\n Method: We conducted a systematic literature review of 72 studies published\nfrom 2002 to March 2020, with extended coverage until September 2020 through\nforward snowballing.\n Results: We identify 14 socio-technical challenges, 18 solution approaches,\ntools and practices mapped onto the software security patch management process.\nWe provide a mapping between the solutions and challenges to enable a reader to\nobtain a holistic overview of the gap areas. The findings also reveal that only\n20.8% of the reported solutions have been rigorously evaluated in industrial\nsettings.\n Conclusion: Our results reveal that 50% of the common challenges have not\nbeen directly addressed in the solutions and that most of them (38.9%) address\nthe challenges in one phase of the process, namely vulnerability scanning,\nassessment and prioritisation. Based on the results that highlight the\nimportant concerns in software security patch management and the lack of\nsolutions, we recommend a list of future research directions. This study also\nprovides useful insights about different opportunities for practitioners to\nadopt new solutions and understand the variations of their practical utility.\n