{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,6]],"date-time":"2026-03-06T18:00:10Z","timestamp":1772820010183,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":51,"publisher":"ACM","license":[{"start":{"date-parts":[[2021,8,18]],"date-time":"2021-08-18T00:00:00Z","timestamp":1629244800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2021,8,20]]},"DOI":"10.1145\/3468264.3468595","type":"proceedings-article","created":{"date-parts":[[2021,8,19]],"date-time":"2021-08-19T01:44:18Z","timestamp":1629337458000},"page":"793-805","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":10,"title":["A grounded theory of the role of coordination in software security patch management"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-2873-137X","authenticated-orcid":false,"given":"Nesara","family":"Dissanayake","sequence":"first","affiliation":[{"name":"University of Adelaide, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6276-9956","authenticated-orcid":false,"given":"Mansooreh","family":"Zahedi","sequence":"additional","affiliation":[{"name":"University of Adelaide, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2051-030X","authenticated-orcid":false,"given":"Asangi","family":"Jayatilaka","sequence":"additional","affiliation":[{"name":"University of Adelaide, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9696-3626","authenticated-orcid":false,"given":"Muhammad Ali","family":"Babar","sequence":"additional","affiliation":[{"name":"University of Adelaide, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2021,8,18]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/3236024.3236061"},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2017.2730870"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2012.32"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/1180875.1180929"},{"key":"e_1_3_2_1_5_1","unstructured":"Huseyin Cavusoglu Hasan Cavusoglu and Jun Zhang. 2006. Economics of Security Patch Management. In WEIS. Citeseer 1\u201310.  Huseyin Cavusoglu Hasan Cavusoglu and Jun Zhang. 2006. Economics of Security Patch Management. In WEIS. Citeseer 1\u201310."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1287\/mnsc.1070.0794"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1057\/s41265-016-0005-7"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/1323293.1294283"},{"key":"e_1_3_2_1_9_1","unstructured":"Kevin Crowston. 2003. A taxonomy of organizational dependencies and coordination mechanisms. Organizing Business Knowledge: The MIT Process Handbook 85\u2013108.  Kevin Crowston. 2003. A taxonomy of organizational dependencies and coordination mechanisms. Organizing Business Knowledge: The MIT Process Handbook 85\u2013108."},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"crossref","unstructured":"Andrew H. Van de Ven Andre L. Delbecq and Richard Koenig Jr. 1976. Determinants of Coordination Modes within Organizations. American Sociological Review 322\u2013338.  Andrew H. Van de Ven Andre L. Delbecq and Richard Koenig Jr. 1976. Determinants of Coordination Modes within Organizations. American Sociological Review 322\u2013338.","DOI":"10.2307\/2094477"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1287\/ijoc.2014.0638"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243794"},{"key":"e_1_3_2_1_13_1","unstructured":"Nesara Dissanayake Asangi Jayatilaka Mansooreh Zahedi and M Ali Babar. 2020. Software Security Patch Management\u2013A Systematic Literature Review of Challenges Approaches Tools and Practices. arxiv:2012.00544.  Nesara Dissanayake Asangi Jayatilaka Mansooreh Zahedi and M Ali Babar. 2020. Software Security Patch Management\u2013A Systematic Literature Review of Challenges Approaches Tools and Practices. arxiv:2012.00544."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23126"},{"key":"e_1_3_2_1_15_1","unstructured":"Melissa Eddy and Nicole Perlroth. 2020. Cyber Attack Suspected in German Woman\u2019s Death. https:\/\/www.nytimes.com\/2020\/09\/18\/world\/europe\/cyber-attack-germany-ransomeware-death.html?smid=tw-share  Melissa Eddy and Nicole Perlroth. 2020. Cyber Attack Suspected in German Woman\u2019s Death. https:\/\/www.nytimes.com\/2020\/09\/18\/world\/europe\/cyber-attack-germany-ransomeware-death.html?smid=tw-share"},{"key":"e_1_3_2_1_16_1","article-title":"Best Practices in Project Management Through a Grounded Theory Lens","volume":"6","author":"Georgieva Svetla","year":"2008","unstructured":"Svetla Georgieva and George Allan . 2008 . Best Practices in Project Management Through a Grounded Theory Lens . Electronic Journal of Business Research Methods , 6 , 1 (2008). Svetla Georgieva and George Allan. 2008. Best Practices in Project Management Through a Grounded Theory Lens. Electronic Journal of Business Research Methods, 6, 1 (2008).","journal-title":"Electronic Journal of Business Research Methods"},{"key":"e_1_3_2_1_17_1","volume-title":"Theoretical Sensitivity: Advances in the Methodology of Grounded Theory","author":"Glaser Barney G.","year":"1978","unstructured":"Barney G. Glaser . 1978 . Theoretical Sensitivity: Advances in the Methodology of Grounded Theory . Sociology Press , Mill Valley, CA . Barney G. Glaser. 1978. Theoretical Sensitivity: Advances in the Methodology of Grounded Theory. Sociology Press, Mill Valley, CA."},{"key":"e_1_3_2_1_18_1","volume-title":"Basics of Grounded Theory Analysis: Emergence vs Forcing","author":"Glaser Barney G.","unstructured":"Barney G. Glaser . 1992. Basics of Grounded Theory Analysis: Emergence vs Forcing . Sociology Press , Mill Valley, CA . Barney G. Glaser. 1992. Basics of Grounded Theory Analysis: Emergence vs Forcing. Sociology Press, Mill Valley, CA."},{"key":"e_1_3_2_1_19_1","volume-title":"The Grounded Theory Perspective III: Theoretical Coding","author":"Glaser Barney G.","unstructured":"Barney G. Glaser . 2005. The Grounded Theory Perspective III: Theoretical Coding . Sociology Press , Mill Valley, CA . Barney G. Glaser. 2005. The Grounded Theory Perspective III: Theoretical Coding. Sociology Press, Mill Valley, CA."},{"key":"e_1_3_2_1_20_1","volume-title":"Strauss","author":"Glaser Barney G.","year":"1967","unstructured":"Barney G. Glaser and Anselmo L . Strauss . 1967 . The Discovery of Grounded Theory: Strategies for Qualitative Research. Aldine Transaction, Chicago . Barney G. Glaser and Anselmo L. Strauss. 1967. The Discovery of Grounded Theory: Strategies for Qualitative Research. Aldine Transaction, Chicago."},{"key":"e_1_3_2_1_21_1","unstructured":"Dan Goodin. 2017. Failure to patch two-month-old bug led to massive Equifax breach. https:\/\/arstechnica.com\/information-technology\/2017\/09\/massive-equifax-breach-caused-by-failure-to-patch-two-month-old-bug\/  Dan Goodin. 2017. Failure to patch two-month-old bug led to massive Equifax breach. https:\/\/arstechnica.com\/information-technology\/2017\/09\/massive-equifax-breach-caused-by-failure-to-patch-two-month-old-bug\/"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/3230833.3232855"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2007.12"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/381694.378798"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2010.10.009"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-011-9161-0"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/NOMS.2012.6211988"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP48549.2020.00015"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/203330.203345"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.5465\/amr.1999.2553248"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134072"},{"key":"e_1_3_2_1_32_1","volume-title":"Keepers of the Machines: Examining How System Administrators Manage Software Updates. In Fifteenth Symposium on Usable Privacy and Security (SOUPS","author":"Li Frank","year":"2019","unstructured":"Frank Li , Lisa Rogers , Arunesh Mathur , Nathan Malkin , and Marshini Chetty . 2019 . Keepers of the Machines: Examining How System Administrators Manage Software Updates. In Fifteenth Symposium on Usable Privacy and Security (SOUPS 2019). USENIX Association, 273\u2013288. Frank Li, Lisa Rogers, Arunesh Mathur, Nathan Malkin, and Marshini Chetty. 2019. Keepers of the Machines: Examining How System Administrators Manage Software Updates. In Fifteenth Symposium on Usable Privacy and Security (SOUPS 2019). USENIX Association, 273\u2013288."},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/99332.99367"},{"key":"e_1_3_2_1_34_1","volume-title":"Malone and Kevin Crowston","author":"Thomas","year":"1991","unstructured":"Thomas W. Malone and Kevin Crowston . 1991 . Toward an interdisciplinary theory of coordination. Organizing Business Knowledge: The MIT Process Handbook . Thomas W. Malone and Kevin Crowston. 1991. Toward an interdisciplinary theory of coordination. Organizing Business Knowledge: The MIT Process Handbook."},{"key":"e_1_3_2_1_35_1","unstructured":"Lee Mathews. 2017. Equifax Data Breach Impacts 143 Million Americans. https:\/\/www.forbes.com\/sites\/leemathews\/2017\/09\/07\/equifax-data-breach-impacts-143-million-americans\/##1abcaed0356f  Lee Mathews. 2017. Equifax Data Breach Impacts 143 Million Americans. https:\/\/www.forbes.com\/sites\/leemathews\/2017\/09\/07\/equifax-data-breach-impacts-143-million-americans\/##1abcaed0356f"},{"key":"e_1_3_2_1_36_1","first-page":"289","article-title":"Multiteam systems","volume":"2","author":"Mathieu John E.","year":"2001","unstructured":"John E. Mathieu , Michelle A. Marks , and Stephen J. Zaccaro . 2001 . Multiteam systems . Handbook of Industrial, Work and Organizational Psychology , 2 (2001), 289 \u2013 313 . John E. Mathieu, Michelle A. Marks, and Stephen J. Zaccaro. 2001. Multiteam systems. Handbook of Industrial, Work and Organizational Psychology, 2 (2001), 289\u2013313.","journal-title":"Handbook of Industrial, Work and Organizational Psychology"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.48"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1201\/1086\/43808.12.5.20031101\/78486.2"},{"key":"e_1_3_2_1_39_1","volume-title":"Proceedings of the 19th USENIX Systems Administration Conference. IEEE, 6\u20136.","author":"Potter Shaya","year":"2005","unstructured":"Shaya Potter and Jason Nieh . 2005 . Reducing Downtime Due to System Maintenance and Upgrades . In Proceedings of the 19th USENIX Systems Administration Conference. IEEE, 6\u20136. Shaya Potter and Jason Nieh. 2005. Reducing Downtime Due to System Maintenance and Upgrades. In Proceedings of the 19th USENIX Systems Administration Conference. IEEE, 6\u20136."},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.22323\/1.133.0031"},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2018.2796554"},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2020.2989666"},{"key":"e_1_3_2_1_43_1","unstructured":"Accenture Security. 2020. 2020 Cyber Threatscape Report. https:\/\/www.accenture.com\/_acnmedia\/PDF-136\/Accenture-2020-Cyber-Threatscape-Full-Report.pdf  Accenture Security. 2020. 2020 Cyber Threatscape Report. https:\/\/www.accenture.com\/_acnmedia\/PDF-136\/Accenture-2020-Cyber-Threatscape-Full-Report.pdf"},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/3368089.3409724"},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.6028\/NIST.SP.800-40r3"},{"key":"e_1_3_2_1_46_1","volume-title":"Participant Observation","author":"Spradley James P.","unstructured":"James P. Spradley . 1980. Participant Observation ( 1 st ed.). Rinehart and Winston , Austin, TX . James P. Spradley. 1980. Participant Observation (1st ed.). Rinehart and Winston, Austin, TX.","edition":"1"},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1145\/2884781.2884833"},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2012.02.017"},{"key":"e_1_3_2_1_49_1","volume-title":"Sixteenth Symposium on Usable Privacy and Security (SOUPS","author":"Tiefenau Christian","year":"2020","unstructured":"Christian Tiefenau , Maximilian H\u00e4ring , Katharina Krombholz , and Emanuel von Zezschwitz . 2020 . Security, Availability, and Multiple Information Sources: Exploring Update Behavior of System Administrators . In Sixteenth Symposium on Usable Privacy and Security (SOUPS 2020). USENIX Association, 239\u2013258. Christian Tiefenau, Maximilian H\u00e4ring, Katharina Krombholz, and Emanuel von Zezschwitz. 2020. Security, Availability, and Multiple Information Sources: Exploring Update Behavior of System Administrators. In Sixteenth Symposium on Usable Privacy and Security (SOUPS 2020). USENIX Association, 239\u2013258."},{"key":"e_1_3_2_1_50_1","volume-title":"Grounded Theory for Qualitative Research: A Practical Guide","author":"Urquhart Cathy","unstructured":"Cathy Urquhart . 2013. Grounded Theory for Qualitative Research: A Practical Guide . Sage . Cathy Urquhart. 2013. Grounded Theory for Qualitative Research: A Practical Guide. Sage."},{"key":"e_1_3_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1109\/INM.2011.5990544"}],"event":{"name":"ESEC\/FSE '21: 29th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering","location":"Athens Greece","acronym":"ESEC\/FSE '21","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering"]},"container-title":["Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3468264.3468595","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3468264.3468595","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T21:24:51Z","timestamp":1750195491000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3468264.3468595"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,8,18]]},"references-count":51,"alternative-id":["10.1145\/3468264.3468595","10.1145\/3468264"],"URL":"https:\/\/doi.org\/10.1145\/3468264.3468595","relation":{},"subject":[],"published":{"date-parts":[[2021,8,18]]},"assertion":[{"value":"2021-08-18","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}