论文标题
软件安全补丁管理 - 对挑战，方法，工具和实践的系统文献综述
Software Security Patch Management -- A Systematic Literature Review of Challenges, Approaches, Tools and Practices
论文作者
论文摘要
上下文：软件安全补丁管理旨在支持修补已知软件安全漏洞的过程。鉴于对软件安全补丁管理的重要性的认识越来越多，因此系统地审查和综合有关此主题的相关文献是重要及时的。 目的：本文旨在系统地审查软件安全补丁管理的最新技术，以确定这方面的社会技术挑战，报告的解决方案（即方法，方法，工具和实践），评估解决方案的严格性以及所报告解决方案的工业相关性，并确定未来研究的差距。 方法：我们对2002年至2020年3月发表的72项研究进行了系统文献评论，并通过向前滚雪球进行了延长的覆盖范围。 结果：我们确定了14个社会技术挑战，18种解决方案方法，工具和实践映射到软件安全补丁程序管理过程中。我们提供了解决方案和挑战之间的映射，以使读者能够获得差距领域的整体概述。研究结果还表明，在工业环境中，仅对报告的解决方案进行了严格评估。 结论：我们的结果表明，解决方案中没有直接解决50％的共同挑战，并且其中大多数（38.9％）解决了该过程的一个阶段中的挑战，即脆弱性扫描，评估和优先级。基于强调软件安全补丁管理和缺乏解决方案的重要关注的结果，我们建议未来的研究方向列表。这项研究还提供了有关从业人员采用新解决方案并了解其实际实用性变化的不同机会的有用见解。
Context: Software security patch management purports to support the process of patching known software security vulnerabilities. Given the increasing recognition of the importance of software security patch management, it is important and timely to systematically review and synthesise the relevant literature on this topic. Objective: This paper aims at systematically reviewing the state of the art of software security patch management to identify the socio-technical challenges in this regard, reported solutions (i.e., approaches, tools, and practices), the rigour of the evaluation and the industrial relevance of the reported solutions, and to identify the gaps for future research. Method: We conducted a systematic literature review of 72 studies published from 2002 to March 2020, with extended coverage until September 2020 through forward snowballing. Results: We identify 14 socio-technical challenges, 18 solution approaches, tools and practices mapped onto the software security patch management process. We provide a mapping between the solutions and challenges to enable a reader to obtain a holistic overview of the gap areas. The findings also reveal that only 20.8% of the reported solutions have been rigorously evaluated in industrial settings. Conclusion: Our results reveal that 50% of the common challenges have not been directly addressed in the solutions and that most of them (38.9%) address the challenges in one phase of the process, namely vulnerability scanning, assessment and prioritisation. Based on the results that highlight the important concerns in software security patch management and the lack of solutions, we recommend a list of future research directions. This study also provides useful insights about different opportunities for practitioners to adopt new solutions and understand the variations of their practical utility.
