UNDERSTANDING AND MANAGING COMPLEX SOFTWARE VULNERABILITIES: AN EMPIRICAL ANALYSIS OF OPEN-SOURCE OPERATING SYSTEMS

Abstract

There is a growing gap between practitioners and researchers: existing scholarly research on software vulnerabilities cannot adequately guide developers to effectively manage their vulnerabilities in the complex context of ‘software as amalgam’, tight coupling and open source. We respond to practitioners’ calls for more research on vulnerability management with a case of effective vulnerability management in the context of an open-source operating system (OSOS). Hence, our paper is aimed at bridging this gap with practice and discussing this overlooked concern in the academic literature: how do organizations effectively manage their vulnerabilities? We provide an empirical contribution with an extreme case of vulnerability management in a large OSOS (Debian). Our research uncovers behavioral dynamics and practices that foster responsiveness and adaptation in complex vulnerability management.