In a typical business IT environment, there are systems of systems; they are integrated, some communicate with external systems, and others do not. Different vendors might manage the systems. Examples of such systems are cloud services like cloud services, managed security services, human resource services, economy and logistics systems, and more. Some are legacy, others not.
These systems are evolving as we speak. Old vulnerabilities become visible, and new ones are detected. Microsoft releases patches every Tuesday, for instance, and other vendors also share information about vulnerabilities in their products. Vulnerability management is challenging for a single business. What challenges do businesses face in vulnerability management? Do they manage “to patch on the fly,” and are there dilemmas that hinder automatic patching?
The thesis should develop recommendations for effective vulnerability management in complex systems.