  Experts agree that keeping systems up to date is a powerful security measure.
Previous work found that users sometimes explicitly refrain from performing
timely updates, e.g., due to bad experiences which has a negative impact on
end-user security. Another important user group has been investigated less
extensively: system administrators, who are responsible for keeping complex and
heterogeneous system landscapes available and secure.
  In this paper, we sought to understand administrators' behavior, experiences,
and attitudes regarding updates in a corporate environment. Based on the
results of an interview study, we developed an online survey and quantified
common practices and obstacles (e.g., downtime or lack of information about
updates). The findings indicate that even experienced administrators struggle
with update processes as the consequences of an update are sometimes hard to
assess. Therefore, we argue that more usable monitoring and update processes
are essential to guarantee IT security at scale.
