{"title":"The Current State of Security Governance and Compliance in Large-Scale Agile Development: A Systematic Literature Review and Interview Study","authors":"Sascha Nägele, Nathalie Schenk, F. Matthes","doi":"10.1109/CBI58679.2023.10187439","DOIUrl":"https://doi.org/10.1109/CBI58679.2023.10187439","url":null,"abstract":"Agile methodologies have gained popularity in software and information systems engineering due to their ability to enable rapid adaption to changing requirements and ensure business value creation in fast-paced environments. However, scaling agile to multiple teams presents challenges related to security governance and compliance. Traditional security activities struggle to keep pace with iterative agile methods. The tension between security and agility intensifies in scaled environments as governance and compliance procedures conflict with the desired autonomy of agile teams. With the increase in the number and complexity of security risks, it is imperative to better understand the current challenges and solution approaches for security governance in large-scale agile development (LSAD). To this end, we conducted a systematic literature review and an interview study involving nine industry experts. We identified 15 relevant challenges and analyzed existing LSAD frameworks concerning their solution approaches for achieving security governance and compliance. In addition, we contribute an overview of alternative solution approaches and propose five factors to balance control and autonomy to mitigate security challenges in LSAD. Our findings provide a foundation for developing well-grounded solution artifacts that address the identified challenges,","PeriodicalId":263266,"journal":{"name":"2023 IEEE 25th Conference on Business Informatics (CBI)","volume":"8 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-06-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125305410","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Intelligent service for monitoring the activities of an employee of an organization","authors":"D. Nazarov, A. Nazarov","doi":"10.1109/CBI58679.2023.10187419","DOIUrl":"https://doi.org/10.1109/CBI58679.2023.10187419","url":null,"abstract":"This article presents an architecture for an intelligent service aimed at monitoring employee working hours in an organization. The proposed architecture is flexible, scalable, and secure, offering tools for in-depth analysis of employee activities to identify areas for improvement and optimization. By implementing this architecture, organizations can effectively track employee working hours, identify inefficient use of work time, and uncover problem areas, ultimately leading to increased productivity, cost reduction, and an improved work environment. The intelligent service modules described function as a powerful tool for workflow optimization and enhanced employee productivity. The developed client application, “Screenshot of the Employee's Computer Screen,” facilitates automatic data collection from employee workstations, providing ample information for activity analysis. This data is then processed using an intelligent model to assess work productivity accurately and identify potential problems or areas for improvement. The article also discusses the implementation of an ETL process in the first version of the model for processing data from screenshots and the Development of a function that establishes a correspondence between the got and reference set of keywords. Overall, the intelligent service for monitoring employee working hours promises to automate personnel management processes, enhance work time data accuracy and reliability, and promote more efficient use of company resources.","PeriodicalId":263266,"journal":{"name":"2023 IEEE 25th Conference on Business Informatics (CBI)","volume":"31 2 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-06-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130443541","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Towards a contextual model of software engineering capabilities: Factors affecting team performance","authors":"O. Plant, J. Hillegersberg, Adina Aldea","doi":"10.1109/CBI58679.2023.10187552","DOIUrl":"https://doi.org/10.1109/CBI58679.2023.10187552","url":null,"abstract":"A prevalent research stream in the information systems domain is founded on the rationale that organizations need to establish and manage specific IT capabilities to achieve competitive advantage. More recently, research efforts have shifted from investigating organizational-level capabilities towards identifying team capabilities in order to support modern approaches to software engineering. The research at hand aims to identify contextual factors which influence these software engineering capabilities required by teams to achieve superior performance. To this end, we adopt a mixed-methods approach conducting a tertiary study and an empirical research component involving six domain experts. The tertiary study results in a taxonomy of 56 contextual factors which are then reduced and validated with regards to their relevance to software engineering teams through a Q-Sort ranking exercise and a subsequent focus group session. This results in a subset of 15 items which together form a contextual model of software engineering team capabilities along the dimensions technology, organization and environment. The paper discusses the mature research stream on information systems context in the new light of modern software engineering approaches. The resulting contextual model is of value to researchers and practitioners when analyzing their team context and deciding in which capabilities to invest.","PeriodicalId":263266,"journal":{"name":"2023 IEEE 25th Conference on Business Informatics (CBI)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-06-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130859011","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Digitalization in the Construction Industry: The Case of Documentation and Invoicing in Tunneling","authors":"O. Melnyk, Marco Huymajer, C. Huemer, R. Galler","doi":"10.1109/CBI58679.2023.10187588","DOIUrl":"https://doi.org/10.1109/CBI58679.2023.10187588","url":null,"abstract":"The digitalization of Architecture, Engineering, & Construction (AEC), specifically the tunneling sector, often lags behind other sectors. Today's invoicing process of tunneling projects frequently involves many manual and paper-based tasks, which are error-prone and time-consuming. Accordingly, replacing this with a fully digital process, from the tunnel face to the project owner, bears high economic potential. This article proposes an integrated digital documentation system for tunnel construction management and invoicing. A month-long case study with data from a real-life construction site is conducted to test the system's suitability. The managed data are exported to commonly used enterprise resource planning (ERP) systems for invoicing and compared to actual invoicing data. The case study has shown that the proposed approach is practical and helped streamline and improve the construction documentation processes in conventional tunnel construction. The proposed solution represents an incremental contribution to the digital transformation of the AEC sector.","PeriodicalId":263266,"journal":{"name":"2023 IEEE 25th Conference on Business Informatics (CBI)","volume":"43 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-06-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126626208","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Data-Driven Customization of Object Lifecycle Processes","authors":"Marius Breitmayer, L. Arnold, M. Reichert","doi":"10.1109/CBI58679.2023.10187572","DOIUrl":"https://doi.org/10.1109/CBI58679.2023.10187572","url":null,"abstract":"Object-aware processes are capable of automatically generating data-driven forms based on pre-specified object lifecycle processes. Thereby, lifecycle process states correspond to user forms, which comprise the object attributes required to complete the form and to transition to the next process state. The pre-specified flow logic of the steps within a state (i.e., the order in which object attributes shall be written), in turn, determines how the corresponding form is organized and how users are guided in filling the form fields. In practice, however, the order in which users interact with form fields is often user-specific. Even if the pre-specified logic of steps is perceived as intuitive by certain users, others may prefer filling the form in a different order. Although this flexibility constitutes a built-in feature of object lifecycle processes, any guidance not fully matching the mental model of a specific user decreases usability and increases mental effort. By learning from the previous interactions a particular user has had with an object-aware process, the presented approach aims at the data-driven customization of lifecycle processes and corresponding user forms. In particular, the approach enables the data-driven customization of forms for users frequently deviating from the standard guidance based on the adaptions automatically derived for the corresponding lifecycle processes. This enables valuable self-adaptions for both lifecycle processes and process-aware information systems in general.","PeriodicalId":263266,"journal":{"name":"2023 IEEE 25th Conference on Business Informatics (CBI)","volume":"163 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-06-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133756853","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A study of the impact of implementation of smart contracts in the sharing economy","authors":"Mikhail B. Vialtsev, Mikhail M. Komarov","doi":"10.1109/CBI58679.2023.10187204","DOIUrl":"https://doi.org/10.1109/CBI58679.2023.10187204","url":null,"abstract":"The sharing economy has shown significant growth in recent years, reinforced by the emergence and success of companies like Uber, Airbnb, eBay, etc. Consistently, it is attracting more and more attention from both the business and academic communities, which in turn are driving the development and adoption of new technologies in the sharing economy, such as smart contracts. However, which attributes of sharing economy business model would be most effectively modified by smart contracts and what would the qualitative effect? To answer these questions in this paper, we conducted a four-part study. First, we presented a description of the sharing economy and smart contract technology. Second, we considered the previously proposed generalized business model of a sharing economy company. Third, we identified the attributes of this business model to which smart contracts can be most effectively applied. Fourth, we qualitatively presented the effect of using smart contracts for each attribute.","PeriodicalId":263266,"journal":{"name":"2023 IEEE 25th Conference on Business Informatics (CBI)","volume":"31 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-06-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134140280","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
R. Calhau, S. Kokkula, David Cameron, G. Guizzardi, João Paulo A. Almeida
{"title":"Modeling Competence Framework Elements with an Ontology-based Approach","authors":"R. Calhau, S. Kokkula, David Cameron, G. Guizzardi, João Paulo A. Almeida","doi":"10.1109/CBI58679.2023.10187498","DOIUrl":"https://doi.org/10.1109/CBI58679.2023.10187498","url":null,"abstract":"Organizations are required to pay constant attention to human resource development in order to prosper. Competence frameworks have received increased attention in this context, as the availability of qualified people with the right combination of competences establishes itself as a major issue for organizational performance. This paper investigates the modeling of competence frameworks in Enterprise Architecture: (i) we identify a key set of competence-related concepts found in competence frameworks; (ii) analyze them using the Unified Foundational Ontology to build a reference Competence Ontology, and, then; (iii) propose well-founded representation patterns for competence modeling in the ArchiMate EA language, discussing how these patterns can be embedded in enterprise competence-based practices.","PeriodicalId":263266,"journal":{"name":"2023 IEEE 25th Conference on Business Informatics (CBI)","volume":"144 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-06-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124612982","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Awareness of the consequences of right-skewed effort and productivity distributions in software development","authors":"M. Jørgensen","doi":"10.1109/CBI58679.2023.10187494","DOIUrl":"https://doi.org/10.1109/CBI58679.2023.10187494","url":null,"abstract":"The available evidence suggests that many characteristics of software development are not symmetrically distributed but follow a right-skewed distribution, meaning that their value distributions have a long tail toward higher values. This right-skew may have important consequences for the effective management of software development work. In this paper, we focus on two right-skewed distributions relevant to software management processes, i.e., the right-skewed distributions of software development effort usage and productivity, and software professionals' awareness of important consequences of the right-skew. Our analysis, which is based on data from four empirical studies with software professionals, reveals that although most software professionals are aware of the right-skew of these two distributions, they may not fully appreciate several of the important management consequences of it. This includes its consequences for the communication of effort estimates, for the use of correct methods for adding effort estimates, and for team productivity. We argue that increasing the awareness of the management consequences of right-skewed distributions among software professionals may play a role in the improvement of software development management.","PeriodicalId":263266,"journal":{"name":"2023 IEEE 25th Conference on Business Informatics (CBI)","volume":"572 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-06-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133092458","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Semantically consistent transformation of behavioral and structural models","authors":"Tarek Skouti","doi":"10.1109/CBI58679.2023.10187590","DOIUrl":"https://doi.org/10.1109/CBI58679.2023.10187590","url":null,"abstract":"The use of multiple conceptual models and model transformations has been gaining increased research interest in recent years. However, several challenges, such as redundancy, inconsistency, complexity, maintainability, and language variations, still need to be addressed. The research question for this paper is how a semantically consistent model transformation can be achieved from different perspectives. To answer this question, the paper follows the design science research methodology. It presents three research objectives focused on reducing complexity, achieving clear traceability, and semantically consistent bi-directional transformation of models.","PeriodicalId":263266,"journal":{"name":"2023 IEEE 25th Conference on Business Informatics (CBI)","volume":"82 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-06-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128609705","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}