Organizations use various resources to achieve business objectives, and for financial gain. In modern business, knowledge is a critical resource, and organizations cannot afford not to manage it. Knowledge Management (KM) aims to support learning and to create value for the organization. Based on three levels of inquiry (why, what, how), work presented in this thesis includes a synthesized view of the existing body of knowledge concerning KM and hence a holistic characterization of KM. This characterization reveals a strong dependency between KM and Learning Organization (LO). Neither of them can be successful without the other. We show that a KM project resulting in an IT-supported knowledge repository is a suitable way to start when the intention is to initiate KM work. Thus, our research focuses on ITsupported knowledge repositories. Large numbers of KM projects fail, and organizations lack support for their KM undertakings. These are the main problems that our research addresses. In order for an IT-supported knowledge repository to be successful, it must be used. Thus, the content of the repository is critical for success. Our work reveals that the process of capturing new knowledge is critical if the knowledge repository is to include relevant and updated knowledge. With the purpose of supporting the capture process, this thesis provides a detailed characterization of the capture process as well as guidance aiming to facilitate the implementation of the capture process in such a way that knowledge is continuously captured, also after the KM implementation project is completed. We argue that the continuous capture of new knowledge which can potentially be stored in the knowledge repository will, in the long term perspective, have a positive influence on the usefulness of the repository. This will most likely increase the number of users of the repository and accordingly increase the number of successful KM projects. All the work presented in this thesis is the result of a qualitative research process comprising a literature review and an empirical study that were carried out in parallel. The empirical study is a case study inspired by action research, which involved participation in the project Efficient Knowledge Management and Learning in Knowledge Intensive Organizations (EKLär).

Risk management has become recognized as a best practice in the software industry. Controlling risks improves essential software development features such as product quality, planning precision and cost-efficiency. For this reason, the inclusion of risk management in software development is an important factor to consider if one wishes to achieve project success. Agile software development models claim to be risk-driven. They state that their iterative approach enables continuous attention to risks and that the risks can be reduced by practices such as continuous software integration and early testing. In reality, however, the agile development models implement few risk management practices. The research problem addressed in this thesis is multi-faceted. The problem concerns the lack of explicit risk management practices in agile development. However, it also concerns the need to address risk management on an organization-wide basis. In addition, it concerns the conflict that emerges from trying to merge the agile process with standard industrial processes, such as risk management, without compromising agility. The goal of this thesis is to explore integration as a solution for addressing the lack of risk management in the agile model based on empirical research. It involves (a) outlining a model integrating the agile and risk management processes on an organization-wide basis, and (b) providing a foundation for its extension. The results show that, within the scope of this research, the proposed solution is a valid candidate for improving the agile situation. However, it is still in its infancy. It does not claim to be complete but needs to be further elaborated and complemented with details. Hence, we outline the model and provide a foundation established in empirical investigation for extending it in future research.

Social engineering denotes, within the realm of security, a type of attack against the human element during which the assailant induces the victim to release information or perform actions they should not. Our research on social engineering is divided into three areas: understanding, measuring and protecting. Understanding deals with finding out more about what social engineering is, and how it works. This is achieved through the study of previous work in information security as well as other relevant research areas. The measuring area is about trying to find methods and approaches that put numbers on an organization’s vulnerability to social engineering attacks. Protecting covers the ways an organization can use to try to prevent attacks. A common approach is to educate the users on typical attacks, assailants, and their manipulative techniques. In many cases there are no preventive techniques, dealing with the human element of security, in place. The results show that social engineering is a technique with a high probability of success. Furthermore, defense strategies against it are complicated, and susceptibility to it is difficult to measure. Important contributions are a model describing social engineering attacks and defenses, referred to as the Cycle of Deception, together with a thorough discussion on why and how social engineering works. We also propose new ways of conducting social engineering penetration testing and outline a set of recommendations for protection. It is crucial to involve managers more, but also to train the users with practical exercises instead of theoretical education, for example, by combining measuring exercises and penetration testing with training. We also discuss the future threat of Automated Social Engineering, in which software with a simple form of artificial intelligence can be used to act as humans using social engineering techniques online, making it quite hard for Internet users to trust anyone they communicate with online.

The purpose of this research is to present a means of knowledge capture in form of patterns that are solutions to reoccurring problems for business-to-business (B2B) organizations. Using empirical data, we examine the processes involved in the B2B engagement and capture valuable solutions as best practices. The collection of patterns forms a pattern language for B2B engagements that addresses operational, communication and collaboration areas of the B2B environment. The thesis is organized into three parts. Part I presents an overview of the work tying Part II and Part III. It contains problem, research objective, research process, contribution, result, publications, and thesis structure. Part II presents the first set of patterns developed. Part III builds up on the work in Part II by taking an in-depth study using more organizations to expound on the pattern language. Patterns developed in this thesis essentially are best practices in the B2B domain. Natural language is used to present the knowledge embedded in the patterns, i.e. solutions and suggestions that give advice on how the pattern is to be applied in a real case scenario. In some cases, this knowledge constitutes an organizational design proposal serving as a suggestion or inspiration for design B2B engagements in organizations. Citations are used in the motivation field of pattern to emphasize the reason for using industry practices and experience. The pattern validation process is performed after pattern development, and it showed the external consistency of the knowledge embedded in the developed patterns. The research result shows that organizations appreciate and are willing to participate in capturing best practices in the form of organizational patterns. These patterns are seen as generic and abstract organizational designs that can be adapted and reused in practice.

Computing devices are becoming wireless, smaller and embedded into other artifacts. Some of them are mobile while others are built into the environment. The novel technologies are also becoming more dependent of communication with other computing devices over different kinds of networks. These interconnected devices constitute locally and globally distributed service environments that will enforce new requirements on the design of software systems. These new type of environments provide both opportunities for new types of applications as well as a number of new problems that will have to be addressed. One approach that have been suggested both in order to provide new functionalities and as a possible solution to some of the problems is to try and collect and incorporate aspects of the /context/ of a person, activity or device as a part of the computer system. This thesis addresses some issues that have to be considered when designing this kind of systems. In particular the thesis examines how to design middleware that can support the creation of context aware applications. As a part of this work several instances of such systems have been implemented and put in use and tested in various applications. Some key problems with respect to the design of context information middleware are also identified and examined. One question that is addressed concerns the clash between the need for internal representations of context information and the goal of middleware to support a broad range of applications. Another problem that has been addressed concerns how to create means for context aware service discovery in ubiquitous computing environments. Various mechanisms that address these problems have been implemented and tested. Finally the work addresses issues related to the role of the users in this kind of systems. Implementations and experiments have been performed where users take more active roles in aspects of system maintenance and adaptation as well as in the interpretation and representation of context information. / QC 20100802

A theory of many-sorted implicative conceptual systems (abbreviated msic-systems) is presented. Examples of msic-systems include legal systems, normative systems, systems of rules and instructions, and systems expressing policies and various kinds of scientific theories. In computer science, msic-systems can be used in, for instance, legal information systems, decision support systems, and multi-agent systems. In the thesis, msic-systems are studied from a logical and algebraic perspective aiming at clarifying their structure and developing effective methods for representing them. Of special interest are the most narrow links or joinings between different strata in a system, that is between subsystems of different sorts of concepts, and the intermediate concepts intervening between such strata. Special emphasis is put on normative systems, and the role that intermediate concepts play in such systems, with an eye on knowledge representation issues. Normative concepts are constructed out of descriptive concepts using operators based on the Kanger-Lindahl theory of normative positions. An abstract architecture for a norm-regulated multi-agent system is suggested, containing a scheme for how normative positions will restrict the set of actions that the agents are permitted to choose from. Technical results inlude a characterization of an msic-system in terms of the most narrow joinings between different strata, characterization of the structure of the most narrow joinings between two strata, conditions for the extendability of intermediate concepts, and finally, a specification of the conditions such that the Boolean operations on intermediate concepts will result in intermediate concepts and characterization of most narrow joinings in terms of weakest grounds and strongest consequences. / QC 20100901

Object-oriented programming relies on sharing and the mutable states of objects for common data structures, patterns and programming idioms. Sharing and mutable state is a powerful but dangerous combination. Uncontrolled aliasing risks causing representation exposure, where an object's state is exposed and modifiable out of the control of its conceptually owning object. This breaks encapsulation, and hence, in extension, abstraction. Contemporary object-oriented programming languages' support for alias encapsulation is mediocre and easily circumvented. To this end, several proposals have been put forward that strengthen encapsulation to enable construction of more reliable systems and formally reasoning about properties of programs. These systems are vastly superior to the constructs found in for example C++, Java or C#, but have yet to gain acceptance outside the research community. In this thesis, we present three constructs for alias management on top of a deep ownership types system in the context of the Joline programming language. Our constructs are fully statically checkable and impose little run-time overhead. We show the formal semantics and soundness proof for our constructs as well as their formal and informal aliasing properties. We show applications and extensions and perform a practical evaluation of our system with our implemented Joline compiler. The evaluation suggests that our constructs are compatible with real-world programming, makes use of some of our own proposed patterns, and encourages further practical studies of programming with ownership-based constructs for alias management. / QC 20100928

In many industries today, the speed and costs with which new products are delivered to customers provide the basis for competitive advantage. Electronic business (e-business) is a concept that shortens the “time to market” and enables transacting at lower costs. Currently, one of the main limitations in the exploitation of e-business is the lack of efficient Information System (IS) integration, both in intra- and cross-enterprise environments. Intra-enterprise integration is complex, as the business needs and the underlying information systems do not evolve in accordance. In the cross-enterprise context, transparent system integration is hardly achievable due to the incompatibility of the services of the involved partners. This means that the future success of the integration depends heavily on the possibilities offered in terms of interoperability among the involved enterprises. The Business Process Management (BPM) discipline addresses this challenge, as processes have been recognized as key mechanisms through which most intra- and cross-enterprise interactions take place. The development of methods for successful integration of process models is one of the essential issues for the use of the BPM approach in the application and evolution of e-business. In this thesis, we address two topics in the area of business process management: 1) intra-enterprise process integration which concerns alignment between the internal business processes and information systems enclosed in the form of software services and 2) cross-enterprise integration which concerns coordination of the internal business processes of an enterprise with the processes of its suppliers, intermediaries, or customers. The goal of the thesis is to add theoretical and applicable knowledge to the field of business process management by using the proposed approaches for improvement of process integration in intra- and cross-enterprise contexts. / QC 20100929

The research reported here is about improvement of the ICT security management process in non-commercial organisations in order to reduce possible financial damage, taking into consideration the realities found in developing countries. The research took place in a developing country—Tanzania, where five organisations were involved. The study is organised into seven papers covering: the state of ICT security management in the organisations; prerequisites when utilising the existing ICT security management approaches in attaining a solution for managing ICT security in the organisations; issues and challenges of managing ICT security; important aspects to be taken into consideration in order to successfully manage ICT security; and how the management of ICT security in non-commercial organisations could be improved. Among others, the research was motivated by the observed need for bridging the perception gap between the management and technicians when dealing with the ICT security problem, and consequently extending to a common understanding by the staff in the various departments and specialities within and between the departments. The thesis contributes to increased empirical knowledge on the importance of the holistic ICT security management process. Particularly, our main contribution is the proposed holistic approach for managing ICT security in non-commercial organisations, organised in the form of guidelines with two main phases: the initialisation phase which involved the introduction of the ICT security management process in the organisation; and the internalised and continuous phase.

<p>This thesis concerns the relationship between aspects of cognitive differences and interface design in the context of visual impairment. Among a number of sources of cognitive differences studied, this work focuses on Witkin’s Cognitive Style Theory (1971). According to this theory people are more or less field-dependent. A field-independent person has good analytical and restructuring skills while the field-dependent individual has a more holistic approach and good inter-personal skills. According to several researchers, a number of design aspects such as dialogue style, user versus system guiding etc., can be designed to accommodate these differences in cognitive style. An interview study gives some support to the hypothesis that this relationship between cognitive style and design aspects also is relevant in a context of visual impairment.</p>