Context: Today’s software development industry requires high-speed software delivery from the development team. In order to do this, organizations make transformation from their conventional software development method to agile development method while preserving customer satisfaction. Even though this approach is becoming popular development method, from security point of view, it has some disadvantage. Because, this method has several constraints imposed such as lack of a complete overview of a product, higher development pace and lack of documentation. Although security-engineering (SE) process is necessary in order to build secure software, no SE process is developed specifically for agile model. As a result, SE processes that are commonly used in waterfall model are being used in agile models. However, there is a clash or disparity between the established waterfall SE processes and the ideas and methodologies proposed by the agile manifesto. This means that, while agile models work with short development increments that adapt easily to change, the existing SE processes work in plan-driven development setting and try to reduce defects found in a program before the occurrence of threats through heavy and inflexible process. This study aims at bridging the gap in agile model and security by providing insightful understanding of the SE process that are used in the current agile industry. Objectives: The objectives of this thesis are to identify and evaluate security activities from high-profile waterfall SE-process that are used in the current agile industry. Then, to suggest the most compatible and beneficial security activities to agile model based on the study results. Methods: The study involved two approaches: systematic literature review and survey. The systematic literature review has two main aims. The first aim is to gain a comprehensive understanding of security in an agile process model; the second one is to identify high-profile SE processes that are commonly used in waterfall model. Moreover, it helped to compare the thesis result with other previously done works on the area. A survey is conducted to identify and evaluate waterfall security activities that are used in the current agile industry projects. The evaluation criteria were based on the security activity integration cost and benefit provides to agile projects. Results: The results of the systematic review are organized in a tabular form for clear understanding and easy analysis. High-profile SE processes and their activities are obtained. These results are used as an input for the survey study. From the survey study, security activities that are used in the current agile industry are identified. Furthermore, the identified security activities are evaluated in terms of benefit and cost. As a result the best security activities, that are compatible and beneficial, are investigated to agile process model. Conclusions: To develop secure software in agile model, there is a need of SE-process or practice that can address security issues in every phase of the agile project lifecycle. This can be done either by integrating the most compatible and beneficial security activities from waterfall SE processes with agile process or by creating new SE-process. In this thesis, it has been found that, from the investigated high-profile waterfall SE processes, none of the SE processes was fully compatible and beneficial to agile projects. / (046) 73 6136215

Purpose - The primary aim of this study is to explore the intricacies of knowledge management within theframework of large-scale digital and agile projects. This was undertaken within the context of a specificmanufacturing project referred to as 'Project X'. The project provided an opportunity to delve into the processesof knowledge creation, sharing, and utilization, and to identify the barriers of these processes, creating a morecomprehensive understanding of the subject. Method - An abductive exploratory single case study approach was employed, focusing on Company X as thesingle case company. The study utilized a combination of data collection methods, including document analysisand qualitative interviews. The interviews were conducted in three waves: exploratory, semi-structured, andvalidatory. The data obtained from the interviews and document analysis were analysed using thematic analysisand content analysis. Findings - The study found that knowledge creation is impeded by lack of communication and managingresources. Knowledge sharing was hindered by a changing project landscape and the lack of 'knowledgechampions'. Knowledge utilization was found to be affected by lack of structure, internal resistance to change,and a lack of knowledge repository. Theoretical contribution - This study contributes to the knowledge management literature by providing insightsinto the complexities of managing knowledge within the context of digital and agile projects in the manufacturingindustry. It underscores the pivotal role of communication, resource management, and organizational culture ineffective knowledge management and opens new avenues to explore and understand these areas. Managerial implications - From a practical standpoint, this study underscores the need for organizations toprioritize effective communication and resource management in the pursuit of effective knowledge management.Organizations should work towards creating a favourable environment for knowledge sharing and strive to bridgeknowledge gaps through structured storage and retrieval of information. The findings also provide a prioritycharting of recommendations to onset barriers based on value and effort. Limitations and future research - While this study provides important insights into knowledge management indigital and agile projects, it is not without limitations. It was confined to a single project within onemanufacturing company, which may limit the generalizability of the findings. Future research should consider alarger sample size, spanning different companies and industries. Additionally, further exploration of the role oforganizational culture and the dynamics of change resistance in knowledge management would be beneficial.

COSMIC metodas apibrėžia principus, taisykles ir standartinio funkcinio dydžio matavimo procesą. Šio metodo realizacija Agile projektuose, padės prognozuoti konkrečios užduoties atlikimo laiką ankstyvoje planavimo stadijoje. Netikslus darbo imlumo įvertinimas planavimo stadijoje gali tapti rimta problema, dėl ko gali nepavykti įgyvendinti projekto, arba jo dalies, laiku. Vartotojų scenarijai yra vertinami SP, kurie nėra verčiami į laikinę skalę, kas dar labiau apsunkina tikslų darbo imlumo įvertinimą pradinėje projekto ir užduočių planavimo stadijoje. Šiame darbe atliekama detali COSMIC metodo analizė, apžvelgiami esami įrankiai, skirti Agile projektams. Įsitikinama, kad nėra sukurto įrankio, leidžiančio prognozuoti vartotojų scenarijų atlikimo laiką, sujungus COSMIC su istoriniais darbų atlikimo duomenimis. Darbe iškeltų tikslų pasiekimui buvo atliktas trijų dalių eksperimentinis tyrimas kurio metu paaiškėjo, kad COSMIC metodo apjungimas su istoriniais darbų atlikimo duomenimis gali pateikti panašią ar net geresnę prognozę, lyginant su programuotojų komandos įvertinimu. Taip pat pateikiamos idėjos įrankio korekcijai, jos realizuojamos ir kartojamas eksperimentas. Aptariami gauti rezultatai ir pateikiamos išvados. / COSMIC method defines principles, rules and the process of standard functional size measurement. Method implementation in Agile projects will help forecasting the completion time for a specific task in the early planning stages. Inaccurate task capacity estimation in the planning stage can become a serious problem which in turn may lead to not being able to complete parts of the assignment or even the whole project. User stories are being evaluated as SP which are not converted into a timescale which further complicates accurate job receptivity in the early project and task planning stage. Within this paper a detailed COSMIC method analysis is being performed as well as a review of existing Agile project tools. Also making sure that there are no other tools which allow the forecast of user story completion time by merging COSMIC with task completion time history log. To complete the goals of this paper a three part experimental survey took place which determined that the consolidation of the COSMIC method with the task completion time history may result in a similar or even more accurate forecast as compared to the forecast of a team of software developers. Also new ideas for tool adjustments are included, their implementation and repeating of the experiment, review of the obtained results and findings.

<p>Enligt statistik från The Standish Group’s artikel Extreme Chaos (2001) tenderar IT-projekten att oftare få problem med tid, kostnad och kvalité aspekten i jämförelse med andra typer av projekt. I vår uppsats vill vi försöka förstå vad det är som skiljer IT-projekt i jämförelse med andra projekt. Kan det exempelvis vara så att man använder sig av fel projektledningsmodell?</p><p> </p><p>I denna studie har vi jämfört hur projekt utförts i byggbranschen respektive IT-branschen. Under studiens gång har fyra intervjuer inom dessa sektorer utförts, studien har även införskaffat ytterligare betydande information genom två expertintervjuer inom området. Studien är uppbyggd kring en rubrikstruktur utifrån viktiga kriterier som Extreme Chaos (2001) tar upp, även några kriterier från teorin ligger till grund för denna struktur. Det vi hittade var att det är av stor betydelse att man verkligen är införstådd med vad kunden vill få ut av projektet, att man verkligen talar samma språk. Att man använder sig av en begreppslista för att förtydliga svårbegripliga ord.</p><p> </p><p>Studien framhäver även att projektledarens roll inom IT-projekt mer är av stödjande karaktär i jämförelse med bygg, där projektledarrollen mer är av styrande karaktär. Det finns även tydliga tecken på att projektledningsmodellen har en stor betydelse för projektets utgång. Inom IT-projekt är ofta vägen till resultatet tämligen diffus på grund av dess komplexitet. Analysen visar en illustration över hur vi ser på projektutförandet. Den visar att det finns två typer av IT-projekt, den ena är industri-IT, vilket vi menar är installationer av redan färdigutvecklade produkter. Den andra är innovativ-IT, vilket vi menar är IT-projekt där målet är känt men vägen dit är okänd. I dessa fall är det av fördel att använda sig av en iterativ metod som exempelvis Scrum för att successivt ta sig an IT-projektet.</p>

Enligt statistik från The Standish Group’s artikel Extreme Chaos (2001) tenderar IT-projekten att oftare få problem med tid, kostnad och kvalité aspekten i jämförelse med andra typer av projekt. I vår uppsats vill vi försöka förstå vad det är som skiljer IT-projekt i jämförelse med andra projekt. Kan det exempelvis vara så att man använder sig av fel projektledningsmodell?   I denna studie har vi jämfört hur projekt utförts i byggbranschen respektive IT-branschen. Under studiens gång har fyra intervjuer inom dessa sektorer utförts, studien har även införskaffat ytterligare betydande information genom två expertintervjuer inom området. Studien är uppbyggd kring en rubrikstruktur utifrån viktiga kriterier som Extreme Chaos (2001) tar upp, även några kriterier från teorin ligger till grund för denna struktur. Det vi hittade var att det är av stor betydelse att man verkligen är införstådd med vad kunden vill få ut av projektet, att man verkligen talar samma språk. Att man använder sig av en begreppslista för att förtydliga svårbegripliga ord.   Studien framhäver även att projektledarens roll inom IT-projekt mer är av stödjande karaktär i jämförelse med bygg, där projektledarrollen mer är av styrande karaktär. Det finns även tydliga tecken på att projektledningsmodellen har en stor betydelse för projektets utgång. Inom IT-projekt är ofta vägen till resultatet tämligen diffus på grund av dess komplexitet. Analysen visar en illustration över hur vi ser på projektutförandet. Den visar att det finns två typer av IT-projekt, den ena är industri-IT, vilket vi menar är installationer av redan färdigutvecklade produkter. Den andra är innovativ-IT, vilket vi menar är IT-projekt där målet är känt men vägen dit är okänd. I dessa fall är det av fördel att använda sig av en iterativ metod som exempelvis Scrum för att successivt ta sig an IT-projektet.

The software development business today is a land of constant change. The change requires the organizations who operate within this business to be flexible and quick to respond. This has led to multiple agile organization methods being developed, one of them is DevOps. A cornerstone in DevOps is self-selection - a method for assembling teams. This method gives hope of less administration, autonomy in teams and increased performance. In this essay we investigate the promises - the challenges and the possibilities - of self-selection. The case in this essay is IFS - a big software development company, implementing self-selection department by department also facing the challenges of combining traditional project values with the short iterations of an agile method. Our qualitative study investigates which the main challenges and possibilities are. We also investigate how these findings should be managed. How could the diversity, team size and autonomy be enhanced or diminished? We found that some parts of the case, and practice, were like our prior literature - but some were not. For example, the feeling of being in homogeneous teams were not always negative, and the majority of those taking part of the self-selection at IFS said they chose team by assignment - not social network as the prior literature said. Our conclusion reveals that there are several different factors to consider when having selfselection implemented in a traditional project environment. The main areas where we have found possible improvements are Team Choice, Team Diversity, Overlapping Assignments, Experienced Ownership, Management Influence and Performance.