Identity management : strengthening one-time password authentication through usability

Usability in HCI (Human-Computer Interaction) is normally understood as the simplicity and clarity with which the interaction with a computer program or a web site is designed. Identity management systems need to provide adequate usability and should have a simple and intuitive interface. The system should not only be designed to satisfy service provider requirements but it has to consider user requirements, otherwise it will lead to inconvenience and poor usability for users when managing their identities. With poor usability and a poor user interface with regard to security, it is highly likely that the system will have poor security. The rapid growth in the number of online services leads to an increasing number of different digital identities each user needs to manage. As a result, many people feel overloaded with credentials, which in turn negatively impacts their ability to manage them securely. Passwords are perhaps the most common type of credential used today. To avoid the tedious task of remembering difficult passwords, users often behave less securely by using low entropy and weak passwords. Weak passwords and bad password habits represent security threats to online services. Some solutions have been developed to eliminate the need for users to create and manage passwords. A typical solution is based on generating one-time passwords, i.e. passwords for single session or transaction usage. Unfortunately, most of these solutions do not satisfy scalability and/or usability requirements, or they are simply insecure. In this thesis, the security and usability aspects of contemporary methods for authentication based on one-time passwords (OTP) are examined and analyzed. In addition, more scalable solutions that provide a good user experience while at the same time preserving strong security are proposed.

Understanding user differences in open-source workflow management system usage intentions

Open-source software systems have become a viable alternative to proprietary systems. We collected data on the usage of an open-source workflow management system developed by a university research group, and examined this data with a focus on how three different user cohorts – students, academics and industry professionals – develop behavioral intentions to use the system. Building upon a framework of motivational components, we examined the group differences in extrinsic versus intrinsic motivations on continued usage intentions. Our study provides a detailed understanding of the use of open-source workflow management systems in different user communities. Moreover, it discusses implications for the provision of workflow management systems, the user-specific management of open-source systems and the development of services in the wider user community.

The role of knowledge in the project management office

Both Knowledge Management (KM) and Project Management (PM) are known as crucial factors to develop competitive advantage(CA). PM Office (PMO) is recognized as a strong solution to institutionalize PM practices in organization. However, according to the literature there is a significant gap in addressing KM practices in the PMO. In other words, existing PMO maturity models has not been addressed from KM perceptive. This paper discusses undertaken investigations of both KM and PM as an initial part of PhD research on the role of knowledge in PMO

Patterns-based evaluation of open source BPM systems: The cases of jBPM, OpenWFE, and Enhydra Shark

In keeping with the proliferation of free software development initiatives and the increased interest in the business process management domain, many open source workflow and business process management systems have appeared during the last few years and are now under active development. This upsurge gives rise to two important questions: What are the capabilities of these systems? and How do they compare to each other and to their closed source counterparts? In other words: What is the state-of-the-art in the area?. To gain an insight into these questions, we have conducted an in-depth analysis of three of the major open source workflow management systems – jBPM, OpenWFE, and Enhydra Shark, the results of which are reported here. This analysis is based on the workflow patterns framework and provides a continuation of the series of evaluations performed using the same framework on closed source systems, business process modelling languages, and web-service composition standards. The results from evaluations of the three open source systems are compared with each other and also with the results from evaluations of three representative closed source systems: Staffware, WebSphere MQ, and Oracle BPEL PM. The overall conclusion is that open source systems are targeted more toward developers rather than business analysts. They generally provide less support for the patterns than closed source systems, particularly with respect to the resource perspective, i.e. the various ways in which work is distributed amongst business users and managed through to completion.

Users adoption of web 2.0 for knowledge management : position paper

Web 2.0 is a new generation of online applications on the web that permit people to collaborate and share information online. The use of such applications by employees in organisations enhances knowledge management (KM) in organisations. Employee involvement is a critical success factor as the concept is based on openness, engagement and collaboration between people where organizational knowledge is derived from employees experience, skills and best practices. Consequently, the employee's perception is recognized as being an important factor in web 2.0 adoption for KM and worthy of investigation. There are few studies that define and explore employee's enterprise 2.0 acceptance for KM. This paper provides a systematic review of the literature prior to demonstrating the findings as part of a preliminary conceptual model that represents the first stage of an ongoing research project that will end up with an empirical study. Reviewing available studies in technology acceptance, knowledge management and enterprise 2.0 literatures aids obtaining all potential user acceptance factors of enterprise 2.0. The preliminary conceptual model is a refinement of the theory of planed behaviour (TPB) as the user acceptance factors has been mapped into the TPB main components including behaviour attitude, subjective norms and behaviour control which are the determinant of individual's intention to a particular behaviour.

An empirical investigation of health information system failure in regional Sri Lanka

Public health decision making is critically dependant on accurate, timely and reliable information. There is a widespread belief that most of the national and sub-national health information systems fail in providing much needed information support for evidence based health planning and interventions. This situation is more acute in developing nations where resources are either stagnant or decreasing, coupled with the situations of demographic transition and double burden of diseases. Literature abounds with publications, which provide information on misguided health interventions in developing nations, leading to failure and waste of resources. Health information system failure is widely blamed for this situation. Nevertheless, there is a dearth of comprehensive evaluations of existing national or sub-national health information systems, especially in the region of South-East Asia. This study makes an attempt to bridge this knowledge gap by evaluating a regional health information system in Sri Lanka. It explores the strengths and weaknesses of the current health information system and related causative factors in a decentralised health system and then proposes strategic recommendations for reform measures. A mix methodological and phased approach was adopted to reach the objectives. An initial self administered questionnaire survey was conducted among health managers to study their perceptions in relation to the regional health information system and its management support. The survey findings were used to establish the presence of health information system failure in the region and also as a precursor to the more in-depth case study which was followed. The sources of data for the case study were literature review, document analysis and key stake holder interviews. Health information system resources, health indicators, data sources, data management, data quality, and information dissemination were the six major components investigated. The study findings reveal that accurate, timely and reliable health information is unavailable and therefore evidence based health planning is lacking in the studied health region. Strengths and weaknesses of the current health information system were identified and strategic recommendations were formulated accordingly. It is anticipated that this research will make a significant and multi-fold contribution for health information management in developing countries. First, it will attempt to bridge an existing knowledge gap by presenting the findings of a comprehensive case study to reveal the strengths and weaknesses of a decentralised health information system in a developing country. Second, it will enrich the literature by providing an assessment tool and a research method for the evaluation of regional health information systems. Third, it will make a rewarding practical contribution by presenting valuable guidelines for improving health information systems in regional Sri Lanka.

Operational semantics of aspects in business process management

Aspect orientation is an important approach to address complexity of cross-cutting concerns in Information Systems. This approach encapsulates these concerns separately and compose them to the main module when needed. Although there a different works which shows how this separation should be performed in process models, the composition of them is an open area. In this paper, we demonstrate the semantics of a service which enables this composition. The result can also be used as a blueprint to implement the service to support aspect orientation in Business Process Management area.

An authorization framework using building information models

A building information model (BIM) is an electronic repository of structured, three-dimensional data that captures both the physical and dynamic functional characteristics of a facility. In addition to its more traditional function as a tool to aid design and construction, a BIM can be used throughout the life cycle of a facility, functioning as a living database that places resources contained within the building in their spatial and temporal context. Through its comprehension of spatial relationships, a BIM can meaningfully represent and integrate previously isolated control and management systems and processes, and thereby provide a more intuitive interface to users. By placing processes in a spatial context, decision-making can be improved, with positive flow-on effects for security and efficiency. In this article, we systematically analyse the authorization requirements involved in the use of BIMs. We introduce the concept of using a BIM as a graphical tool to support spatial access control configuration and management (including physical access control). We also consider authorization requirements for regulating access to the structured data that exists within a BIM as well as to external systems and data repositories that can be accessed via the BIM interface. With a view to addressing these requirements we present a survey of relevant spatiotemporal access control models, focusing on features applicable to BIMs and highlighting capability gaps. Finally, we present a conceptual authorization framework that utilizes BIMs.

On governing collaborative Information Technology (IT) : a relational perspective

Organizations today invest in collaborative IT to engage in collaborative alliances to sustain or improve their competitive positions. Effective use of this collaborative IT in an alliance requires a deeper understanding of their governance structures. This effort is to ensure the sustainability of these alliances. Through the relational view of the firm, we suggest relational lateral IT-steering committees, relational IT operational committees, and relational IT performance management systems as IT governance structures for collaborative alliances. We then incorporate these structures, develop a model for approaches to governing collaborative IT, and evaluate the effectiveness for such governance structures in the IT-dependent alliances. We suggest that IT governance efforts of an alliance should contribute to their collaborative rent. We also suggest that the collaborative rent of an alliance would relate to the business value of its alliance partners. Field survey data containing 192 responses indicates a positive influence of the suggested IT governance efforts of the alliance on the collaborative rent of the alliance. The results also suggest a positive impact of the collaborative rent of the alliance on the business value of the alliance partners.

Legal issues related to Accountable-eHealth systems in Australia

Information privacy requirements of patients and information requirements of healthcare providers (HCP) are competing concerns. Reaching a balance between these requirements have proven difficult but is crucial for the success of eHealth systems. The traditional approaches to information management have been preventive measures which either allow or deny access to information. We believe that this approach is inappropriate for a domain such as healthcare. We contend that introducing information accountability (IA) to eHealth systems can reach the aforementioned balance without the need for rigid information control. IA is a fairly new concept to computer science, hence; there are no unambiguously accepted principles as yet. But the concept delivers promising advantages to information management in a robust manner. Accountable-eHealth (AeH) systems are eHealth systems which use IA principles as the measure for privacy and information management. AeH systems face three main impediments; technological, social and ethical and legal. In this paper, we present the AeH model and focus on the legal aspects of AeH systems in Australia. We investigate current legislation available in Australia regarding health information management and identify future legal requirements if AeH systems are to be implemented in Australia.

Supply chain benefits expectation management framework

Organizations invest heavily in Supply Chain Management Systems expecting the benefits promised by the software vendors and the implementation partners. However, both academic and industry reports suggest that there is growing dissatisfaction among client organizations due to an increasing gap in benefits purported by the software vendors and benefits realised by the client. In order to better manage expectations of the client organization, this study proposes a Benefit Expectation Management Framework for Supply Chain Management Systems, based on Expectation-Confirmation Theory. This study derives 60 expected benefits of Supply Chain Management Systems through 41 vendor-reported customer stories and academic papers. Through comparing those benefits with the received benefits by a case organization that has implemented SAP Supply Chain Management Systems for seven years, two salient factors – long timetable and multiple stakeholders – have been identified as the controlling factors affecting the confirmation level of Supply Chain Management System expectations and further impacting the satisfaction of a client organization. The case study also highlights the likely causes for realized benefits and enduring issues in relation to the Supply Chain Management Systems.

Privacy-aware workflow management

Information security policies play an important role in achieving information security. Confidentiality, Integrity, and Availability are classic information security goals attained by enforcing appropriate security policies. Workflow Management Systems (WfMSs) also benefit from inclusion of these policies to maintain the security of business-critical data. However, in typical WfMSs these policies are designed to enforce the organisation’s security requirements but do not consider those of other stakeholders. Privacy is an important security requirement that concerns the subject of data held by an organisation. WfMSs often process sensitive data about individuals and institutions who demand that their data is properly protected, but WfMSs fail to recognise and enforce privacy policies. In this paper, we illustrate existing WfMS privacy weaknesses and introduce WfMS extensions required to enforce data privacy. We have implemented these extensions in the YAWL system and present a case scenario to demonstrate how it can enforce a subject’s privacy policy.

Ubiquitous customer relationship management : unforeseen issues and benefits

Convergence of pervasive technologies, techno-centric customers and the emergence of digitized channels, overabundance of user friendly retail applications are having a profound impact on retail experience, leading to the advent of ‘everywhere retailing’. With the rapid uptake of digital complimentary assets and smart mobile applications are revolutionizing the relationship of retailers with their customers and suppliers. Retail firms are increasingly investing substantial resources on dynamic Customer Relationship Management systems (D-CRM / U-CRM) to better engage with customers to sense and respond quickly (Agility of the firm) to their demands. However, unlike traditional CRM systems, engagement with U-CRM systems requires that firms be hyper sensitive to volatile customer needs and wants. Following the notions of firm agility, this study attempts to develop a framework to understand such unforeseen benefits and issues of U-CRM. This research-in-progress paper reports an a-priory framework including 62 U-CRM benefits derived through an archival analysis of literature.

Improving quality management system implementation in Indonesian construction companies

As the Indonesian construction industry is now promising to become the engine of national economic development, achieving quality and higher performance, not only domestically but also in the international market, are becoming crucial issues. Implementing quality management systems (QMSs) based on ISO 9001 are important in helping Indonesian construction companies become more competitive, for it is acknowledged that quality in construction is a major concern in the global construction industry. However, the possession of ISO 9001 certification does not reflect the presence of a well-operated QMS, which is capable of giving customer and project end-users satisfaction. The review of literature found that there is a significant correlation between a company.s organisational culture and the quality performance of contractors. While research into this area has involved many researchers, there is no critical mass of information specifically related to the Indonesian situation. Studies based on contemporary perspectives of the characteristics of the Indonesian construction organisational culture using Cameron and Quinn.s Organizational Culture Assessment Instrument (OCAI) and its relationship with the contractor.s ISO 9001 practices, have not been previously undertaken. This thesis research, therefore, investigated the culture profiles in Indonesian construction organisations, together with the current implementation of ISO 9001 and their performance during implementing QMSs, as information in these areas has a bearing on the poor performance and low levels of competitiveness of Indonesian construction companies. Questionnaire surveys were distributed to selected representative grade 7 civil engineering contractors located in the two provincial capitals of Makassar and Manado, and the national capital, Jakarta, in order to collect responses designed to examine the effectiveness of their QMSs implementation. The survey also aimed to identify current problems within the systems, and examine the performance of companies while implementing their QMSs. The questionnaire contained questions to assess the organisational culture profiles of Indonesian construction companies, adopting the OCAI. The survey results were then used to analyse the influence of different organisational culture profiles on QMSs implementation among respondent companies. The results from the questionnaire survey supported the development of a Culture-based Quality Management System Improvement Implementation Framework, designed to help Indonesian construction companies identify some typical barriers associated with impacting on effective QMSs implementation; to assist them to develop cultural values that can drive effective QMSs implementation; to undertake effective QMSs practices; and to recognise the potential results and longer-term benefits obtainable from implementing effective QMSs. A Focus Group Discussion was conducted with the assistance of a panel of professional construction practitioners, policy makers and academic experts, which further considered and validated the usefulness and applicability of the framework. Based on the outcome from this discussion and on the results of the earlier data analysis, a final version of the framework was developed to assist Indonesian construction companies in improving their capability of construction project delivery, and thereby contribute to providing or improving the competitive advantage of Indonesian construction companies in the local, national and global construction market.

Personalised information gathering and recommender systems : techniques and trends

With the explosive growth of resources available through the Internet, information mismatching and overload have become a severe concern to users. Web users are commonly overwhelmed by huge volume of information and are faced with the challenge of finding the most relevant and reliable information in a timely manner. Personalised information gathering and recommender systems represent state-of-the-art tools for efficient selection of the most relevant and reliable information resources, and the interest in such systems has increased dramatically over the last few years. However, web personalization has not yet been well-exploited; difficulties arise while selecting resources through recommender systems from a technological and social perspective. Aiming to promote high quality research in order to overcome these challenges, this paper provides a comprehensive survey on the recent work and achievements in the areas of personalised web information gathering and recommender systems. The report covers concept-based techniques exploited in personalised information gathering and recommender systems.