To Örebro University

Given that there are an increasing number of information security breaches, organizations are being driven to adopt best practice for coping with attacks. Information security standards are designed to embody best practice and the legitimacy of these standards is a core issue for standardizing organizations. This study uncovers how structures at play in de jure standard development affect the input and throughput legitimacy of standards. We participated as members responsible for standards on information security and our analysis revealed two structures: consensus and warfare. A major implication of the combination of these structures is that legitimacy claims based on appeals to best practice are futile because it is difficult to know which the best practice is.

Syftet med den här studien är att utvärdera svensk terminologi på informationssäkerhetsområdet med fokus på frågor om målgrupper och grundläggande termer. Baserat på en Delphi-studie, där experter från olika yrkeskategorier har fått definiera en uppsättning grundläggande begrepp, har vi utvärderat både experternas definitioner och processen med att ta fram definitionerna. Vi har identifierat flera problem med svensk terminologi på informationssäkerhetsområdet. För att stödja arbetet med att utveckla svensk terminologi för informationssäkerhet beskriver vi i rapporten förslag på hur arbetet kan bedrivas vidare. De problem vi har identifierat är bl.a. att begrepp som inte finns med i rådande styrdokument blir otydliga och svårtolkade för experter inom området och att det är problematiskt med två olika styrdokument (HB550 och SIS-TR50:2015) i användning med delvis olika definitioner av samma begrepp. Vi har även sett att olika yrkeskategorier ofta definierar begreppen utifrån sin specifika profession, vilket kan innebära att det finns ett behov av att säkerhetsbegrepp kontextualiseras utifrån yrkesroller. Processen med att arbeta med experter enligt Delphi-metoden gav ett bra underlag för att analysera och diskutera olika definitioner av centrala begrepp inom informationssäkerhetsområdet. Dessutom har experterna varit mycket engagerade i processen. Vi föreslår att framtida begreppsutredningar använder sig av denna metod eller varianter av den och att det är experterna, de som i sitt dagliga yrke handhar informationssäkerheten, som ska vara de som skapar definitionerna. Vi ser också ett stort behov av större, effektivare och mer samordnade former för framtida begreppsutredningar.

Information security standards are influential tools in society today. The validity claim of standards is based on what is considered “best practice.” We unveil the negotiations that take place when “best practice” is constructed during standard development. By using dis- course analysis, we investigate how power operates in national and international contexts of de jure information security standard development work. As members of a standard- ization committee, we analyzed the language used by this committee. The results showed two discourses at play: the consensus discourse and the warfare discourse. We conclude by proposing six theoretical propositions on how power operates in the above-mentioned contexts of de jure standard development.

Purpose: The purpose of this paper is to develop a method for information classification. The proposed method draws on established standards, such as the ISO/IEC 27002 and information classification practices. The long-term goal of the method is to decrease the subjective judgement in the implementation of information classification in organisations, which can lead to information security breaches because the information is under- or over-classified.

Design/methodology/approach: The results are based on a design science research approach, implemented asfive iterations spanning the years 2013 to 2019.

Findings: The paper presents a method for information classification and the design principles underpinning the method. The empirical demonstration shows that senior and novice information security managers perceive the method as a useful tool for classifying information assets in an organisation.

Research limitations/implications: Existing research has, to a limited extent, provided extensive advice on how to approach information classification in organisations systematically. The method presented in this paper can act as a starting point for further research in this area, aiming at decreasing subjectivity in the information classification process. Additional research is needed to fully validate the proposed method fo rinformation classification and its potential to reduce the subjective judgement.

Practical implications: The research contributes to practice by offering a method for information classification. It provides a hands-on-tool for how to implement an information classification process. Besides, this research proves that it is possible to devise a method to support information classification. This is important, because, even if an organisation chooses not to adopt the proposed method, the very fact that this method has proved useful should encourage any similar endeavour.

Originality/value: The proposed method offers a detailed and well-elaborated tool for information classification. The method is generic and adaptable, depending on organisational needs.

Public organisations are starting to show an interest in automated decision-making (ADM). So far, existing research focuses on the governmental perspective on this phenomenon. Less attention is paid to citizens' views on ADM. The aim of this study is to provide empirical insights into citizen awareness of and beliefs about ADM in public-sector services. To this end, we participated in an annual national survey in Sweden carried out by the SOM Institute at Gothenburg University concluding that a minority of the citizens know about the use of ADM in public-sector services. Furthermore, when computers instead of civil servants make decisions in the public-sector, citizens expect decisions by computers to become less legally secure but more impartial. They also expect ADM to take personal circumstances into account to a lesser degree and become less transparent. Finally, we found that citizens with that awareness expect decisions by computers to become more reliable and impartial. Based on our empirical findings in relation to previous research, we suggest four hypotheses on citizen's awareness and beliefs about public-sector ADM.

I allt större utsträckning införs automatiserat beslutsfattande i offentlig sektor. Det innebär att datorer ersätter handläggare som beslutsfattare. Flera av de ärenden som avgörs med automatiserat beslutsfattande berör medborgarna. Detta kapitel undersöker om medborgarna är medvetna om denna förändring och hur de tror att besluten förändras när datorer ersätter handläggare som beslutsfattare. Resultaten visar att det är en minoritet (20 procent) som har kännedom sedan tidigare om automatiserat beslutsfattande i offentlig sektor. En majoritet tror att besluten förvisso blir mer opartiska när datorer istället för handläggare fattar beslut, men inte att besluten blir mer tillförlitliga. De tror också att automatiska beslut kommer att ta mindre hänsyn till människornas situation och minska insynen i beslutsfattandet. De som har kännedom om automatiserat beslutsfattande är mer positiva när det gäller beslutens opartiskhet och tillförlitlighet, men anser i samma utsträckning som de utan kännedom att besluten medför mindre hänsynstagande till människors situation och minskad insyn i beslutsfattandet.

Alltfler myndigheter inför automatiserat beslutsfattande, vilket innebär att en dator fattar beslut istället för handläggare och utredare. Detta kapitel undersöker med- borgarnas inställning till att öka det automatiserade beslutsfattandet i myndigheter. Kapitlets analyser visar att en majoritet (64 procent) anser att det är ett mycket dåligt eller ganska dåligt förslag att datorer ska få ta över fler beslut i myndigheter. Analyserna indikerar också att inställningen har samband med socio-demografisk bakgrund, politiska förhållningssätt och framtidsoro för AI, automatisering och robotisering. Den negativa inställningen återfinns i samtliga grupper. Det är dessutom så att det snarare är graden av negativ inställning som varierar mellan grupper än inställningen som sådan. Med dessa resultat framträder en möjlig spänning mellan utvecklingen inom myndigheter och medborgarnas inställning till automatiserat beslutsfattande.

In this paper, we motivate, devise, demonstrate, and evaluate an approach for the research-based development of information systems development methods (ISDMs). This approach, termed "method engineering as design science" (ME-DS), emerged from the identified need for scholars to develop ISDMs using proper research methods that meet the standards of both rigor and relevance. ISDMs occupy a position of central importance to information systems development and scholars have therefore invested extensive resources over the years in developing such methods. The method engineering (ME) discipline has developed different frameworks and methods to guide such development work and, for that purpose, they are well-suited. Still, there remains a need for applications and evaluations of ISDMs based on the demands for knowledge justification. Unfortunately, in many cases, scholars come up short with regard to how ISDMs are generated and empirically validated. While design science (DS) stresses knowledge justification, prominent DS approaches seem to be biased toward the development of IT artifacts, making this approach ill-suited for the development of method artifacts. We therefore propose eight principles that marry ME and DS, resulting in a process model with six activities to support research-based development of ISDMs. We demonstrate and evaluate ME-DS by assessing three existing research papers that propose ISDMs. These retrospectives show how ME-DS directs attention to certain aspects of the research process and provides support for future ISDM development.

When adopting and using a Software Development Method (SDM), it is important to stay true to the philosophy of the method; otherwise, software developers might execute activities that do not lead to the intended outcomes. Currently, no overview of SDM research addresses software developers’ reasoning behind adopting and using SDMs. Accordingly, this paper aims to survey existing SDM research to scrutinize the current knowledge base on software developers’ type of reasoning behind SDM adoption and use. We executed a systematic literature review and analyzed existing research using two steps. First, we classified papers based on what type of reasoning was addressed regarding SDM adoption and use: rational, irrational, and non-rational. Second, we made a thematic synthesis across these three types of reasoning to provide a more detailed characterization of the existing research. We elicited 28 studies addressing software developers’ reasoning and identified five research themes. Building on these themes, we framed four future research directions with four broad research questions, which can be used as a basis for future research.

Misinterpretations and faulty use of Software Development Method (SDM) practices and principles are identified pitfalls in Software Development (SD). Previous research indicates cases with method adoption and use failures; one reason could be the SDM Cargo Cult (CC) behavior, where SD organizations claim to be agile but not doing agile. Previous research has suggested the SDM CC framework as an analytical tool. The aim of this paper is to refine the SDM CC framework and empirically test this version of the framework. We use data from an ethnographical study on three SD teams’ Daily Scrum Meetings (DSM). The empirical material was collected through observations, interviews, and the organization’s business documents. We uncovered twelve CC situations in the SD teams’ use of the DSM practice, structured into seven categories of SDM deviations: bringing irrelevant information, canceling meetings, disturbing the team, receiving unclear information, bringing new requirements, problemsolving, and task distribution.

This paper presents an Actor Network Theory (ANT) analysis of a computer hack at a large university. Computer hacks are usually addressed through technical means thus ensuring that perpetrators are unable to exploit system vulnerabilities. We however argue that a computer hack is a result of different events in a heterogeneous network embodying human and non-human actors. Hence a secure organizational environment is one that is characterized by ‘stability’ and ‘social order’, which is a result of negotiations and alignment of interests among different actants. The argument is conducted through a case study. Our findings reveal not only the usefulness of ANT in developing an understanding of the (in)security environment at the case study organization, but also the ability of ANT to identify differences in interests among actants. At a practical level, our analysis suggests three principles that management needs to pay attention to in order to prevent future security breaches.

It is widely acknowledged that requirements change during systems development projects. The reasons are usually explained by changes in lower-level goals, while high-level goals are expected to be stable. In this paper we analyse, and compare, how two electronic government projects use goals as a basis for procuring new Information Technology systems. The high-level goals of these projects have evolved differently, where high-level goals changed in one project, but remained stable in the second project. This can be explained by the fact that the two cases have interpreted the concept of high-level goals differently. We believe that goal-stability increases when values are related to high-level goals during goal-oriented requirements engineering. This illustrates the importance of taking political values into consideration when defining the high-level goals for electronic government projects.

It is widely acknowledged that requirements change during systems development projects. The reasons are usually explained by changes in lower-level goals, while high-level goals are expected to be stable. In this paper we analyse, and compare, how two electronic government projects use goals as a basis for procuring new Information Technology systems. The high-level goals of these projects have evolved differently, where high-level goals changed in one project, but remained stable in the second project. This can be explained by the fact that the two cases have interpreted the concept of high-level goals differently. We believe that goal-stability increases when values are related to high-level goals during goal-oriented requirements engineering. This illustrates the importance of taking political values into consideration when defining the high-level goals for electronic government projects.

Purpose – Employees' compliance with information security policies is considered an essential component of information security management. The research aims to illustrate the usefulness of social action theory (SAT) for management of information security.

Design/methodology/approach – This research was carried out as a longitudinal case study at a Swedish hospital. Data were collected using a combination of interviews, information security documents, and observations. Data were analysed using a combination of a value-based compliance model and the taxonomy laid out in SAT to determine user rationality.

Findings – The paper argues that management of information security and design of countermeasures should be based on an understanding of users' rationale covering both intentional and unintentional non-compliance. The findings are presented in propositions with practical and theoretical implications: P1. Employees' non-compliance is predominantly based on means-end calculations and based on a practical rationality, P2. An information security investigation of employees' rationality should not be based on an a priori assumption about user intent, P3. Information security management and choice of countermeasures should be based on an understanding of the use rationale, and P4. Countermeasures should target intentional as well as unintentional non-compliance.

Originality/value – This work is an extension of Hedström et al. arguing for the importance of addressing user rationale for successful management of information security. The presented propositions can form a basis for information security management, making the objectives underlying the study presented in Hedström et al. more clear

Purpose: The purpose of this paper is to examine the challenges that arise when introducing an electronic identification (eID) card for professional use in a health-care setting.

Design/methodology/approach: This is a case study of an eID implementation project in healthcare. Data were collected through interviews with key actors in a project team and with eID end users. The authors viewed the eID card as a boundary object intersecting social worlds. For this analysis, the authors combined this with an electronic government initiative challenge framework.

Findings: The findings of this paper illustrate the interpretative flexibility of eID cards and how eID cards as boundary objects intersect social worlds. The main challenges of implementing and using eID cards in healthcare are usability, user behaviour and privacy. However, the way in which these challenges are interpreted varies between different social worlds.

Practical implications: One of the implications for future practice is to increase our understanding of the eID card as a socio-technical artefact, where the social and technical is intertwined, at the same time as the eID card affects the social as well as the technical. By using a socio-technical perspective, it is possible to minimise the potential problems related to the implementation and use of eID.

Originality/value: Previous research has highlighted the need for more empirical research on identity management. The authors contextualise and analyse the implementation and use of eID cards within healthcare. By viewing the eID card as a boundary object, the authors have unveiled its interpretative flexibility and how it is translated across different social worlds.

A business’s information is one of its most important assets, making the protection of information a strategic issue. In this paper, we investigate the tension between information security policies and information security practice through longitudinal case studies at two health care facilities. The management of information security is traditionally informed by a control-based compliance model, which assumes that human behavior needs to be controlled and regulated. We propose a different theoretical model: the value-based compliance model, assuming that multiple forms of rationality are employed in organizational actions at one time, causing potential value conflicts. This has strong strategic implications for the management of information security. We believe health care situations can be better managed using the assumptions of a value-based compliance model.

The increased interest for user participation in development of public electronic services (public e-services for short) is expected to bring similar value as it has done in other systems development projects. Existing research, however, has shown that introducing user participation to public e-service development is associated with a number of challenges. We have in this paper explored the challenges a) getting users to participate, and b) lacking adequate skills, in the context of three user participation schools. Our interview results show that citizens in general are interested to participate in public e-service development, and favour user participation schools with a high degree of active participation.Moreover, citizens’ ability to participate is high with respect to ICT-knowledge. However, their knowledge of laws, regulations and business processes related to public authorities in general is low, thus limiting citizens’ ability to participate.

For decades, user participation has brought value to various systems development projects. Today, there are expectations that public e-service development will experience the same benefits. However, existing research has shown that introducing user participation into public e-service development can be challenging. In this study, we interviewed citizens in order to explore their willingness and ability to participate in public e-service development according to three user participation schools: User-Centred Design, Participatory Design and User Innovation. Our findings show that citizens in general are willing to participate, but their ability to do so is limited. Based on our findings, we developed nine propositions to explain citizens' willingness and ability to participate in public e-service development. The propositions contribute to practice by acting as a tentative guide for systems developers when they use user participation schools as inspiration in public e-service projects. They also act as a starting point for future research into conditions for user participation in public e-service development. (C) 2014 Elsevier Inc. All rights reserved.

New technology means new ways of both developing, providing and consuming services. In the strive for government organizations to build and maintain relationships with its citizens, e-presence is highly important. E-services are one way to go, and it has been argued that user participation is an important part of developing said services. In this paper we analyze a selection of user participation approaches from a goal perspective to see how they fit in an e-government service development context., In doing so, we identify four challenges that need to be addressed when including users in the development: 1) Identifying the user target segment, 2) Identifying the individual user within each segment, 3) Getting users to participate, and 4) Lacking adequate skills

This paper investigates the use of cloud services in the public sector and management of information security challenges in the procurement of such services. The findings are based on an exploratory approach that included a systematic literature review and a survey among the public agencies and municipalities in Sweden. The literature review is used to derive a conceptual framework that structures our empirical results into the three groups: 1) contractual and legal, 2) operational, and 3) managerial competency. The survey explored all these three groups. The findings show that the information security challenges are mostly related to the potential breaching of national security and laws applicable to cross-border cloud services. Most of the cloud contracts of public organizations are found to be supplier driven. In this case, lack of knowledge and awareness in managing procurement are mostly raised compared to technical risks.

Tailoring systems development methods is a challenge. Both the research of method engineering and method-in-action have put much effort into this issue. State-of-the art Computer-Aided Method Engineering tools for situational method engineering often requires specific competences in meta modelling languages. Together with the tool investments they often become heavy weight solutions for small systems development companies that seek method tailoring support. In this paper a wiki-based approach to method tailoring, the Wiki Method Tool (WMT), has been evaluated during two systems development projects. The evaluation of this light weight tool has been carried out in a small systems development company in Sweden. The evaluation has been anchored in Activity Theory to focus on the collaborative actions on the situational methods using the WMT, such as changing work descriptions and templates. The WMT itself contributed with data about each documented change -- what the change looked like, by whom, and when it was made. Based on these data and subsequent interviews, we report on lessons learned and can conclude that all team members have contributed to the situational methods. It also means that they took a shared responsibility for the role as method engineer.

Organizations that implement a company-wide method to standardize the way that systems development is carried out still have a need to adapt this method to specific projects. When adapting this method the end results should align with the basic philosophy of the original method. To this end, goal-driven situational method engineering has been proposed. However, there are no longitudinal studies on systems developers’ use of such approaches and their intentions to balance their need of adaptation with the basic philosophy of the original method. This paper explores how goal-driven method configuration has been used by two project teams in six successive systems development projects, with the intention to balance the goals and values of a specific method with the systems developers’ need for method adaptation. We do that through the use of method rationality resonance theory. Through content examples of method configurations, we report on (a) lessons learned from the project teams’ work on balancing the goals of the company-wide method with their needs and (b) theoretical development of the method rationality resonance theory.

The need for method tailoring is widely accepted in the field of information systems development methods. Today much attention has been devoted to viewing method tailoring either as (a) a highly rational process with the method engineer as the driver where the method users are passive information providers, or (b) as an unstructured process where the developer makes individual choices, a selection process without a driver. In this paper we view method tailoring from a negotiation perspective using Actor Network Theory. Our narrative examples depict method tailoring as a more complexprocess than either (a) or (b) show.

Group development has been proposed as a way of improving quality in end user development. Earlier experiments have shown promising results on error rates. However, these studies have been carried out on students, often, in laboratory settings. This study reports on a field experiment on group development during spreadsheeting. Experienced business managers have been working alone (monads) and in groups of two (dyads), solving a context specific problem. The results show that dyads made 36% fewer errors than monads. Hence, the results verify earlier findings and that group development can be recommended as a technique to include in end user development processes to improve quality.

Today, public organisations need to share information in order to complete their tasks. Over the years, scholars have mapped out the social and organisational factors that affect the success or failure of these kinds of endeavours. However, few of the suggested models have sought to address the temporal aspect of inter-organisational information sharing. The aim of this paper is to investigate the reshaping of social and organisational factors of inter-organisational information sharing in the public sector over time. We analysed four years' worth of information sharing in an inter-organisational reference group on copper corrosion in the context of nuclear waste management. We could trace how factors in the model proposed by Yang and Maxwell (2011) were reshaped over time. Two factors in the model – concerns of information misuse and trust – are frequently assessed by organisations and are the most likely to change. In the long run we also found that legislation and policies can change.

Information security is an understudied area within electronic government. In this study, we examine the quality of information security policy design in health care. Employees cause a majority of the security breaches in health care, and many of them are unintentional. In order to support the formulation of practical, from the employees’ perspective, information security policies, we propose eight tentative quality criteria. These criteria were developed using practice-based discourse analysis on three information security policy documents from a health care organisation.

Employees' poor compliance with information security policies is a perennial problem for many organizations. Existing research shows that about half of all breaches caused by insiders are accidental, which means that one can question the usefulness of information security policies. In order to support the formulation of practical, from the employees' perspective, information security policies, we propose eight tentative quality criteria. These criteria were developed using practice-based discourse analysis on three information security policy documents from a health care organisation.

End user development has grown strong during the last decades. The advantages and disadvantages of this phenomenon have been debated over the years, but not extensively from an information security culture point of view. We therefore investigate information security design decisions made by an end user during an end user development. The study is interpretative and the analysis is structured using the concept of inscriptions. Our findings show that end user development results in inscriptions that may induce security risks that organizations are unaware of. We conclude that it is a) important to include end user development as a key issue for information security management, and include end user developers as in important group for the development of a security-aware culture, and b) that information security aspects are addressed in end user development policies.