Research suggests that social engineering attacks pose a significant security risk, with social networking sites (SNSs) being the most common source of these attacks. Recent studies showed that social engineers could succeed even among those organizations that identify themselves as being aware of social engineering techniques. Although organizations recognize the serious risks of social engineering, there is little understanding and control of such threats. This may be partly due to the complexity of human behaviors in failing to recognize attackers in SNSs. Due to the vital role that impersonation plays in influencing users to fall victim to social engineering deception, this paper aims to investigate the impact of source characteristics on users’ susceptibility to social engineering victimization on Facebook. In doing so, we identify source credibility dimensions in terms of social engineering on Facebook, Facebook-based source characteristics that influence users to judge an attacker as per these dimensions, and mediation effects that these dimensions play between Facebook-based source characteristics and susceptibility to social engineering victimization.

The idea of extracting knowledge from log data for both data mining and process mining emphasises data flow and relations among data items in the data. Unfortunately, challenges have been encountered when working with the data flow and relations. One of the challenges is that the representation of the data flow between a pair of elements or tasks is insufficiently simplified and formulated, as it considers only a one-to-one data flow relation. In this paper, we discuss how to effectively represent dependency relations in log data. To this end, we introduce a new representation of the data flow and dependency formulation using an extracted flow graph. The solution solves the issue of the insufficiency of presenting other relation types, such as many-to-one and one-to-many relations. As an experiment, a new evaluation framework is applied to the Teleclaim process in order to show how this method can provide us with more precise results when compared with other definitions.

Although the benefits of service orientation are prevalent in literature, a review, analysis, and evaluation of the 30 existing service analysis approaches presented in this paper have shown that a comprehensive approach to the identification and analysis of both business and supporting software services is missing. Based on this evaluation of existing approaches and additional sources, we close this gap by proposing an integrated, consolidated approach to business and software service analysis that combines and extends the strengths of the examined methodologies.

We empirically test the relative impact of general programming knowledge and application-specific knowledge on maintenance productivity. One hundred undergraduates participated in a quasi-experiment that required them to perform two maintenance tasks in sequence on an inventory control application. Each maintenance task involved a modification to the original application and the hours needed to complete each maintenance task are used to measure productivity. Since subjects may submit modifications that do not meet all the user requirements, the person-hours spent can be less than the actual hours required if modified applications were to meet the user requirements completely. That is, the observed time effort censored the actual required time effort. To overcome the challenge of this censored time problem, we use a proportional hazard model to model the effect of human capital on productivity. The method of maximum likelihood estimation was used to estimate the model parameters. Our study enables us to draw several implications for formulating hiring policies relating to software maintenance.

The worldwide installed base of Enterprise Resource Planning (ERP) systems has increased rapidly in size over the past 10 years now comprising tens of thousands of installations in large- and medium-sized organizations and millions of licensed users. Similar to traditional Information Systems (IS), ERP systems must be maintained and upgraded. It is therefore not surprising that EPP maintenance activities have become the largest budget provision in the IS departments of ERP-adopting organizations. Yet, there has been very limited study conducted on ERP maintenance activities. Are they simply instances of traditional software maintenance activities to which traditional software maintenance research findings can be generalized? Or are they fundamentally different activities, such that new research, specific to ERP maintenance, is required to help alleviate the ERP maintenance burden? This paper reports a case study of a large organization that implemented ERP (an SAP system) two years ago. From the case study and data collected, we observe that (1) an ERP-employing organization does not only maintain user change request but also implement maintenance introduced by the vendor; (2) request for user-support. concerning the ERP system usage, and training constitutes a main part of ERP maintenance activities; and (3) configuration is a major ERP maintenance component. We find that ERP maintenance activities are indeed different from traditional in-house software maintenance in a way that these maintenance activities cannot be sufficiently described by existing taxonomies used to classify traditional software maintenance activities. We propose a benefits-oriented taxonomy that better represents ERP enhancement maintenance activities.

Abstract This paper seeks to stimulate research on large application package software maintenance by presenting a tentative framework for future research in the area, partially instantiating that framework with examples from the papers in this special issue of the Journal of Software Maintenance and Evolution, highlighting other specific areas of research need and neglect, and posing a long list of related research questions. The user‐organization‐centric research framework captures relevant and interacting factors that can impact maintenance strategy, including software‐source, support‐source, and organizational and environmental contexts. These are viewed from the perspectives of four key stakeholders in the new distributed maintenance arrangement. In addition to the user‐organization, stakeholders include the software vendor, third‐party service providers, and society. Key messages from the paper include: maintenance generates benefits as well as costs; all stakeholders must have a lifecycle‐wide view of maintenance costs and benefits; there is value in understanding all stakeholder perspectives; various software and related support sourcing alternatives have substantial maintenance incidence implications (incidence of costs, benefits, and responsibilities); and maintenance knowledge sourcing decisions should be made in the light of lifecycle‐wide maintenance knowledge requirements. Copyright © 2001 John Wiley & Sons, Ltd.

Research on the economics of software maintenance has concentrated on software maintenance productivity. More often than not, maintenance productivity is measured by the number of hours spent in servicing a maintenance request. While this measure captures the cost of an information systems (IS) department, it ignores a potential opportunity cost to the users that is better captured by the lead time taken to fulfil a request. Using detailed data of more than 1000 maintenance projects collected at a field site over a 6-year period, we examine how the lead time of a request is affected by factors such as the characteristics of the system, the request, and the maintainer responsible for the request. We found that the complexity of a request significantly postpones its lead time. The lead time is also increased by the internal lead time target set by the IS department based on staff availability. We also divided the lead time into the queuing time and the service time components and study how they are influenced by the same factors.

The effort required to service maintenance requests on a software system increases as the software system ages and deteriorates. Thus, it may be economical to replace an aged software system with a freshly written one to contain the escalating cost of maintenance. We develop a normative model of software maintenance and replacement effort that enables us to study the optimal policies for software replacement. Based on both analytical and simulation solutions, we determine the timings of software rewriting and replacement, and hence the schedule of rewriting, as well as the size of the rewriting team as functions of the: user environment, effectiveness of rewriting, technology platform, development quality, software familiarity, and maintenance quality of the existing and the new software systems. Among other things, we show that a volatile user environment often leads to a delayed rewriting and an early replacement (i.e., a compressed development schedule). On the other hand, a greater familiarity with either the existing or the new software system allows for a less-compressed development schedule. In addition, we also show that potential savings from rewriting will be higher if the new software system is developed with a superior technology platform, if programmers' familiarity with the new software system is greater, and if the software system is rewritten with a higher initial quality.