Understanding a new literature corpus can be a grueling experience for junior scholars. Nevertheless, corresponding guidelines have not been updated for decades. We contend that the traditional strategy of skimming all papers and reading selected papers afterwards needs to be revised. Therefore, we design a new strategy that guides the overall exploratory process by prioritizing influential papers for initial reading, followed by skimming the remaining papers. Consistent with schemata theory, starting with in-depth reading allows readers to acquire more substantial prior content schemata, which are representa-tive for the literature corpus and useful in the following skimming process. To this end, we develop a prototype that identifies the influential papers from a set of PDFs, which is illustrated in a case study in the IT business value domain. With the new strategy, we envision a more efficient process of exploring unknown literature corpora.

Recommender Agents (RAs) facilitate consumers’ online purchase decisions for complex, multi-attribute products. As not all combinations of attribute levels can be obtained, users are forced into trade-offs. The exposure of trade-offs in a RA has been found to affect consumers’ perceptions. However, little is known about how different preference elicitation methods in RAs affect consumers by varying degrees of trade-off exposure. We propose a research model that investigates how different levels of trade-off exposure cognitively and affectively influence consumers’ satisfaction with RAs. We operationalize these levels in three different RA types and test our hypotheses in a laboratory experiment with 116 participants. Our results indicate that with increasing tradeoff exposure, perceived enjoyment and perceived control follow an inverted Ushaped relationship. Hence, RAs using preference elicitation methods with medium trade-off exposure yield highest consumer satisfaction. This contributes to the understanding of trade-offs in RAs and provides valuable implications to e-commerce practitioners.

When responding to natural disasters, professional relief units are often supported by many volunteers which are not affiliated to humanitarian organizations. The effective coordination of these volunteers is crucial to leverage their capabilities and to avoid conflicts with professional relief units. In this paper, we empirically identify key requirements that professional relief units pose on this coordination. Based on these requirements, we suggest a decision model. We computationally solve a real-world instance of the model and empirically validate the computed solution in interviews with practitioners. Our results show that the suggested model allows for solving volunteer coordination tasks of realistic size near-optimally within short time, with the determined solution being well accepted by practitioners. We also describe in this article how the suggested decision support model is integrated in the volunteer coordination system which we develop in joint cooperation with a disaster management authority and a software development company.

Design science is a fundamental research stream that contends its position in the information systems discipline. While ongoing debates address the relative importance of design science contributions in the information systems community, insights into the scientific impact of design science research (DSR) are missing and this lack of understanding arguably poses challenges to an informed discourse. To identify the most influential papers and those factors that explain their scientific impact, this paper presents an exploratory study of the scientific impact of DSR papers published in the AIS Senior Scholars' Basket of Journals. We uncover the current DSR landscape by taking stock of influential papers and theories and develop a model to explain the scientific impact of DSR papers. Our findings show that scientific impact is significantly explained by theorization and novelty. We discuss how the implications of our work can be projected on the overarching discourse on DSR.

We consider Max-min Share (MmS) fair allocations of indivisible chores (items with negative utilities). We show that allocation of chores and classical allocation of goods (items with positive utilities) have some fundamental connections but also differences which prevent a straightforward application of algorithms for goods in the chores setting and viceversa. We prove that an MmS allocation does not need to exist for chores and computing an MmS allocation - if it exists - is strongly NP-hard. In view of these non-existence and complexity results, we present a polynomial-time 2-approximation algorithm for MmS fairness for chores. We then introduce a new fairness concept called optimal MmS that represents the best possible allocation in terms of MmS that is guaranteed to exist. We use connections to parallel machine scheduling to give (1) a polynomial-time approximation scheme for computing an optimal MmS allocation when the number of agents is fixed and (2) an effective and efficient heuristic with an ex-post worst-case analysis.

Literature reviews play an important role in the development of knowledge. Yet, we observe a lack of theoretical underpinning of and epistemological insights into how literature reviews can contribute to knowledge creation and have actually contributed in the IS discipline. To address these theoretical and empirical research gaps, we suggest a novel epistemological model of literature reviews. This model allows us to align different contributions of literature reviews with their underlying knowledge conversions - thereby building a bridge between the previously largely unconnected fields of literature reviews and epistemology. We evaluate the appropriateness of the model by conducting an empirical analysis of 173 IS literature reviews which were published in 39 pertinent IS journals between 2000 and 2014. Based on this analysis, we derive an epistemological taxonomy of IS literature reviews, which complements previously suggested typologies.

The protection of information technology (IT) has become and is predicted to remain a key economic challenge for organizations. While research on IT security investment is fast growing, it lacks a theoretical basis for structuring research, explaining economic-technological phenomena and guide future research. We address this shortcoming by suggesting a new theoretical model emerging from a multi-theoretical perspective adopt-ing the Resource-Based View and the Organizational Learning Theory. The joint appli-cation of these theories allows to conceptualize in one theoretical model the organiza-tional learning effects that occur when the protection of organizational resources through IT security countermeasures develops over time. We use this model of IT security invest-ments to synthesize findings of a large body of literature and to derive research gaps. We also discuss managerial implications of (closing) these gaps by providing practical ex-amples.

Nowadays, providing employees with failure-free access to various systems, applications and services is a crucial factor for organizations? success as disturbances potentially inhibit smooth workflows and thereby harm productivity. However, it is a challenging task to assign access rights to employees? accounts within a satisfying time frame. In addition, the management of multiple accounts and identities can be very onerous and time consuming for the responsible administrator and therefore expensive for the organization. In order to meet these challenges, firms decide to invest in introducing an Identity and Access Management System (IAMS) that supports the organization by using policies to assign permissions to accounts, groups, and roles. In practice, since various versions of IAMSs exist, it is a challenging task to decide upon introduction of an IAMS. The following study proposes a first attempt of a decision support model for practitioners which considers four alternatives: Introduction of an IAMS with Role-based Access Control RBAC) or without and no introduction of IAMS again with or without RBAC. To underpin the practical applicability of the proposed model, we parametrize and operationalize it based on a real world use case using input from an expert interview.

Many academic disciplines - including information systems, computer science, and operations management - face scheduling problems as important decision making tasks. Since many scheduling problems are NP-hard in the strong sense, there is a need for developing solution heuristics. For scheduling problems with setup times on unrelated parallel machines, there is limited research on solution methods and to the best of our knowledge, parallel computer architectures have not yet been taken advantage of. We address this gap by proposing and implementing a new solution heuristic and by testing different parallelization strategies. In our computational experiments, we show that our heuristic calculates near-optimal solutions even for large instances and that computing time can be reduced substantially by our parallelization approach.

Enduring doubts about the value of IS investments reveal that IS researchers have not fully managed to identify and to explain the economic benefits of IS. Three research tasks are essential requisites on the path towards addressing this criticism: the synthesis of knowledge, the identification of lack of knowledge, and the proposition of paths for closing knowledge gaps. This paper considers each of these tasks by a) synthesizing key research findings based on a comprehensive literature review, b) identifying and unfolding key limitations of current research, and c) applying a decision-theoretic perspective, which opens new horizons to IS business value research and shows paths for overcoming the limitations. The adoption of this perspective results in a decision-theoretic foundation of IS business value research and includes the proposition of a consistent terminology and a research model that frames further research.

Emerging digital environments and infrastructures, such as distributed services and computing services, have generated new options of communication, information sharing, and resource utilization in past years. Different distributed trust concepts are applied to increase trust in such systems. However, these concepts yield to rather complex architectures which make it difficult to determine which component or system needs to be trusted. This paper presents a novel trust measurement method for distributed systems which enables the t identification of weak points in the overall system architecture. The measurement method includes the specification of a formal trust language and its representation by means of propositional logic formulas. The applicability of the proposed concepts is demonstrated by conducting a case study on the Internet voting system that was used in the 2007 parliamentary elections in Estonia.

In a world, where more and more businesses seem to trade in an online market, the supply of online services to supply the ever-growing demand could quickly reach its capacity limits. Online service providers may find themselves maxed out at peak operation levels during high-traffic timeslots but too little demand during low-traffic timeslots, although the latter is becoming less frequent. At this point not only deciding which user is allocated what level of service becomes essential, but also the magnitude of the service provided, can be controlled by pricing. Pricing is an important factor when efficient and acceptable allocation of resources between individuals must be reached. Without prices, transferring or sharing goods would be impossible. In sharing information, pricing a product however is not as simple as relatively pricing an apple or a pear. Often the costs, and hence the prices are simply unknown. Backed by this scenario, the online services market could be combined with the market design mechanism of diamonds. For this we propose an ultimatum pricing strategy which effectively allows for valuations to be accounted for, but no longer a necessity when pricing in grid, cloud or other online computing environments.

This paper presents a fuzzy set based decision support model for taking uncertainty into account when making security investment decisions for distributed systems. The proposed model is complementary to robabilistic approaches and useful in situations where probabilistic information is either unavailable or not appropriate to reliably predict future conditions. We ?rst present the speci?cation of a formal security language that allows to specify under which conditions a distributed system is protected against security violations. We show that each term of the security language can be transformed into an equivalent propositional logic term. Then we use propositional logic terms to de?ne a fuzzy set based decision model. This optimization model incorporates uncertainty with regard to the impact of investments on the achieved security levels of components of the distributed system. The model also accounts for budget and security constraints, in order to be applicable in practice.

In double-sided markets for computing resources an optimal allocation schedule among job offers and requests subject to relevant capacity constraints can be determined. With increasing storage demands and emerging storage services the question how to schedule storage jobs becomes more and more interesting. Since such scheduling problems are often in the class NP-complete an exact computation is not feasible in practice. On the other hand an approximation to the optimal solution can easily be found by means of using heuristics. The problem with this attempt is that the suggested solution may not be exactly optimal and is thus less satisfying. Considering the two above mentioned solution approaches one can clearly find a trade-off between the optimality of the solution and the efficiency to get to a solution at all. This work proposes to apply and combine heuristics in optimization to gain from both of their benefits while reducing the problematic aspects. Following this method it is assumed to get closer to the optimal solution in a shorter time compared to a full optimization.

While many theoretical arguments against or in favor of open source and closed source software development have been presented, the empirical basis for the assessment of arguments and the development of models is still weak. Addressing this research gap, this paper presents the first comprehensive empirical investigation of published vulnerabilities and patches of 17 widely deployed open source and closed source software packages, including operating systems, database systems, web browsers, email clients, and office systems. The empirical analysis uses comprehensive vulnerability data contained in the NIST National Vulnerability Database and a newly compiled data set of vulnerability patches. The results suggest that it is not the particular software development style that determines the severity of vulnerabilities and vendors? patching behavior, but rather the specific application type and the policy of the particular development community, respectively.

Enduring doubts about the value of IS investments reveal that IS researchers have not fully managed to identify and to explain the economic benefits of IS. This paper assumes that literature reviews, which represent a powerful instrument for the identification and synthesis of knowledge, have not tapped their full potential to address this issue due to deficiencies in methodology. The analysis of 18 literature reviews published in pertinent academic outlets during the past 20 years shows such deficiencies. Two of the most critical weaknesses identified are (1) the lack of theory use in most reviews and (2) a weak linkage of reviews, resulting in little progress in theory and framework development. The systematic identification of these weaknesses and the extraction of promising methodological examples from past literature are the main contributions of this work, which supports the composition of more effective literature reviews in future research.

The increasing availability and deployment of open source software in personal and commercial environments makes open source software highly appealing for hackers, and others who are interested in exploiting software vulnerabilities. This deployment has resulted in a debate ?full of religion? on the security of open source software compared to that of closed source software. However, beyond such arguments, only little quantitative analysis on this research issue has taken place. We discuss the state-of-the-art of the security debate and identify shortcomings. Based on these, we propose new metrics, which allows to answer the question to what extent the review process of open source and closed source development has helped to fix vulnerabilities. We illustrate the application of some of these metrics in a case study on OpenOffice (open source software) vs. Microsoft Office (closed source software).

While many theoretical arguments against or in favor of open source and closed source software development have been presented, the empirical basis for the assessment of arguments is still weak. Addressing this research gap, this paper presents a comprehensive empirical investigation of the patching behavior of software vendors/communities of widely deployed open source and closed source software packages, including operating systems, database systems, web browsers, email clients, and office systems. As the value of any empirical study relies on the quality of data available, this paper also discusses in detail data issues, explains to what extent the empirical analysis can be based on vulnerability data contained in the NIST National Vulnerability Database, and shows how data on vulnerability patches was collected by the author to support this study. The results of the analysis suggest that it is not the particular software development style that determines patching behavior, but rather the policy of the particular software vendor.

Reviewing literature on open source and closed source security reveals that the discussion is often determined by biased attitudes toward one of these development styles. The discussion specifically lacks appropriate metrics, methodology and hard data. This paper contributes to solving this problem by analyzing and comparing published vulnerabilities of eight open source software and nine closed source software packages, all of which are widely deployed. Thereby, it provides an extensive empirical analysis of vulnerabilities in terms of mean time between vulnerability disclosures, the development of disclosure over time, and the severity of vulnerabilities, and allows for validating models provided in the literature. The investigation reveals that (a) the mean time between vulnerability disclosures was lower for open source software in half of the cases, while the other cases show no differences, (b) in contrast to literature assumption, 14 out of 17 software packages showed a significant linear or piecewise linear correlation between time and the number of published vulnerabilities, and (c) regarding the severity of vulnerabilities, no significant differences were found between open source and closed source.

Der Beitrag diskutiert die kontroversen Ans{\"a}tze ? Verifizierung versus Evaluation/Zertifizierung ? zur Sicherung elektronischer Wahlen mit Wahlger{\"a}ten. Dabei spielt das Urteils des Bundesverfassungsgerichts [BVG099] eine zentrale Rolle. Hierin wird entschieden, dass die Zertifizierung des Wahlger{\"a}tes nicht ausreicht und es werden Verifizierungsfunktionen gefordert, die den W{\"a}hlern die M{\"o}glichkeit geben sich von der Integrit{\"a}t des Wahlergebnisses zu {\"u}berzeugen. Der Beitrag zeigt auf, dass auch mit der Implementierung entsprechender Verifizierungsfunktionen nicht auf Zertifizierung verzichtet werden kann, da an ein Wahlger{\"a}t auch andere Anforderungen wie etwa hinsichtlich des Wahlgeheimnisses gestellt werden. Es wird au{\ss}erdem die Frage diskutiert, warum der Zertifizierung hinsichtlich dieser zus{\"a}tzlichen Anforderungen vertraut werden kann, w{\"a}hrend dies nicht der Fall bei der Integrit{\"a}tsanforderung ist.

The Estonian parliamentary election in 2007 is regarded as a success story of large-scale Internet elections. I use this election in a single case study on practical security to show that low quality of security and its management does not necessarily prevent large-scale Internet elections from being conducted. I also provide research propositions with regard to future challenges for large-scale Internet elections.

Spamming remains a form of Internet abuse, which burdens the Internet infrastructure, is generally regarded as an annoyance, and is said to cause economic harm to the tune of about several billion US\$ per year. Many technological, organizational, and legislative anti-spam measures have already been proposed and implemented, but have not led to any substantial decrease in the number of spam e-mails. We propose here a new infrastructure framework that combines several anti-spam measures in a framework that features both a technological and an organizational facet. The key element of our infrastructure is a new organizational unit that reliably and transparently limits he number of e-mails that can be sent per day and per account. This paper first gives an overview of the framework, then it provides technological and organizational details of the infrastructure, the deployment of which depends to a large degree on its acceptance and propagation by the ICANN, the ISOC, and by large e-mail service providers. Finally, the paper discusses the limitations and drawbacks of the proposed framework.

Spam e-mails have become a serious technological and economic problem. So far we have been reasonably able to resist spam e-mails and use the Internet for regular communication by deploying complementary anti-spam approaches. However, if we are to avert the danger of losing the Internet email service as a valuable, free, and worldwide medium of open communication, anti-spam activities should be performed more systematically than is done in current, mainly heuristic, anti-spam approaches. A formal framework within which the modes of spam delivery, anti-spam approaches, and their effectiveness can be investigated, may encourage a shift in methodology and pave the way for new, holistic anti-spam approaches. This paper presents a model of the Internet e-mail infrastructure as a directed graph and a deterministic finite automaton, and draws on automata theory to formally derive the modes of spam delivery possible. Finally the effectiveness of anti-spam approaches in terms of coverage of spamming modes is assessed.

Spam has become one of the most annoying and costly phenomenon in the Internet. Valid e-mail addresses belong to the most valuable resources of spammers, but little is known about spammers? behavior when collecting and harvesting addresses and spammers? capabilities and interest in carefully directed, consumer-oriented marketing have not been explored yet. Gaining insight into spammers? ways to obtain and (mis)use e-mail addresses is useful in many ways, e.g. for the assessment of the effectiveness of address obscuring techniques and the usability and necessity of hiding e-mail addresses on the Internet. This paper presents a spam honeypot project in progress addressing these issues by systematically placing e-mail addresses in the Internet and analyzing received e-mails. The honeypot?s conceptual framework, its implementation, and first empirical results are presented. Finally, an outlook on further work and activities is provided.

Spam as unsolicited e-mail to a large number of recipients is known to ecome an increasingly disturbing and costly issue of electronic business and internet traffic. Mainly technical-oriented approaches are applied with a focus on blocking, filtering, and authentication mechanisms based on the domain name system. They come along with different drawbacks and have all low effectiveness in common. The article sketches these approaches, shows its limitations, and proposes an account-based approach where the number of e-mails per day and account is restricted.

Remote Internet voting systems still suffer from many security problems which rely on the clients, the servers, and the network connections. Denial-ofservice attacks and viruses still belong to the most challenging security issues. Projects and studies like the ?Voting Technology Project? of CALTECH and MIT or SERVE of the US Department of Defense set up to gain experience evidence many of the notional weaknesses of current Internet voting systems.

Voting via the Internet has become a feasible option for political as well as non-political ballots. However, there are many obstacles which have to be overcome, especially legal restrictions have to be transformed into technical and security solutions. The article starts with a brief presentation of advantages and disadvantages of Internet ballots and presents application fields and pilot schemes. Then, technological security aspects are derived due to democratic basic principles. Especially the applied voting procedures are critical in security terms. Hence, the most relevant cryptographic protocols are presented and their drawbacks and shortcomings are identified. However, this article does not propose a new voting protocol. Beyond fixing cryptographic procedures for ballots, more elements are to be specified, e.g. responsibilities and rights of involved authorities or security precautions regarding hardware and software. For this reason, a structural security framework for electronic voting systems is presented which can be used for their composition and analysis.