Search

Information Technology governance (IT Governance) in the world of education is quite widely used including in Indonesia itself, for example at some educational institutes. The ITIL framework, used as a tool for evaluation, audit and also as a reference implementation. To help improve the Universitas Multimedia Nusantara (UMN) IT service in the service operation section, it is necessary to know the maturity level of the service, which is then done through the measurement of maturity level in the service operation section. In addition, the measurement results obtained can be used to produce the right recommendations with the problems found in the service. Measurements are made on the domain service operation which is the focus of UMN's IT department services. Service Operation has 5 indicators: incident management, problem management, access management, event management and request fulfillment. In this research, the framework used is ITIL Version 2011. The result of this measurement has been found: incident management, problem management, event management and request fulfillment get the result of measurement at level 1 and access management up to level 2. The result of measurement and recommendation given is expected to be input material and become development material that can be used by the IT department of Universitas Multimedia Nusantara.

This article presents a machine learning approach in a heterogeneous group of algorithms in a transport type model for the optimal distribution of tasks in safety-critical systems (SCS). Applied systems in the working area identify the determination of their parameters. Accordingly, in this article, machine learning models are implemented on various subsets of our transformed data and repeatedly calculated the bounds for 90 percent tolerance intervals, each time noting whether or not they contained the actual value of X. This approach considers the features of algorithms for solving such important classes of problem management as the allocation of limited resources in multi-agent SCS and their most important properties. Modeling for the error was normally distributed. The results are obtained, including the situation requiring solutions, recorded and a sample is made out of the observations. This paper summarizes the literature review on the machine learning approach into new implication research. The empirical research shows the effect of the optimal algorithm for transport safety-critical systems.

Bug tracking systems manage bug reports for assuring the quality of software products. A bug report (alsoreferred as trouble, problem, ticket or defect) contains several features for problem management and resolution purposes. Severity and priority are two essential features of a bug report that define the effect level and fixing order of the bug. Determining these features is challenging and depends heavily on human being, e.g., software developers or system operators, especially for assessing a large number of error and warning events occurring on software products or network services. This study first proposes a comparison of machine learning techniques for assessing severity and priority for software bug reports and then chooses an approach of using optimal decision trees, or random forest, for further investigation. This approach aims at constructing multiple decision trees based on the subsets of the existing bug dataset and features, and then selecting the best decision trees to assess the severity and priority of new bugs. The approach can be applied for detecting and forecasting faults in large, complex communication networks and distributed systems today. We have presented the applicability of random forest for bug report analysis and performed several experiments on software bug datasets obtained from open source bug tracking systems. Random forest yields an average accuracy score of 0.75 that can be sufficient for assisting system operators in determining these features. We have provided some analysis of the experimental results.

In visual distance education, online classroom education mode is the latest form, which requires the use of digital technology, Internet technology, so as to be able to develop. The traditional form of education is classroom education in which teachers teach the content of class textbooks. This kind of teaching method can make students simply feel bored in the learning content, and they are always not interested in learning. In the process of learning, due to the lack of initiative, the content is only blindly accepted, but not understood. This situation seriously affects the possibility of students’ autonomous learning. Moreover, due to the continuous development of the Internet, the embedded system has gradually become mature, and now has been favored by many industries, especially in the Internet of things, in order to improve the front-end equipment of the Internet of things, and help to obtain and identify information in a short time. The development of software system based on new technology of embedded devices further promotes the development of Internet of things and the application in many fields. The development scale of embedded software is more and more large and complex, which brings a lot of problems to the past embedded software testing. Through the in-depth research and analysis of the Internet of things and embedded software system, combined with the development trend and research hotspot of visual distance education, the theory and practicality, Internet of things and embedded software related to the research field are combined with engineering design, system design, theme design and system design. This paper introduces the test problem management, online testing and other functional methods. Finally, this paper analyzes the problems in the development and application of network education platform, so as to further promote the sustainable development of visual distance education platform.

Traditional process mining techniques offer limited possibilities to analyze business processes working in low-predictable and dynamic environments. Recently, to close this gap, declarative process models have been introduced to represent process mining results since they allow for describing complex behaviors as a compact set of business rules. However, in this context, activities of a business process are still considered as atomic/instantaneous events. This is a strong limitation for these approaches because often, in realistic environments, process activities are not instantaneous but executed across a time interval and pass through a sequence of states of a lifecycle. This paper investigates how the existing techniques for the discovery of declarative process models can be adapted when the business process under analysis contains non-atomic activities. In particular, we base our proposed approach on the use of discriminative rule mining to determine how the characteristics of the activity lifecycles in a business process influence the validity of a business rule in that process. The approach has been implemented as a plug-in of the process mining tool ProM and validated on synthetic logs and on a real-life log recorded by an incident and problem management system called VINST in use at Volvo IT Belgium. HighlightsWe present an approach to discover declarative specifications from logs.The approach has a strong focus on activity lifecycles.The lifecycle identification can be FIFO-based or event correlation based.The approach is implemented as a ProM plug-in.The approach has been validated on synthetic logs and on a real-life log.

Process safety incidents have large consequences on people, community and environment; hence, it is important to have a learning organization to build on lessons learned from incidents both within and outside the organization. In this study, a web-based collection of process safety incidents is categorized and analyzed in a two-tiered manner to identify proximate causes. Further, a risk-based framework is used to determine deficiencies in the safety management systems. 96 incidents were collected and subjected to the analysis. Even though these incidents are from across the world, they are not statistically representative due to the lack of a universal database of process safety incidents. During the analysis, it was observed that 60% of the incidents resulted in explosions and 16% had equipment malfunction as a proximate cause. In addition, the analysis using the risk-based framework showed that incidents were influenced by a deficiency of safe work practices, operating procedures and conduct of operations. Future work in this area includes the development of tools for continuous monitoring of safety critical systems by leveraging lessons learned from previous incidents.

Traffic incidents can result in different kinds of hazards (e.g., plumes) that influence the status of road networks, therefore there is a great need for incident management in the presence of the hazards. When incidents occur, the created hazards not only affect the normal road users (make them detour or blocked), but also influence the movement of first responders. Traffic managers, who are responsible for maintaining the road safety and traffic stability, should carry out quick and effective measures to manage the incidents. In this paper, we present four issues to help people better understand the situations that could occur in the management of incidents with hazards: 1). Evacuation in the presence of hazards; 2). 3D incident management; 3). Navigation support for first responders; 4). Navigation support for road users. To address these issues, we propose a solution which combines agent technology, geo-database, hazard simulation, and traffic simulation. Further research would be needed to investigate the potentials of the proposed solution in real applications.

Decision support systems must provide the tools for effective problem management thus improving the whole decision process, from problem conception to solution implementation. However, model creation heavily depends on the modeler’s expertise and the problem conception. This work focuses on automating the problem modeling and creating semantically enriched models. As a result, the modeler is supported in the modeling process. An automated modeling platform is developed, which encompasses mathematical models, their formal representation and the semantic model of the represented system. In addition, intelligent agents are designed in order to provide additional reasoning capabilities and create case rules for model creation, problem application storage and usage. A case study is performed using a scheduling modeling and solution example. Specifically, a systematic approach to scheduling model selection and solution implementation is achieved, thus enabling the bridge between theoretical developments and industrial practice.

Bug tracking systems manage bug reports for assuring the quality of software products. A bug report also referred as trouble, problem, ticket or defect contains several features for problem management and resolution purposes. Severity and priority are two essential features of a bug report that define the effect level and fixing order of the bug. Determining these features is challenging and depends heavily on human being, e.g., software developers or system operators, especially for assessing a large number of error and warning events occurring on software products or network services. This study proposes an approach of using random forest for assessing severity and priority for software bug reports automatically. This approach aims at constructing multiple decision trees based on the subsets of the existing bug dataset and features, and then selecting the best decision trees to assess the severity and priority of new bugs. The approach can be applied for detecting and forecasting faults in large, complex communication networks and distributed systems today. We have presented the applicability of random forest for bug report analysis and performed several experiments on software bug datasets obtained from open source bug tracking systems. Random forest yields an average accuracy score of 0.75 that can be sufficient for assisting system operators in determining these features. We have provided some analysis of the experimental results.

Catastrophic incidents, while common in the world, are rare events to any single facility or even company. Were anyone to count catastrophic incidents to measure Process Safety performance, it is likely the facility would be gone before they counted to two. We look instead to Near Miss incidents as one measure of Process Safety performance. We count them and measure their frequency. We implement corrective actions to prevent reoccurrence. We look beyond the specific incident to apply the lessons in other areas. Most importantly, we look for faults in our management systems that permitted the near miss to occur. Defining near misses, identifying their occurrence, and fully learning the lessons they can teach us can be a difficult undertaking. Simple communication of these incidents can be problematic. And, learning lessons from an incident occurring at another facility can challenge even the broadest-minded people. This article will describe the learning process that has evolved at one specialty chemical company. It will include definitions of specific types of near misses, how data are gathered and communicated, and information on the number and type of incidents occurring. The reader will gain ideas on how to classify and collect data on specific near miss incidents, and ways to communicate the information throughout a company. © 2015 American Institute of Chemical Engineers Process Saf Prog, 2015

Internet is inundated with large amount of intrusion, attack and other security incidents, which have posed a serious threat to network security. Security evaluation is one of the important management means throughout the life cycle of information system; it is also a basis and premise of formulating and adjusting the security strategies. Accurately predicting the impending security incidents and evaluating the possible degree of detriment are the decision-making foundation in network security defense. In this paper, a hierarchical detriment evaluation method of security incidents is put forward, after direct detriment is calculated ,indirect detriment of the incidents is calculated based on service dependence and permission transfer relations, and then, the overall detriment of security incidents is obtained.

Information Technology (IT) plays a very important role in all organizations. IT executives are constantly faced with problems that are difficult to tackle. Failure in IT service can interrupt the functioning of an organization. Case-Based Reasoning (CBR) is a problem solving methodology where experience in the form of past cases can be used to solve problems, thereby assisting the automation of problem solving and experience management. Furthermore, the performance, quality and efficiency of CBR systems can be enhanced through data mining. In order to support the IT team for faster and efficient problem resolution, a case-based reasoning approach integrated with data mining techniques could be utilized. In this paper, the study done on various CBR systems and data mining techniques for problem and experience management is explained. A system is proposed for IT experience and problem management with semantic retrieval in order to increase the efficiency and quality of the IT support service.

To apportion blame, and by extension liability, for an accident it is necessary to decide causality, who caused the accident and how it was caused. The same requirements apply to the preventative management of such potential accidents, except blame is assigned post-hoc, after the event, whereas preventative management is essentially proactive and obviates the need for blame. Much thinking is based on the notion that there is a single root cause of an incident, the most important cause and therefore the one pointing at liability as well as determining the main target for prevention. This is embedded in the idea that incident causation is linear and deterministic, that there are clear sequences of causes going back to a root cause. This way of thinking has proved very successful and its preventative application may be regarded as reducing the number of (potential) accidents by 80%. Most of these 80% accidents are personal; the development and use of the Swiss Cheese model, aimed also at process incidents, h...

At present information security (IS) incidents have become not only more numerous and diverse but also more damaging and disruptive. Preventive controls based on the IS risk assessment results decrease the majority but not all the IS incidents. Therefore, an IS incident management system is necessary for rapidly detecting IS incidents, minimizing loss and destruction, mitigating the vulnerabilities that were exploited and restoring the Internet of Things infrastructure (IoTI), including its IT services. These systems can be implemented on the basis of a Security Operations Center (SOC). Based on the related works a survey of the existing SOCs, their mission and main functions is given. The SOCs' classification as well as the key indicators of IS incidents in IoTI are proposed. Some serious first-generation SOCs' limitations are defined. This analysis leads to the main area of further research launched by the author.

‘Cyber Incidents’ are common in every domain where technology is prevalent. Recurring or sequential incidents are not unusual and are often manageable. Whilst more rare, the incidents that reach crisis levels have been shown to cause an unexpected amount of damage.

It is common knowledge in the IT service domain that changes to the system configuration are responsible for a major portion of incidents that result in client outages. However, it is typically very difficult to establish a relationship between changes and incidents as proper documentation takes lower priority at change creation time, as well as during incident management, in order to deal with the tremendous time pressure to quickly implement changes and resolve incidents. As a result, it is often not possible to leverage historical data to perform retrospective analysis to identify any emerging trends linking changes to incidents, or to build predictive models for proactive incident prevention at change creation time. In this paper, we present an approach for establishing causality between changes and incidents through an ensemble of statistics, data classification, and natural language processing techniques. We demonstrate our approach with a real world example.

This article is focused on the problem how to minimize the damage of an economic entity because of reputation loss as a result of information security incidents. There are many techniques concerning such kind of problem worldwide. However the issues of using the analysis tools of information security incidents are paid not much attention, so the organizations can seriously damage their reputation and obviously decrease their commercial profits. The article describes an approach to define the parameters for reputational risk due to information security incidents. The article defines how to determine the source of incidents and to form a list of actual threats and to calculate the consequences of their implementation. The article offers the techniques of the reputational risk management due to information security incidents. The techniques can be implemented in any organization, no matter how big it is and no matter which kind of business it is occupied.

VINST is a system used to record all activities related to the incident and problem management in Volvo IT Belgium. In this VINST system, activities recorded in several attributes, such as serial number, change date and time, status, and any other attributes needed, which is stored in the event log. In these sequenced activities, there are some specific knowledge that is not explicitly described in the event log. To find some of the necessary knowledge, this study extracts knowledge from the event log, by using process mining. Heuristic miner algorithm was implemented in this study, because this algorithm has advantages compared to other methods, such as the ability to calculate the frequency of the process, to handle noise, and to combine the frequency between events and trace in the event log to build a process model. The steps being taken in this study began with the discovery process, followed by conformance checking, and completed with process model extension in enhancement step, which was finding knowledge based on analysing process model and event log. This study was using a specifically designed program to achieve the goals of this study. This study used VINST incident records with 149 cases consisting of 2.771 events. By applying heuristics miner, a process model discovered with precision, recall, and f-measure more than 96%. Knowledge gained from this process model extension were the analysis of time and organizational perspectives in forms of timestamp-impact attribute relation and originator-impact attribute relation.

Author's version of an article in the journal: Computers and Security. Also available from the publisher at: http://dx.doi.org/10.1016/j.cose.2012.09.001 In the present study, we draw on previous system dynamics research on operational transition and change of vulnerability to investigate the role of incident response capability in controlling the severity of incidents during the adoption of new technology. Toward this end, we build a system dynamics model using the Norwegian Oil and Gas Industry as the context. The Norwegian Oil and Gas Industry has started to adopt new information communication technology to connect its offshore platforms, onshore control centers, and suppliers. In oil companies, the management is generally aware of the increasing risks associated with operational transition; however, to date, investment in incident response capability has not been highly prioritized because of the uncertainty related to risks and the present reactive mental model of security risk management. The model simulation shows that a reactive approach to security risk management might trap the organization into blindness to minor incidents and low incident response capability, which can lead to severe incidents. The system dynamics model can serve as a means to promote proactive investment in incident response capability.

The article is dedicated to the problem of decision making in complex systems. Application of a novel interdisciplinary approach, which widely use intelligent agents is offered. The principal ideas of the novel approach are embodied into the DeciMaS framework, that offers a logical set of stages oriented to creation of decision support systems for complex problem management. The components of the DeciMaS framework and the way in which they are organized are introduced. Design and implementation of the system are discussed. The article demonstrates how the initial information is transformed into knowledge. Impact assessment upon human health evaluation is the case study, which is resolved by DeciMas framework. It includes creation of the meta-ontology. In addition, a multi-agent architecture for a decision support system is introduced. The sequence of the steps for the DeciMaS framework design with Prometheus Development Kit and its implementation with JACK Development Environment are presented as well. Finally, data and experiment results of data modeling, simulation, impact assessment, and decision generation are discussed.

SummaryInterest in the field of patient safety incident reporting and analysis with respect to Health Information Technology (HIT) has been growing over recent years as the development, implementation and reliance on HIT systems becomes ever more prevalent. One of the rationales for capturing patient safety incidents is to learn from failures in the delivery of care and must form part of a feedback loop which also includes analysis; investigation and monitoring. With the advent of new technologies and organizational programs of delivery the emphasis is increasingly upon analyzing HIT incidents.This thematic review had two objectives, to test the applicability of a framework specifically designed to categorize HIT incidents and to review the Welsh incidents as communicated via the national incident reporting system in order to understand their implications for healthcare. The incidents were those reported as IT/ telecommunications failure/ overload. Incidents were searched for within a national reporting system using a standardized search strategy for incidents occurring between 1st January 2009 and 31st May 2011. 149 incident reports were identified and classified. The majority (77%) of which were machine related (technical problems) such as access problems; computer system down/too slow; display issues; and software malfunctions. A further 10% (n = 15) of incidents were down to human-computer interaction issues and 13% (n = 19) incidents, mainly telephone related, could not be classified using the framework being tested.On the basis of this review of incidents, it is recommended that the framework be expanded to include hardware malfunctions and the wrong record retrieved/missing data associated with a machine output error (as opposed to human error).In terms of the implications for clinical practice, the incidents reviewed highlighted critical issues including the access problems particularly relating to the use of mobile technologies.

This paper presents a Translation ITIL (Information Technology Infrastructure Library) Service Operation to Ontological Artifacts. The model is used to solve an unplanned interruption to an IT service or reduction in the quality of an IT service operation and the impact of incidents that cannot be prevented. The focus of the research is on IT service operation in organization , based on Incident Management and Problem Management of ITIL Framework. The research uses OWL design Ontological Artifacts and SQWRL (Semantic Query-enhanced Web Rule Language) which is a SWRLbased query language that can be used to query OWL ontologies, using Protege software as a tool. To implement Ontological Artifacts and Visualization of Process Activities we use Protege to design Business Cases. The Business Cases are presented in 4 types: Incident Management for Procurement , Problem Management for Procurement , Incident Management for Communication Network Failure and Problem Management for Communication Network Failure. The goal of this paper is to produce an OWL of those Business Cases. We organize a group of 5 domain experts to verify and validate. The mean value of evaluation is 4.60 (maximum=5) or 92%. This model has been implemented in the Computer Center’s Directorate of Communications and Electronics, Royal Thai Air Force.

Incident trend analysis is a practice where historical incident records and reports are investigated in order to identify patterns or trends in incident root causes. It is needed to prevent reoccurrence of incidents in order to improve the quality of service in ICT infrastructures. The research problem of this study is how quality of service could be improved by analysis of incidents with root causes related to human errors. Human error related root causes of IT service incidents are classified with the Human Factors Analysis and Classification System (HFACS) and also according to IT service management processes. 18 incident reports containing enough information to track the contributing conditions behind the harmful human act were investigated. As a result, three major types of sequences of events were identified. These event sequences describe error pathways leading to the active failure. By combining two categorization models, HFACS and ITSM processes, in a two dimensional matrix, we found that that most of the error pathways were related to change planning.

Problem determination and resolution (PDR) is at the core of Incident and Problem Management. PDR is the process of detecting an anomaly in a monitored system, identifying the nature of the anomaly in view of routing to the appropriate support team, determining the root cause responsible for the anomaly and fixing or eliminating the cause of the problem. The cost of PDR represents a substantial part of operational costs, and faster, more effective PDR can contribute to a substantial reduction in system administration costs. The methodologies described by the authors in this chapter relate to automation of critical aspects of PDR, such as problem classification for targeted diagnosis and structuring of solved problem tickets for offering systematized resolution to the support personnel.

Industrial control systems are used to control and supervise plants and critical infrastructures. They are crucial for operation of many industries and even society at large. However, despite efforts to secure such systems, there are frequent reports of incidents that lead to problems because of human error (e.g., installing unauthorized software on a mission-critical machine) or even cyber attacks. While such incidents should be prevented in the first place, it is not feasible to achieve 100% security; therefore, operators should be prepared to deal with incidents promptly and efficiently if they occur. In this paper, we present a general methodology and framework for investigating incidents in industrial control systems. The methodology is supported by a tool to automate an investigation, especially to efficiently determine the state of files on a device after an incident. This enables faster recovery from incidents by being able to identify suspicious files and focus on the files that have been modified compared to the initially installed files, or a previously taken baseline. An evaluation confirms the applicability of the methodology for an embedded industrial controller and for an industrial control system.

This article describes the data in search results of crawl a crawl Web search engine to build the item repository. These methods make the efficiency of building Q improve and the costs reduce. Examing the questions based on XML storage format also have a very strong compatibility. Introduction The test resources library adapts in large-scale development of the cause of examination and examination work with more scientific, standardized which needs developed. Strictly follow the theory of educational measurement, based on the accurate mathematical model and the educational measurement tool, which belongs to the field of computer-aided teaching (what??). Its basic unit is a single subject and the test database is a test warehouse. Problem management a good question bank can control the quality of the whole system, to achieve a variety of specialized functions, so as to effectively use questions for education and test. Test resource library construction is a complex systems engineering, first to establish the mathematical model of the system, then determine item attribute index and test structure, to organize a large number of outstanding teachers to write papers, in order to ensure the scientificalness and validity of these questions, which should organize a large number of test samples, sampling and testing, the item parameter label is effective for correction. The traditional method of test resources library to establish the need to consume a large amount of manpower and material resources,After decades of development, many fields have accumulated a lot of questions of resources, if these resources for the collection and processing through the network, as the material for the test resources library, the cost of the item bank construction can be greatly reduced cost, construction time can be shortened, ,it is also conducive to the inheritance of test resources and sharing. The network data capture using the technology basically used vertical search engine technology of web spider (or data acquisition robot), word segmentation system, tasks and index system technology of comprehensive and complete. Vertical search engine for a certain industry professional search engine, search object are usually specific website, and test resource on the network is basically evenly distributed in a large number of web servers, and the question involved in the field is various, content is very wide in the pan. The test resources on the network for data capture the full text search engine more suitable; can use the mainstream search massive search engine results were analyzed to obtain the related questions of resources. Basic Function Module A lot of questions of resources must be through the rational organization and management can be easily used by the majority of teachers and students. Therefore, it is necessary to build the test resources library, resource library cannot only store a lot of questions, but also can store the and related test some important information, such as courses, chapters, types, difficulty, solution analysis, and so on, but also 3rd International Conference on Management, Education, Information and Control (MEICI 2015) © 2015. The authors Published by Atlantis Press 1241 must provide quick query and statistical functions and convenient import and export functions. The main functions modules of the test library are shown in Fig. 1. Fig. 1 Function module chart of test resource library As Fig. 1 shows, test resource library through the test the import function building, also open the question query and statistical analysis function module, the output of the item bank is divided into two parts, the electronic version of the questions through the test module is derived to obtain, the paper version of the test by printing and output module to obtain. At the same time, the cross library transfer of the test resource can be realized through the import and export of the questions based on XML. System Data Flow The source of the data source is the Internet resource, and the output is the format of the paper, and the map is the complete data flow chart of the resource library: Fig. 2 Data flow chart of test resource database

This paper describes four human error incidents in chemical process plants which I have personally observed, and discusses specific lessons from each of them. As often stated by Trevor Kletz, people respond to stories and examples, and hopefully these incidents will be useful in preventing similar incidents in the future. Fortunately none of the incidents resulted in serious safety consequences, although all cost some money and productivity. And, under other circumstances, similar errors in a more hazardous operation could have had serious safety consequences.

We have been discussing the management process for information security incidents. While we have emphasized that these incidents may, often, be prevented by taking a series of proactive steps such as risk management, inevitably those steps will fail and there will be an incident. When that happens, your proactive measures as well as solid preparation should help minimize the severity of the incident. It is axiomatic that our preparatory measures must be planned and executed to minimize the number and severity of such incidents.

Many incidents have occurred because organisations have failed to learn from lessons of the past. This means that there is room for improvement in the way organisations analyse incidents, generate measures to remedy identified weaknesses and prevent reoccurrence: the learning from incidents process. To improve that process, it is necessary to gain insight into the steps of this process and to identify factors that hinder learning (bottlenecks). This paper presents a model that enables organisations to analyse the steps in a learning from incidents process and to identify the bottlenecks. The study describes how this model is used in a survey and in 3 exploratory case studies in The Netherlands. The results show that there is limited use of learning potential, especially in the evaluation stage. To improve learning, an approach that considers all steps is necessary.

We took a brief look at the notion of risk in our last column. This time we'll conduct a similar examination of incident management. An important concept in managing incidents is the term itself: Managing Incidents. Note that the emphasis is not on incident response. The idea of managing digital incidents is build around the notion that incidents pose risk to the organization. Thus, they must be managed proactively and treated as part of the risk profile.

M-government is an emergent area for mobile applications, where citizens and organizations can interact with government and municipal agencies through mobile devices. One promising area for m-government is complaint and problem management, where mobile applications using the integrated functions of a cellular telephone can offer citizens convenient ways of rapidly reporting problems. The problems reported can then be effectively managed by the municipality using state-of-the-art workflow techniques. Furthermore, the municipality can inform citizens and companies of problems already reported or addressed, which can be visualized through interactive maps. In this study, a municipal e-service for complaint and problem management is transformed into an m-service and put into operation in a Swedish municipality. The experiences from developing the m-service comprise of a suggested design and several identified challenges. Suggestions for future research include the application of new technologies for positioning and the adaptation of the m-service to new cellular telephone models.

IT incident management aims to maintain high levels of service quality and availability by restoring normal service operations as quickly as possible and minimizing business impact. Enterprises often maintain many applications to support their business. It is a significant challenge to diagnose incidents at application level due to complicated causes often aggregated from the shared IT environment, network, hardware, software, and changes. In this paper, we present a new approach to diagnosing application incidents by effectively searching for relevant co-occurring and reoccurring incidents. These relevant incidents reveal patterns of application failures and provide insights into incident resolution and prevention. This paper also provides a case study where we implement this approach and evaluate its performance in terms of search accuracy.

IT is vital to business success or survival, IT provide not just technology but also a service. The objective of problem management is to minimize the impact of problems on the organization, which is an essential element for business service management. Supervised learning algorithms have been used for problem classification, but they rely on predefined classes and require each problem belongs to each category which sometimes is unreasonable. Moreover, with uncertainty, they may lead to poor quality. This paper proposes an uncertain fuzzy clustering problem classification approach based on partition. It does not rely on predefined classes and class-labeled training examples and allows that one problem can belongs to two or more categories by using fuzzy analysis and this approach use the expected sum of squared errors (E(SSE)) as its objective function instead of the sum of squared errors (SSE) to reduce uncertainty of data. This approach is unsupervised and automatic and is accurater than the others.

Ticket routing is key to the efficiency of IT problem management. Due to the complexity of many reported problems, problem tickets typically need to be routed among various expert groups, to search for the right resolver. In this paper, we study the problem of using historical ticket data to make smarter routing recommendations for new tickets, so as to improve the efficiency of ticket routing, in terms of the Mean number of Steps To Resolve (MSTR) a ticket. Previous studies on this problem have been focusing on mining ticket resolution sequences to generate more informed routing recommendations. In this work, we enhance the existing sequence-only approach by further mining the text content of tickets. Through extensive studies on real-world problem tickets, we find that neither resolution sequence nor ticket content alone is sufficient to deliver the most reduction in MSTR, while a hybrid approach that mines resolution sequences in a content-aware manner proves to be the most effective. We therefore propose such an approach that first analyzes the content of a new ticket and identifies a set of semantically relevant tickets, and then creates a weighted Markov model from the resolution sequences of these tickets to generate routing recommendations. Our experiments show that the proposed approach achieves significantly better results than both sequence-only and content-only solutions.

Publisher Summary The thorough investigation and analysis of incidents (both actual events and near misses), along with the appropriate follow-up, provides one of the most effective means of improving the safety and reliability of process facilities. Other risk management programs, such as hazards analysis and management of change, are directed toward anticipating problems so that corrective actions can be taken before an event occurs. Actual incidents, on the other hand, provide hard information as to how things can go wrong, thus helping to cut through wishful thinking, prejudice, ignorance, and misunderstandings. The root cause analysis that follows an incident investigation will help identify weaknesses and limitations in a facility's management system, thereby reducing the chance of recurrence of similar incidents. An effective incident investigation and analysis program generally contains two major components: technical and human. The technical side of the investigation is what most publications in this area focus on, particularly with regard to root cause analysis. However, what does not always receive the same degree of attention is the human aspect of incident investigation work. An effective investigator understands how people think and behave.

There is a significant number of IT failures per year because parts fail, products are used in ways they were not designed for, and humans make errors in using products. These failures result in incidents that product vendors service as a part of the warranty or contracts. Incidents incur significant costs for servicing them, including call centers, parts, and field engineers. Some of the major problems include lack of coherent incident information, leading to inaccurate service diagnosis and inability to forecast failures. At the same time, technology has evolved. Hardware is generally more reliable, failures are moving from hardware to firmware, software, and applications. The scale effect limits human operator engagement, prevents centralized approaches, and expands automation. Traditional ways of handling incidents are not appropriate any more.In this paper we present a set of tools and approaches that enable unified serviceability with self-healing, automated learning, and an analysis engine. Unified serviceability with self-healing results in clean incident data and it reduces criticality of incidents into deferred maintenance. Automated learning produces empirically proven actionable knowledge enabling cost reduction of automated incident resolution. Using clean data and actionable knowledge, the analysis engine helps predict failures and determine trends, resulting in preventive maintenance. Collectively, preventive and deferred maintenance and automated incident service significantly reduce the costs. This way we have aligned incidents cost with the technology trends.

In recent years, IT Service Management (ITSM) has become one of the most researched areas of IT. Incident and Problem Management are two of the Service Operation processes in the IT Infrastructure Library (ITIL). These two processes aim to recognize, log, isolate and correct errors which occur in the environment and disrupt the delivery of services. Incident Management and Problem Management form the basis of the tooling provided by an Incident Ticket Systems (ITS).

An incident management process is performed by the service desk that acts as contact point to the users and customers. The service desk records each incident (a failure report or a service request) reported by a user or a customer in the incident management system. Many IT organizations are interested in establishing an incident management system (IMS) that is compliant with IT Infrastructure Library (ITIL) service management framework. In this study, we aim to answer the research question is: what types of requirements should be taken account in building an incident management system. Lessons learned from a tool specification project in healthcare domain are presented. An effective IMS should be capable of handling incidents, service requests, problems and requests for change (RFCs); enable relating several incidents and RFCs to one problem; have a public known error database; and contain information on service level agreements.

The increasing complexity and dynamics in IT infrastructure and the emerging Cloud services present challenges to timely incident/problem diagnosis and resolution. In this paper we present a problem determination platform with multi-dimensional knowledge integration (e.g. configuration data, system vital data, log data, related tickets) and enablement for efficient incident and problem management of the enterprise. Three features of the platform are discussed: automated ticket classification, the automated association of resource with tickets based on integration with configuration database, and the collection of the system vitals relevant to the ticket through integration with monitoring systems. In response to the emerging Cloud services and their highly dynamic service operation context, we identify the need for a proactive service management approach which incorporates configurations and deployment of incident management tools, policies, and templates throughout the service life cycle in order to enable effective and efficient incident management in service operation.

An Electrical Inspector from the Health and Safety Executive (HSE) investigates many serious incidents and inspects a wide range of industrial and commercial premises. This experience gives rise to an insight into the types of incident that lead to serious injuries and death. Using this information it is possible to identify recurring types of incidents and assess them in a structured way. This will assist in managing the risks arising to prevent further serious incidents. (5 pages)

The modern requirements and the best practices in the field of Information Security (IS) Incident Management Process (ISIMP) are analyzed. "IS event" and "IS incident" terms, being used for ISIMP, have been defined. An approach to ISIMP development has been created. According to this approach ISIMP processes are described. As an example the «Vulnerabilities, IS events and incidents detection and notification» joint process is examined in detail.

Organizations face increasing challenges in addressing and preventing computer and network security incidents. There are financial consequences from security incidents. These include lost time and resources used during recovery, possible theft of personal and/or proprietary information, and reputational damage that may negatively impact stock prices or reduce consumer confidence in a company. Being able to understand and predict trends in computer and network security incidents can aid an organization with resource allocation for prevention of such incidents, as well as evaluation of mitigation strategies. We look at using time series models with a large set of security incident data. We examine appropriateness of the data for modeling and consider needed transformations. Parameter search and model selection criteria are discussed. Then, forecasts from time series models are compared to forecasts from Non-Homogeneous Poisson Process (NHPP) software reliability growth (SRG) models.

Application Service Maintenance Projects normally deals with Incidents as First Level support function. Incidents in majority directly link with Production Environment, so Turn around Time for Incidents is a significant factor. Many Companies are having Service Level Agreements with Customer for Turn around Time for Incidents. There is a need to focus on Estimating and Predicting Turn around Time for Incidents. Improvement in Turn around Time helps in improving the Service Level Agreements earlier agreed with the Customer. Saved time can be diverted to other Project Activities like Enhancements or for new requests. This will also helps as one of the paths for Companies to get new business with the Customer. We have used Capability Maturity Model Integration(CMMI)V1.2 Quantitative Project Management(QPM) methodology for Application Service Maintenance(ASM) Projects for estimating and predicting turn around time for incidents. By implementing this best practice in SEI CMMI Level 5 Company we have achieved a significant improvement of approximately 50 percent reduction in Average Turn around Time for incidents.

Investigations of many serious accidents in different fields have revealed that before every serious accident, a large number of related prior incidents occurred with limited impact and an even larger number of related incidents happened that resulted in no loss or damage. Collectively, these incidents are called near-misses. Near-misses provide insight into both potential failure points and weaknesses in the management system itself. Therefore, they can be a powerful tool to reduce risk and improve system reliability. Near-miss management systems (NMMS)s are designed to enable people and institutions to learn from high-frequency, low-impact incidents (near-misses) to prevent low-frequency, high-impact events (accidents). A comprehensive NMMS includes several important implementation steps, such as identification of near-misses, disclosure and reporting, prioritization and classification, distribution of the information, analysis of causes, solution identification, dissemination of actions and knowledge, resolution, and closure of the case. Successful implementation of an NMMS requires (a) strong management ownership, (b) participation and reporting of as many incidents as possible, and (c) use of quantitative tools to identify weaknesses and to improve the system. Keywords: near-miss; accident; safety; management; risk; reliability

In this paper, we consider an information system (IS) to be a set of technologies together with a set of rules about those technologies. An IS is considered to be prone to a privacy incident if it does not fully protect the private information of a user or if a dishonest user can take advantage of the privacy protection offered by the IS. This work identifies the potential privacy incidents that may occur in an IS, and proposes a framework, the MAPI Framework (Manage or Avoid Privacy Incidents), which designs IS to manage or avoid privacy incidents. The MAPI Framework can also be used for evaluating IS by identifying the missing or inappropriate technologies which may lead to privacy incidents.

Persistence and cost are the two factors that have motivated several studies about better practices for dealing with security incidents [5]. However, there is not much literature about IT professionals who have to deal with security incidents, in terms of which tasks they actually perform and which resources they need to handle the complex scenarios given by real incidents [6]. This lack of research makes it difficult to evaluate and improve the support that IT security professionals need to respond efficiently to security incidents.

Successful management of incidents that threaten an organization's cyber security is a complex endeavor. Frequently an organization's primary focus on the response aspects of security incidents results in its failure to manage incidents beyond simply reacting to threatening events. The metrics presented in this document are intended to provide a baseline or benchmark of incident management practices. The incident management functions provided in a series of questions and indicators define the actual benchmark. The questions explore different aspects of incident management activities for protecting, defending, and sustaining an organization's computing environment in addition to conducting appropriate response actions. This benchmark can be used by an organization to assess how its current incident management capability is defined, managed, measured, and improved. This will help assure the system owners, data owners, and operators that their incident management services are being delivered with a high standard of quality and success, and within acceptable levels of risk.

The IDS Scheer Customer Interaction Center (CIC) has significantly boosted customer satisfaction by rolling out a Corporate Performance Management system based on the ARIS Process platform. The ISO 9000 certified Support Helpdesk, which looks after worldwide support for all ARIS products, used the Process Mining technology of ARIS PPM to carry out a reorganization to the ITIL standard very rapidly, reducing the processing times of 1st Level Support queries by more than half, which earned it a “Helpdesk Award 2004” from an independent jury.

Publisher Summary The chapter provides an overview of incident investigation with a focus on process safety management (PSM)-type incidents. The chapter provides the Occupational Safety and Health Administration (OSHA) PSM standard for incident investigation as well as the OSHA Nonmandatory Appendix C Compliance Guidelines. An incident can bring embarrassment, cause equipment damage, interrupt production, and create injury or worst. But often, an effective and timely incident investigation is an opportunity to acquire a new insight. Within the spirit of continuous improvement, a system for investigating and sharing findings of significant incidents, near misses, and truly perilous incidents can be a key for a better tomorrow. For decades, most chemical manufacturers have employed a hierarchy of reviews, investigations, and reports for safety and environmental insults and incidents. It is obvious that a process safety incident investigation is the highest level investigation that can incorporate other more limited investigations and reports. The management of a company should not create an environment in which people cover-up potential process problems because incidents cannot be investigated if they are not promptly reported. Root-cause analysis is an incident investigation technique that is simple to apply and effective. This technique involves defining the problem, creating a cause and effect chart, identifying effective solutions, and implementing the best solution.

This paper presents a knowledge-based approach for preventing railway operation incidents, which helps railway operation professionals explore opportunities for dispatch quality improvement. The approach consists of two processors: incident analysis and dispatch advisory. Given a specific operation incident description, the proposed approach enables the identification of underlying problems in the incident and the suggestion of appropriate dispatch strategies that can be implemented to prevent repetitions of similar incidents. Case-based reasoning (CBR) and rule-based reasoning (RBR) are applied to generate dispatch strategies by adapting ones applied to previous incidents and/or using generalised rule-based knowledge for dispatch.