@article {902,
	title = {A Design Science Approach to Constructing Critical Infrastructure and Communicating Cybersecurity Risks},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {06/2015},
	pages = {6-16},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Academics are increasingly examining the approaches individuals and organizations use to construct critical infrastructure and communicate cybersecurity risks. Recent studies conclude that owners and operators of critical infrastructures, as well as governments, do not disclose reliable information related to cybersecurity risks and that cybersecurity specialists manipulate cognitive limitations to overdramatize and oversimplify cybersecurity risks to critical infrastructures. This article applies a design science perspective to the challenge of securing critical infrastructure by developing a process anchored around evidence-based design principles. The proposed process is expected to enable learning across critical infrastructures, improve the way risks to critical infrastructure are communicated, and improve the quality of the responses to citizens{\textquoteright} demands for their governments to collect, validate, and disseminate reliable information on cybersecurity risks to critical infrastructures. These results will be of interest to the general public, vulnerable populations, owners and operators of critical infrastructures, and various levels of governments worldwide. },
	keywords = {advanced persistent threats, critical infrastructures, cybersecurity, design propositions, design science, resilience},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/902},
	url = {http://timreview.ca/article/902},
	author = {Steven Muegge and Dan Craigen}
}
@article {901,
	title = {Editorial: Critical Infrastructures and Cybersecurity (June 2015)},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {06/2015},
	pages = {3-5},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {botnet, club theory, critical infrastructure, cybersecurity, design principles, design science, healthcare, networked medical devices, project management maturity model},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/901},
	url = {http://timreview.ca/article/901},
	author = {Chris McPhee and Dan Craigen and Steven Muegge}
}
@article {904,
	title = {Secure by Design: Cybersecurity Extensions to Project Management Maturity Models for Critical Infrastructure Projects},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {06/2015},
	pages = {26-34},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Many systems that comprise our critical infrastructures {\textendash} including electricity, transportation, healthcare, and financial systems {\textendash} are designed and deployed as information technology (IT) projects using project management practices. IT projects provide a one-time opportunity to securely "design in" cybersecurity to the IT components of critical infrastructures. The project management maturity models used by organizations today to assess the quality and rigour of IT project management practices do not explicitly consider cybersecurity. This article makes three contributions to address this gap. First, it develops the argument that cybersecurity can and should be a concern of IT project managers and assessed in the same way as other project management capabilities. Second, it examines three widely used cybersecurity maturity models {\textendash} i) the National Institute of Science and Technology (NIST) framework for improving critical infrastructure cybersecurity, ii) the United States Department of Energy{\textquoteright}s Cybersecurity Capability Maturity Model (C2M2), and iii) the CERT Resilience Management Model (CERT RMM) from the Carnegie Mellon Software Engineering Institute {\textendash} to identify six cybersecurity themes that are salient to IT project management. Third, it proposes a set of cybersecurity extensions to PjM3, a widely-deployed project management maturity model. The extensions take the form of a five-level cybersecurity capability perspective that augments the seven standard perspectives of the PjM3 by explicitly assessing project management capabilities that impact the six themes where IT project management and cybersecurity intersect. This article will be relevant to IT project managers, the top management teams of organizations that design and deploy IT systems for critical infrastructures, and managers at organizations that provide and maintain critical infrastructures.},
	keywords = {C2M2, capability maturity models, CERT RMM, critical infrastructures, cybersecurity, NIST, P3M3, PjM3, project management},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/904},
	url = {http://timreview.ca/article/904},
	author = {Jay Payette and Esther Anegbe and Erika Caceres and Steven Muegge}
}
@article {703,
	title = {Keystone Business Models for Network Security Processors},
	journal = {Technology Innovation Management Review},
	volume = {3},
	year = {2013},
	month = {07/2013},
	pages = {25-33},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Network security processors are critical components of high-performance systems built for cybersecurity. Development of a network security processor requires multi-domain experience in semiconductors and complex software security applications, and multiple iterations of both software and hardware implementations. Limited by the business models in use today, such an arduous task can be undertaken only by large incumbent companies and government organizations. Neither the {\textquotedblleft}fabless semiconductor{\textquotedblright} models nor the silicon intellectual-property licensing ({\textquotedblleft}IP-licensing{\textquotedblright}) models allow small technology companies to successfully compete. This article describes an alternative approach that produces an ongoing stream of novel network security processors for niche markets through continuous innovation by both large and small companies. This approach, referred to here as the "business ecosystem model for network security processors", includes a flexible and reconfigurable technology platform, a {\textquotedblleft}keystone{\textquotedblright} business model for the company that maintains the platform architecture, and an extended ecosystem of companies that both contribute and share in the value created by innovation. New opportunities for business model innovation by participating companies are made possible by the ecosystem model. This ecosystem model builds on: i) the lessons learned from the experience of the first author as a senior integrated circuit architect for providers of public-key cryptography solutions and as the owner of a semiconductor startup, and ii) the latest scholarly research on technology entrepreneurship, business models, platforms, and business ecosystems. This article will be of interest to all technology entrepreneurs, but it will be of particular interest to owners of small companies that provide security solutions and to specialized security professionals seeking to launch their own companies.},
	keywords = {business ecosystems, business model innovation, commercialization, cybersecurity, platforms, semiconductors, technology entrepreneurship},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/703},
	url = {http://timreview.ca/article/703},
	author = {Arthur Low and Steven Muegge}
}
