@article {1065,
	title = {Editorial: Cybersecurity (April 2017)},
	journal = {Technology Innovation Management Review},
	volume = {7},
	year = {2017},
	month = {04/2017},
	pages = {3-4},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {anomaly detection, automation, big data, cybersecurity, exploration, Hypponen{\textquoteright}s law, Internet of Things, IOT, legislation, medical devices, privacy, real time, risk assessment, security engineering, smart devices, value proposition, vulnerabilities},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/1065},
	url = {http://timreview.ca/article/1065},
	author = {Chris McPhee and Michael Weiss}
}
@article {865,
	title = {Q\&A. Should the Internet Be Considered Critical Infrastructure?},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {01/2015},
	pages = {37-40},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {communication networks, critical infrastructure, cyber-attacks, cybersecurity, information technology, Internet, vulnerabilities},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/865},
	url = {http://timreview.ca/article/865},
	author = {Walter Miron}
}
@article {863,
	title = {Securing the Car: How Intrusive Manufacturer-Supplier Approaches Can Reduce Cybersecurity Vulnerabilities},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {01/2015},
	pages = {21-25},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Today{\textquoteright}s vehicles depend on numerous complex software systems, some of which have been developed by suppliers and must be integrated using "glue code" so that they may function together. However, this method of integration often introduces cybersecurity vulnerabilities at the interfaces between electronic systems. In this article we address the {\textquotedblleft}glue code problem{\textquotedblright} by drawing insights from research on supplier-manufacturer outsourcing relationships in the automotive industry. The glue code problem can be framed as a knowledge coordination problem between manufactures and suppliers. Car manufacturers often employ different levels of intrusiveness in the design of car subsystems by their suppliers: the more control over the supplier the manufacturer exerts in the design of the subsystem, the more intrusive the manufacturer is. We argue that high intrusiveness by car manufacturers in defining module interfaces and subcomponents for suppliers would lead to more secure cars. },
	keywords = {automobile manufacturing, car design, control, cybersecurity, glue code, governance, intrusiveness, outsourcing, supplier, supplier-manufacturer relationships, vulnerabilities},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/863},
	url = {http://timreview.ca/article/863},
	author = {Mohamed Amin and Zaid Tariq}
}
@article {712,
	title = {Quantitative Metrics and Risk Assessment: The Three Tenets Model of Cybersecurity},
	journal = {Technology Innovation Management Review},
	volume = {3},
	year = {2013},
	month = {08/2013},
	pages = {15-24},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Progress in operational cybersecurity has been difficult to demonstrate. In spite of the considerable research and development investments made for more than 30 years, many government, industrial, financial, and consumer information systems continue to be successfully attacked and exploited on a routine basis. One of the main reasons that progress has been so meagre is that most technical cybersecurity solutions that have been proposed to-date have been point solutions that fail to address operational tradeoffs, implementation costs, and consequent adversary adaptations across the full spectrum of vulnerabilities. Furthermore, sound prescriptive security principles previously established, such as the Orange Book, have been difficult to apply given current system complexity and acquisition approaches. To address these issues, the authors have developed threat-based descriptive methodologies to more completely identify system vulnerabilities, to quantify the effectiveness of possible protections against those vulnerabilities, and to evaluate operational consequences and tradeoffs of possible protections. 

This article begins with a discussion of the tradeoffs among seemingly different system security properties such as confidentiality, integrity, and availability. We develop a quantitative framework for understanding these tradeoffs and the issues that arise when those security properties are all in play within an organization. Once security goals and candidate protections are identified, risk/benefit assessments can be performed using a novel multidisciplinary approach, called {\textquotedblleft}QuERIES.{\textquotedblright} The article ends with a threat-driven quantitative methodology, called {\textquotedblleft}The Three Tenets{\textquotedblright}, for identifying vulnerabilities and countermeasures in networked cyber-physical systems. The goal of this article is to offer operational guidance, based on the techniques presented here, for informed decision making about cyber-physical system security. },
	keywords = {availability, confidentiality, integrity, quantitative cybersecurity, risk assessment, vulnerabilities},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/712},
	url = {http://timreview.ca/article/712},
	author = {Jeff Hughes and George Cybenko}
}
