<?xml version="1.0" encoding="UTF-8"?><xml><records><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Chris McPhee</style></author><author><style face="normal" font="default" size="100%">Michael Weiss</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Editorial: Cybersecurity (April 2017)</style></title><secondary-title><style face="normal" font="default" size="100%">Technology Innovation Management Review</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">anomaly detection</style></keyword><keyword><style  face="normal" font="default" size="100%">automation</style></keyword><keyword><style  face="normal" font="default" size="100%">big data</style></keyword><keyword><style  face="normal" font="default" size="100%">cybersecurity</style></keyword><keyword><style  face="normal" font="default" size="100%">exploration</style></keyword><keyword><style  face="normal" font="default" size="100%">Hypponen’s law</style></keyword><keyword><style  face="normal" font="default" size="100%">Internet of Things</style></keyword><keyword><style  face="normal" font="default" size="100%">IOT</style></keyword><keyword><style  face="normal" font="default" size="100%">legislation</style></keyword><keyword><style  face="normal" font="default" size="100%">medical devices</style></keyword><keyword><style  face="normal" font="default" size="100%">privacy</style></keyword><keyword><style  face="normal" font="default" size="100%">real time</style></keyword><keyword><style  face="normal" font="default" size="100%">risk assessment</style></keyword><keyword><style  face="normal" font="default" size="100%">security engineering</style></keyword><keyword><style  face="normal" font="default" size="100%">smart devices</style></keyword><keyword><style  face="normal" font="default" size="100%">value proposition</style></keyword><keyword><style  face="normal" font="default" size="100%">vulnerabilities</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2017</style></year><pub-dates><date><style  face="normal" font="default" size="100%">04/2017</style></date></pub-dates></dates><urls><web-urls><url><style face="normal" font="default" size="100%">http://timreview.ca/article/1065</style></url></web-urls></urls><publisher><style face="normal" font="default" size="100%">Talent First Network</style></publisher><pub-location><style face="normal" font="default" size="100%">Ottawa</style></pub-location><volume><style face="normal" font="default" size="100%">7</style></volume><pages><style face="normal" font="default" size="100%">3-4</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><issue><style face="normal" font="default" size="100%">4</style></issue><custom1><style face="normal" font="default" size="100%">Technology Innovation Management Review
Chris McPhee is Editor-in-Chief of the &lt;em&gt;Technology Innovation Management Review&lt;/em&gt;. Chris holds an MASc degree in Technology Innovation Management from Carleton University in Ottawa, Canada, and BScH and MSc degrees in Biology from Queen's University in Kingston, Canada. He has nearly 20 years of management, design, and content-development experience in Canada and Scotland, primarily in the science, health, and education sectors. As an advisor and editor, he helps entrepreneurs, executives, and researchers develop and express their ideas.</style></custom1><custom2><style face="normal" font="default" size="100%">Carleton University
Michael Weiss holds a faculty appointment in the Department of Systems and Computer Engineering at Carleton University in Ottawa, Canada, and is a member of the Technology Innovation Management program. His research interests include open source, ecosystems, mashups, patterns, and social network analysis. Michael has published on the evolution of open source business, mashups, platforms, and technology entrepreneurship.</style></custom2></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Walter Miron</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Q&amp;A. Should the Internet Be Considered Critical Infrastructure?</style></title><secondary-title><style face="normal" font="default" size="100%">Technology Innovation Management Review</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">communication networks</style></keyword><keyword><style  face="normal" font="default" size="100%">critical infrastructure</style></keyword><keyword><style  face="normal" font="default" size="100%">cyber-attacks</style></keyword><keyword><style  face="normal" font="default" size="100%">cybersecurity</style></keyword><keyword><style  face="normal" font="default" size="100%">information technology</style></keyword><keyword><style  face="normal" font="default" size="100%">Internet</style></keyword><keyword><style  face="normal" font="default" size="100%">vulnerabilities</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2015</style></year><pub-dates><date><style  face="normal" font="default" size="100%">01/2015</style></date></pub-dates></dates><urls><web-urls><url><style face="normal" font="default" size="100%">http://timreview.ca/article/865</style></url></web-urls></urls><publisher><style face="normal" font="default" size="100%">Talent First Network</style></publisher><pub-location><style face="normal" font="default" size="100%">Ottawa</style></pub-location><volume><style face="normal" font="default" size="100%">5</style></volume><pages><style face="normal" font="default" size="100%">37-40</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><issue><style face="normal" font="default" size="100%">1</style></issue><custom1><style face="normal" font="default" size="100%">TELUS Communications
Walter Miron is a Director of Technology Strategy at TELUS Communications, where he is responsible for the evolution of their packet and optical networks. He has over 20 years of experience in enterprise and service provider networking conducting technology selection and service development projects. Walter is a member of the research program committee of the SAVI project, the Heavy Reading Global Ethernet Executive Council, and the ATOPs SDN/nFV Working Group. He is also the Chair of the Venus Cybersecurity Corporation and is a graduate student in the Technology Innovation Management (TIM) program at Carleton University in Ottawa, Canada.</style></custom1></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Mohamed Amin</style></author><author><style face="normal" font="default" size="100%">Zaid Tariq</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Securing the Car: How Intrusive Manufacturer-Supplier Approaches Can Reduce Cybersecurity Vulnerabilities</style></title><secondary-title><style face="normal" font="default" size="100%">Technology Innovation Management Review</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">automobile manufacturing</style></keyword><keyword><style  face="normal" font="default" size="100%">car design</style></keyword><keyword><style  face="normal" font="default" size="100%">control</style></keyword><keyword><style  face="normal" font="default" size="100%">cybersecurity</style></keyword><keyword><style  face="normal" font="default" size="100%">glue code</style></keyword><keyword><style  face="normal" font="default" size="100%">governance</style></keyword><keyword><style  face="normal" font="default" size="100%">intrusiveness</style></keyword><keyword><style  face="normal" font="default" size="100%">outsourcing</style></keyword><keyword><style  face="normal" font="default" size="100%">supplier</style></keyword><keyword><style  face="normal" font="default" size="100%">supplier-manufacturer relationships</style></keyword><keyword><style  face="normal" font="default" size="100%">vulnerabilities</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2015</style></year><pub-dates><date><style  face="normal" font="default" size="100%">01/2015</style></date></pub-dates></dates><urls><web-urls><url><style face="normal" font="default" size="100%">http://timreview.ca/article/863</style></url></web-urls></urls><publisher><style face="normal" font="default" size="100%">Talent First Network</style></publisher><pub-location><style face="normal" font="default" size="100%">Ottawa</style></pub-location><volume><style face="normal" font="default" size="100%">5</style></volume><pages><style face="normal" font="default" size="100%">21-25</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">Today's vehicles depend on numerous complex software systems, some of which have been developed by suppliers and must be integrated using &quot;glue code&quot; so that they may function together. However, this method of integration often introduces cybersecurity vulnerabilities at the interfaces between electronic systems. In this article we address the “glue code problem” by drawing insights from research on supplier-manufacturer outsourcing relationships in the automotive industry. The glue code problem can be framed as a knowledge coordination problem between manufactures and suppliers. Car manufacturers often employ different levels of intrusiveness in the design of car subsystems by their suppliers: the more control over the supplier the manufacturer exerts in the design of the subsystem, the more intrusive the manufacturer is. We argue that high intrusiveness by car manufacturers in defining module interfaces and subcomponents for suppliers would lead to more secure cars. </style></abstract><issue><style face="normal" font="default" size="100%">1</style></issue><custom1><style face="normal" font="default" size="100%">Carleton University
Mohamed Amin is an MASc student in the Technology Innovation Management program at Carleton University in Ottawa, Canada. His research interests include cybersecurity, API strategy, and industry architecture. He works as a Solution Architect for Alcatel-Lucent Canada, where he designs and delivers network solutions for various internet service providers around the world.</style></custom1><custom2><style face="normal" font="default" size="100%">Carleton University
Zaid Tariq is completing his MEng in Technology Innovation Management at Carleton University in Ottawa, Canada. He also holds a BEng degree in Computer Engineering from McGill University in Montreal, Canada. He is a Senior Network Engineer at Cisco Systems and has 9 years experience working in the network design, architecture, and test domains.</style></custom2></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Jeff Hughes</style></author><author><style face="normal" font="default" size="100%">George Cybenko</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Quantitative Metrics and Risk Assessment: The Three Tenets Model of Cybersecurity</style></title><secondary-title><style face="normal" font="default" size="100%">Technology Innovation Management Review</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">availability</style></keyword><keyword><style  face="normal" font="default" size="100%">confidentiality</style></keyword><keyword><style  face="normal" font="default" size="100%">integrity</style></keyword><keyword><style  face="normal" font="default" size="100%">quantitative cybersecurity</style></keyword><keyword><style  face="normal" font="default" size="100%">risk assessment</style></keyword><keyword><style  face="normal" font="default" size="100%">vulnerabilities</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2013</style></year><pub-dates><date><style  face="normal" font="default" size="100%">08/2013</style></date></pub-dates></dates><urls><web-urls><url><style face="normal" font="default" size="100%">http://timreview.ca/article/712</style></url></web-urls></urls><publisher><style face="normal" font="default" size="100%">Talent First Network</style></publisher><pub-location><style face="normal" font="default" size="100%">Ottawa</style></pub-location><volume><style face="normal" font="default" size="100%">3</style></volume><pages><style face="normal" font="default" size="100%">15-24</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">Progress in operational cybersecurity has been difficult to demonstrate. In spite of the considerable research and development investments made for more than 30 years, many government, industrial, financial, and consumer information systems continue to be successfully attacked and exploited on a routine basis. One of the main reasons that progress has been so meagre is that most technical cybersecurity solutions that have been proposed to-date have been point solutions that fail to address operational tradeoffs, implementation costs, and consequent adversary adaptations across the full spectrum of vulnerabilities. Furthermore, sound prescriptive security principles previously established, such as the Orange Book, have been difficult to apply given current system complexity and acquisition approaches. To address these issues, the authors have developed threat-based descriptive methodologies to more completely identify system vulnerabilities, to quantify the effectiveness of possible protections against those vulnerabilities, and to evaluate operational consequences and tradeoffs of possible protections. 

This article begins with a discussion of the tradeoffs among seemingly different system security properties such as confidentiality, integrity, and availability. We develop a quantitative framework for understanding these tradeoffs and the issues that arise when those security properties are all in play within an organization. Once security goals and candidate protections are identified, risk/benefit assessments can be performed using a novel multidisciplinary approach, called “QuERIES.” The article ends with a threat-driven quantitative methodology, called “The Three Tenets”, for identifying vulnerabilities and countermeasures in networked cyber-physical systems. The goal of this article is to offer operational guidance, based on the techniques presented here, for informed decision making about cyber-physical system security. </style></abstract><issue><style face="normal" font="default" size="100%">8</style></issue><custom1><style face="normal" font="default" size="100%">Tenet 3
Jeff A. Hughes is President of Tenet 3, LLC. Tenet 3 is a cybertechnology company with a focus on autonomous cyber-physical systems, analyzing their trustworthiness, and evaluating economical ways to demonstrably mitigate security risks. Previously, Jeff held various positions in the US Air Force Research Laboratory (AFRL), where he led research into advanced techniques for developing and screening trustworthy microelectronic components and performing complex system vulnerability and risk analysis for cyber-physical systems. Jeff has an MS in Electrical Engineering from the Ohio State University and has completed graduate work towards a PhD at the Air Force Institute of Technology in Ohio, United States.</style></custom1><custom2><style face="normal" font="default" size="100%">Dartmouth College
George Cybenko is the Dorothy and Walter Gramm Professor of Engineering at Dartmouth College in New Hampshire, United States. Professor Cybenko has made multiple research contributions in signal processing, neural computing, information security, and computational behavioural analysis. He was the Founding Editor-in-Chief of both IEEE/AIP Computing in Science and Engineering and IEEE Security &amp; Privacy. He has served on the Defense Science Board (2008-2009), on the US Air Force Scientific Advisory Board (2012-2015), and on review and advisory panels for DARPA, IDA, and Lawrence Livermore National Laboratory. Professor Cybenko is a Fellow of the IEEE and received his BS (Toronto) and PhD (Princeton) degrees in Mathematics.</style></custom2></record></records></xml>