@article {1069,
	title = {A Cybersecurity Risk Assessment Framework that Integrates Value-Sensitive Design},
	journal = {Technology Innovation Management Review},
	volume = {7},
	year = {2017},
	month = {04/2017},
	pages = {32-43},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Medical devices today are more effective and connected than ever before, saving more patient lives and making healthcare practitioner{\textquoteright}s jobs more efficient. But with this interconnectedness comes inherent concerns over increased cybersecurity vulnerabilities. Medical device cybersecurity has become an increasing concern for all relevant stakeholders including: patients, regulators, manufacturers, and healthcare practitioners. Although cybersecurity in medical devices has been covered in the literature, there is a gap in how to address cybersecurity concerns and assess risks in a way that brings value to all relevant stakeholders. In order to maximize the value created from cybersecurity risk mitigations, we review literature on the state of cybersecurity in the medical device industry, on cybersecurity risk management frameworks in the context of medical devices, and on how cybersecurity can be used as a value proposition. We then synthesize the key contributions of the literature into a framework that integrates cybersecurity value considerations for all relevant stakeholders into the risk mitigation process. This framework is subsequently applied to the hypothetical case of an insulin pump. Using this example case, we illustrate how medical device manufacturers can use the framework as a standardized method that can be applicable to medical devices at large. Our ultimate goal is to make cybersecurity risk mitigation an exploitable asset for manufacturers rather than a regulatory obligation. },
	keywords = {cybersecurity, framework, medical devices, risk assessment, value propositions, value-sensitive design},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/1069},
	url = {http://timreview.ca/article/1069},
	author = {Aida Alvarenga and George Tanev}
}
@article {1065,
	title = {Editorial: Cybersecurity (April 2017)},
	journal = {Technology Innovation Management Review},
	volume = {7},
	year = {2017},
	month = {04/2017},
	pages = {3-4},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {anomaly detection, automation, big data, cybersecurity, exploration, Hypponen{\textquoteright}s law, Internet of Things, IOT, legislation, medical devices, privacy, real time, risk assessment, security engineering, smart devices, value proposition, vulnerabilities},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/1065},
	url = {http://timreview.ca/article/1065},
	author = {Chris McPhee and Michael Weiss}
}
@article {710,
	title = {Editorial: Cybersecurity (August 2013)},
	journal = {Technology Innovation Management Review},
	volume = {3},
	year = {2013},
	month = {08/2013},
	pages = {3-4},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {Canada, cyberattacks, cybersecurity, cyberthreats, information technology, network security, research, risk assessment},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/710},
	url = {http://timreview.ca/article/710},
	author = {Chris McPhee and Tony Bailetti}
}
@article {712,
	title = {Quantitative Metrics and Risk Assessment: The Three Tenets Model of Cybersecurity},
	journal = {Technology Innovation Management Review},
	volume = {3},
	year = {2013},
	month = {08/2013},
	pages = {15-24},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Progress in operational cybersecurity has been difficult to demonstrate. In spite of the considerable research and development investments made for more than 30 years, many government, industrial, financial, and consumer information systems continue to be successfully attacked and exploited on a routine basis. One of the main reasons that progress has been so meagre is that most technical cybersecurity solutions that have been proposed to-date have been point solutions that fail to address operational tradeoffs, implementation costs, and consequent adversary adaptations across the full spectrum of vulnerabilities. Furthermore, sound prescriptive security principles previously established, such as the Orange Book, have been difficult to apply given current system complexity and acquisition approaches. To address these issues, the authors have developed threat-based descriptive methodologies to more completely identify system vulnerabilities, to quantify the effectiveness of possible protections against those vulnerabilities, and to evaluate operational consequences and tradeoffs of possible protections. 

This article begins with a discussion of the tradeoffs among seemingly different system security properties such as confidentiality, integrity, and availability. We develop a quantitative framework for understanding these tradeoffs and the issues that arise when those security properties are all in play within an organization. Once security goals and candidate protections are identified, risk/benefit assessments can be performed using a novel multidisciplinary approach, called {\textquotedblleft}QuERIES.{\textquotedblright} The article ends with a threat-driven quantitative methodology, called {\textquotedblleft}The Three Tenets{\textquotedblright}, for identifying vulnerabilities and countermeasures in networked cyber-physical systems. The goal of this article is to offer operational guidance, based on the techniques presented here, for informed decision making about cyber-physical system security. },
	keywords = {availability, confidentiality, integrity, quantitative cybersecurity, risk assessment, vulnerabilities},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/712},
	url = {http://timreview.ca/article/712},
	author = {Jeff Hughes and George Cybenko}
}
