02219nas a2200229   4500008004100000022001400041245008500055210006900140260004200209300001000251490000600261520152500267653001801792653001401810653002001824653002001844653002301864653002701887100002001914700001801934856003701952       2017                        eng d  a1927-032100aA Cybersecurity Risk Assessment Framework that Integrates Value-Sensitive Design0 aCybersecurity Risk Assessment Framework that Integrates ValueSen  aOttawabTalent First Networkc04/2017  a32-430 v73 aMedical devices today are more effective and connected than ever before, saving more patient lives and making healthcare practitioner’s jobs more efficient. But with this interconnectedness comes inherent concerns over increased cybersecurity vulnerabilities. Medical device cybersecurity has become an increasing concern for all relevant stakeholders including: patients, regulators, manufacturers, and healthcare practitioners. Although cybersecurity in medical devices has been covered in the literature, there is a gap in how to address cybersecurity concerns and assess risks in a way that brings value to all relevant stakeholders. In order to maximize the value created from cybersecurity risk mitigations, we review literature on the state of cybersecurity in the medical device industry, on cybersecurity risk management frameworks in the context of medical devices, and on how cybersecurity can be used as a value proposition. We then synthesize the key contributions of the literature into a framework that integrates cybersecurity value considerations for all relevant stakeholders into the risk mitigation process. This framework is subsequently applied to the hypothetical case of an insulin pump. Using this example case, we illustrate how medical device manufacturers can use the framework as a standardized method that can be applicable to medical devices at large. Our ultimate goal is to make cybersecurity risk mitigation an exploitable asset for manufacturers rather than a regulatory obligation. 10acybersecurity10aframework10amedical devices10arisk assessment10avalue propositions10avalue-sensitive design1 aAlvarenga, Aida1 aTanev, George  uhttp://timreview.ca/article/106900919nas a2200349   4500008004100000022001400041245004200055210003900097260004200136300000800178490000600186653002200192653001500214653001300229653001800242653001600260653002100276653002300297653000800320653001600328653002000344653001200364653001400376653002000390653002500410653001800435653002200453653002000475100001800495700001900513856003700532       2017                        eng d  a1927-032100aEditorial: Cybersecurity (April 2017)0 aEditorial Cybersecurity April 2017  aOttawabTalent First Networkc04/2017  a3-40 v710aanomaly detection10aautomation10abig data10acybersecurity10aexploration10aHypponen’s law10aInternet of Things10aIOT10alegislation10amedical devices10aprivacy10areal time10arisk assessment10asecurity engineering10asmart devices10avalue proposition10avulnerabilities1 aMcPhee, Chris1 aWeiss, Michael  uhttp://timreview.ca/article/106500653nas a2200241   4500008004100000022001400041245004300055210004000098260004200138300000800180490000600188653001100194653001700205653001800222653001700240653002700257653002100284653001300305653002000318100001800338700001900356856003600375       2013                        eng d  a1927-032100aEditorial: Cybersecurity (August 2013)0 aEditorial Cybersecurity August 2013  aOttawabTalent First Networkc08/2013  a3-40 v310aCanada10acyberattacks10acybersecurity10acyberthreats10ainformation technology10anetwork security10aresearch10arisk assessment1 aMcPhee, Chris1 aBailetti, Tony  uhttp://timreview.ca/article/71002669nas a2200229   4500008004100000022001400041245008600055210006900141260004200210300001000252490000600262520197600268653001702244653002002261653001402281653003102295653002002326653002002346100001702366700002002383856003602403       2013                        eng d  a1927-032100aQuantitative Metrics and Risk Assessment: The Three Tenets Model of Cybersecurity0 aQuantitative Metrics and Risk Assessment The Three Tenets Model   aOttawabTalent First Networkc08/2013  a15-240 v33 aProgress in operational cybersecurity has been difficult to demonstrate. In spite of the considerable research and development investments made for more than 30 years, many government, industrial, financial, and consumer information systems continue to be successfully attacked and exploited on a routine basis. One of the main reasons that progress has been so meagre is that most technical cybersecurity solutions that have been proposed to-date have been point solutions that fail to address operational tradeoffs, implementation costs, and consequent adversary adaptations across the full spectrum of vulnerabilities. Furthermore, sound prescriptive security principles previously established, such as the Orange Book, have been difficult to apply given current system complexity and acquisition approaches. To address these issues, the authors have developed threat-based descriptive methodologies to more completely identify system vulnerabilities, to quantify the effectiveness of possible protections against those vulnerabilities, and to evaluate operational consequences and tradeoffs of possible protections. 

This article begins with a discussion of the tradeoffs among seemingly different system security properties such as confidentiality, integrity, and availability. We develop a quantitative framework for understanding these tradeoffs and the issues that arise when those security properties are all in play within an organization. Once security goals and candidate protections are identified, risk/benefit assessments can be performed using a novel multidisciplinary approach, called “QuERIES.” The article ends with a threat-driven quantitative methodology, called “The Three Tenets”, for identifying vulnerabilities and countermeasures in networked cyber-physical systems. The goal of this article is to offer operational guidance, based on the techniques presented here, for informed decision making about cyber-physical system security. 10aavailability10aconfidentiality10aintegrity10aquantitative cybersecurity10arisk assessment10avulnerabilities1 aHughes, Jeff1 aCybenko, George  uhttp://timreview.ca/article/712