@article {1198,
	title = {Information Security Best Practices: First Steps for Startups and SMEs},
	journal = {Technology Innovation Management Review},
	volume = {8},
	year = {2018},
	month = {11/2018},
	pages = {32-42},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {This article identifies important first steps toward understanding and implementing information security. From the broad selection of existing best practices, we introduce a lightweight yet comprehensive security framework with four useful first steps: identifying assets and risks; protecting accounts, systems, clouds, and data; implementing a continuity plan; and monitoring and reviewing. This article is intended primarily for startups and less mature companies, but it is likely to be of interest to any reader seeking an introduction to basic information security concepts and principles as well as their implementation.},
	keywords = {best practices, cybersecurity, information security, risk management, SMEs, startups},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/1198},
	url = {https://timreview.ca/article/1198},
	author = {Urpo Kaila and Linus Nyman}
}
@article {1113,
	title = {Q\&A. Is Internal Audit Ready for Blockchain?},
	journal = {Technology Innovation Management Review},
	volume = {7},
	year = {2017},
	month = {10/2017},
	pages = {41-44},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {blockchain, controls, governance, internal audit, risk management},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/1113},
	url = {http://timreview.ca/article/1113},
	author = {Hugh Rooney and Brian Aiken and Megan Rooney}
}
@article {886,
	title = {Cyber-Resilience: A Strategic Approach for Supply Chain Management},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {04/2015},
	pages = {13-18},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Risk management and resilience strategies in supply chains have an important role in ensuring business continuity and reliability in a cost-efficient manner. Preventing or recovering from disruptions requires access and analysis of large amounts of data. Yet, given the multiple stakeholders, operations, and environmental contexts in which a global supply chain operates, managing risks and resilience becomes a challenging task. For this reason, information and communication technologies (ICT) are being developed to support managers with tailored tools and services to monitor disruptions, enhance instantaneous communication, and facilitate the quick recovery of supply chains. Hence, the objective of this article is to shed light on managerial strategies to improve the resilience of supply chains and thereby to point out how these could be automated by means of innovative ICT systems. In particular, this article concludes by warning about existing challenges to implementing such systems. If these challenges are not correctly addressed by managers, there is a major risk of further jeopardizing supply chains.},
	keywords = {cross-border trade, cyber-resilience, ICT, IT, risk management, supply chain management},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/886},
	url = {http://timreview.ca/article/886},
	author = {Luca Urciuoli}
}
@article {888,
	title = {Cybersecurity and Cyber-Resilient Supply Chains},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {04/2015},
	pages = {28-34},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {There has been a rapid growth in the use of communications and information technology, whether embedded in products, used to deliver services, or employed to enable integration and automation of increasingly global supply chains. Increased use of information technology introduces a number of cybersecurity risks affecting cyber-resilience of the supply chain, both in terms of the product or service delivered to a customer and supply chain operation. The situation is complicated by factors such as the global sourcing of technology components or software, ownership of the systems in a supply chain, different legal jurisdictions involved, and the extensive use of third parties to deliver critical functionality. This article examines the cyber-resilience issues related to the supply of products, services, and the supply chain infrastructure considering the nature of threats and vulnerabilities and the attributes of cybersecurity. In doing so, it applies a model for cybersecurity that is adapted from the Parkerian hexad to explore the security and trustworthiness facets of supply chain operations that may impact cyber-resilience.},
	keywords = {cyber-resilience, cybersecurity, risk management, supply chain, threat management},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/888},
	url = {http://timreview.ca/article/888},
	author = {Hugh Boyes}
}
@article {689,
	title = {Editorial: Insights (June 2013)},
	journal = {Technology Innovation Management Review},
	volume = {3},
	year = {2013},
	month = {06/2013},
	pages = {3-4},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {case study, intellectual property, IT function, open source business, process ambidexterity, risk management, software licenses, startups, technology entrepreneurship, uncertainty},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/689},
	url = {http://timreview.ca/article/689},
	author = {Chris McPhee}
}
@article {715,
	title = {A Research Agenda for Security Engineering},
	journal = {Technology Innovation Management Review},
	volume = {3},
	year = {2013},
	month = {08/2013},
	pages = {41-50},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Despite nearly 30 years of research and application, the practice of information system security engineering has not yet begun to exhibit the traits of a rigorous scientific discipline. As cyberadversaries have become more mature, sophisticated, and disciplined in their tradecraft, the science of security engineering has not kept pace. The evidence of the erosion of our digital security {\textendash} upon which society is increasingly dependent {\textendash} appears in the news almost daily.

In this article, we outline a research agenda designed to begin addressing this deficit and to move information system security engineering toward a mature engineering discipline. Our experience suggests that there are two key areas in which this movement should begin. First, a threat model that is actionable from the perspectives of risk management and security engineering should be developed. Second, a practical and relevant security-measurement framework should be developed to adequately inform security-engineering and risk-management processes. Advances in these areas will particularly benefit business/government risk assessors as well as security engineers performing security design work, leading to more accurate, meaningful, and quantitative risk analyses and more consistent and coherent security design decisions.

Threat modelling and security measurement are challenging activities to get right {\textendash} especially when they need to be applied in a general context. However, these are decisive starting points because they constitute the foundation of a scientific security-engineering practice. Addressing these challenges will require stronger and more coherent integration between the sub-disciplines of risk assessment and security engineering, including new tools to facilitate that integration. More generally, changes will be required in the way security engineering is both taught and practiced to take into account the holistic approach necessary from a mature, scientific discipline.},
	keywords = {cybersecurity, information system security engineering, research, risk management, security engineering, security measurement, threat modelling},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/715},
	url = {http://timreview.ca/article/715},
	author = {Rich Goyette and Yan Robichaud and Fran{\c c}ois Marinier}
}
@article {751,
	title = {Risk Management in Crowdsourcing-Based Business Ecosystems},
	journal = {Technology Innovation Management Review},
	volume = {3},
	year = {2013},
	month = {12/2013},
	pages = {32-38},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {The benefits of crowdsourcing are enabled by open environments where multiple external stakeholders contribute to a firm{\textquoteright}s outcomes. However, crowdsourcing typically has been examined as a general process and not from the specific perspective of a mechanism for driving value creation and capture within a business ecosystem. In this conceptual article, we highlight this research gap by examining crowdsourcing from a business ecosystem perspective and by identifying the inherent business risks in crowdsourcing-based business ecosystems. We apply the concept of ecosystem health to the crowdsourcing context, in terms of how firms create and capture value, and we examine the methods by which these firms can maximize health by mitigating risk in crowdsourcing-based business ecosystems.},
	keywords = {business ecosystem health, business ecosystems, crowdsourcing, risk management},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/751},
	url = {http://timreview.ca/article/751},
	author = {Suchita Nirosh Kannangara and Peter Uguccioni}
}
@article {696,
	title = {TIM Lecture Series {\textendash} Using Risk to Drive a Security Service},
	journal = {Technology Innovation Management Review},
	volume = {3},
	year = {2013},
	month = {06/2013},
	pages = {42-45},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {cybersecurity, platforms, risk management, security, services, strategy, uncertainty},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/696},
	url = {http://timreview.ca/article/696},
	author = {Paul Card}
}
@article {550,
	title = {TIM Lecture Series: The Importance of Dealing with Risk for New Businesses},
	journal = {Technology Innovation Management Review},
	volume = {2},
	year = {2012},
	month = {04/2012},
	pages = {41-43},
	keywords = {insurance, risk management, startups, technology entrepreneurship},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/550},
	url = {http://timreview.ca/article/550},
	author = {Tony Lackey}
}
