@article {1422,
	title = {Call for Papers: Distributed Ledger Technologies for Smart Digital Economies},
	journal = {Technology Innovation Management Review},
	volume = {11},
	year = {2021},
	month = {02/2021},
	pages = {1-1},
	publisher = {Talent First Network},
	chapter = {1},
	address = {Ottawa},
	keywords = {artificial intelligence, blockchain, cybersecurity, digital economy, distributed ledger technology, smartification},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/1422},
	url = {timreview.ca/article/1422}
}
@article {1329,
	title = {Examining the Relationship Between Cybersecurity and Scaling Value for New Companies},
	journal = {Technology Innovation Management Review},
	volume = {10},
	year = {2020},
	month = {02-2020},
	pages = {62-70},
	publisher = {Talent First Network},
	chapter = {62},
	address = {Ottawa},
	abstract = {We explore the cybersecurity-scaling relationship in the context of scaling new company value rapidly. The relationship between the management of what a new company does to protect against the malicious or unauthorized use of electronic data, and the management of what a new company does to scale company value rapidly is important, but not well understood. We use a topic modelling technique to identify the eight topics that best describe a corpus comprised of 137 assertions about what new companies do to scale company value rapidly, manually examine the stability of the topics extracted from the dataset, and describe the relationship between 17 assertions about how to manage cybersecurity in new companies, and the six topics found to be stable. The six stable topics are labelled Fundraise, Enable, Position, Communicate, Innovate, and Complement. We find that of the 17 cybersecurity assertions, seven are related to Position, two to Innovate, one to Fundraise and, one to Complement. Six cybersecurity assertions were not found to be strongly related to any of the eight topics. This paper contributes to our understanding of cybersecurity in the context of a new company that scales its value rapidly, an application of topic modelling to perform small-scale data analysis, and a manual approach to examine the stability of the topics extracted by the topic modelling technique. We expect this paper to be relevant to new companies{\textquoteright} top management teams, members of the networks upon which new companies depend for to scale company value, accelerators and incubators, as well as academics teaching or carrying out research in entrepreneurship.   },
	keywords = {cybersecurity, scaling company value, scaling initiatives, topic model stability},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/1329},
	url = {timreview.ca/article/1329},
	author = {Tony Bailetti and Daniel Craigen}
}
@article {1278,
	title = {Editorial: Insights (November 2019)},
	journal = {Technology Innovation Management Review},
	volume = {9},
	year = {2019},
	month = {11/2019},
	pages = {3-4},
	publisher = {Talent First Network},
	chapter = {3},
	address = {Ottawa},
	keywords = {artificial intelligence, competitive advantage, cybersecurity, deep learning, Deepfake, design rules, digitalization, entrepreneurial ecosystems, entrepreneurial university, entrepreneurship, entrepreneurship education, fake news, innovation, international entrepreneurship, leadership, Learning Capabilities, marketing, motivation, new venture teams, quadruple helix, sanctions, SMEs, teamwork, triple helix, university business incubation},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/1278},
	url = {timreview.ca/article/1278},
	author = {Stoyan Tanev and Gregory Sandstrom}
}
@article {1282,
	title = {The Emergence of Deepfake Technology: A Review},
	journal = {Technology Innovation Management Review},
	volume = {9},
	year = {2019},
	month = {11/2019},
	pages = {40-53},
	publisher = {Talent First Network},
	chapter = {40},
	address = {Ottawa},
	abstract = {Novel digital technologies make it increasingly difficult to distinguish between real and fake media. One of the most recent developments contributing to the problem is the emergence of deepfakes which are hyper-realistic videos that apply artificial intelligence (AI) to depict someone say and do things that never happened. Coupled with the reach and speed of social media, convincing deepfakes can quickly reach millions of people and have negative impacts on our society. While scholarly research on the topic is sparse, this study analyzes 84 publicly available online news articles to examine what deepfakes are and who produces them, what the benefits and threats of deepfake technology are, what examples of deepfakes there are, and how to combat deepfakes. The results suggest that while deepfakes are a significant threat to our society, political system and business, they can be combatted via legislation and regulation, corporate policies and voluntary action, education and training, as well as the development of technology for deepfake detection, content authentication, and deepfake prevention. The study provides a comprehensive review of deepfakes and provides cybersecurity and AI entrepreneurs with business opportunities in fighting against media forgeries and fake news.},
	keywords = {artificial intelligence, cybersecurity, deep learning, Deepfake, fake news},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/1282},
	url = {timreview.ca/article/1282},
	author = {Mika Westerlund}
}
@article {1194,
	title = {Editorial: Innovation Strategy and Practice (November 2018)},
	journal = {Technology Innovation Management Review},
	volume = {8},
	year = {2018},
	month = {11/2018},
	pages = {3-3},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {best practice, collaboration, creativity, cybersecurity, framework, information security, innovation, innovation ecosystems, maturity model, method, model, practice, research, research institutions, strategy},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/1194},
	url = {https://timreview.ca/article/1194},
	author = {Chris McPhee}
}
@article {1198,
	title = {Information Security Best Practices: First Steps for Startups and SMEs},
	journal = {Technology Innovation Management Review},
	volume = {8},
	year = {2018},
	month = {11/2018},
	pages = {32-42},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {This article identifies important first steps toward understanding and implementing information security. From the broad selection of existing best practices, we introduce a lightweight yet comprehensive security framework with four useful first steps: identifying assets and risks; protecting accounts, systems, clouds, and data; implementing a continuity plan; and monitoring and reviewing. This article is intended primarily for startups and less mature companies, but it is likely to be of interest to any reader seeking an introduction to basic information security concepts and principles as well as their implementation.},
	keywords = {best practices, cybersecurity, information security, risk management, SMEs, startups},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/1198},
	url = {https://timreview.ca/article/1198},
	author = {Urpo Kaila and Linus Nyman}
}
@article {1109,
	title = {Anticipating the Economic Benefits of Blockchain},
	journal = {Technology Innovation Management Review},
	volume = {7},
	year = {2017},
	month = {10/2017},
	pages = {6-13},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {In this general overview article intended for non-experts, I define blockchain technology and some of the key concepts, and then I elaborate four specific applications that highlight the potential economic benefits of digital ledgers. These applications are digital asset registries, blockchains as leapfrog technology for global financial inclusion, long-tail personalized economic services, and net settlement payment channels. I also highlight key challenges that offset the potential economic benefits of blockchain distributed ledgers, while arguing that the benefits would outweigh the potential risks. The overarching theme is that an increasing amount of everyday operations involving money, assets, and documents could start to be conducted via blockchain-based distributed network ledgers with cryptographic security, and at more granular levels of detail. One economic implication of widespread blockchain adoption is that the institutional structure of society could shift to one that is computationally-based and thus has a diminished need for human-operated brick-and-mortar institutions.},
	keywords = {blockchain, cryptocurrencies, cryptoeconomics, cybersecurity, digital asset registries, digital goods, distributed ledgers, economics, eWallet, lightning network, long tail markets, payment channels, programmable money, smart assets, smart contracts, streaming money},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/1109},
	url = {http://timreview.ca/article/1102},
	author = {Melanie Swan}
}
@article {1067,
	title = {Big Data and Individual Privacy in the Age of the Internet of Things},
	journal = {Technology Innovation Management Review},
	volume = {7},
	year = {2017},
	month = {04/2017},
	pages = {12-24},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {The availability of {\textquotedblleft}big data{\textquotedblright} and {\textquotedblleft}smart{\textquotedblright} products are credited with advancing solutions to complex problems in medicine, transportation, and education, among others. However, with big data comes big responsibility. The collection, storage, sharing, and analysis of data are far outpacing individual privacy protections, whether technological or legislative. The Internet of Things (IoT), with its promise to create networks of networks, will magnify individual data privacy threats. Recent data breaches, exposing the personal information of millions of users, provide insight into the vulnerability of personal data. Although seemingly expansive, there are core individual privacy issues that are central to current big data breaches and anticipated IoT threats. This article examines both big data and the IoT using examples of data privacy breaches to illustrate the impact of individual data loss. Furthermore, the article examines the complexity of tackling technological and legislative challenges in protecting individual privacy. It concludes by summarizing these issues in terms of the future implications of the IoT and the loss of privacy. },
	keywords = {big data, cybersecurity, data breaches, Internet of Things, IOT, privacy, smart devices},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/1067},
	url = {http://timreview.ca/article/1067},
	author = {Mackenzie Adams}
}
@article {1112,
	title = {A Blockchain Ecosystem for Digital Identity: Improving Service Delivery in Canada{\textquoteright}s Public and Private Sectors},
	journal = {Technology Innovation Management Review},
	volume = {7},
	year = {2017},
	month = {10/2017},
	pages = {35-40},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Blockchain-based solutions have the potential to make government operations more efficient and improve the delivery of services in the public and private sectors. Identity verification and authentication technologies, as one of the applications of blockchain-based solutions {\textendash} and the focus of our own efforts at SecureKey Technologies {\textendash} have been critical components in service delivery in both sectors due to their power to increase trust between citizens and the services they access. To convert trust into solid value added, identities must be validated through highly-reliable technologies, such as blockchain, that have the capacity to reduce cost and fraud and to simplify the experience for customers while also keeping out the bad actors. With identities migrating to digital platforms, organizations and citizens need to be able to transact with reduced friction even as more counter-bound services move to online delivery. In this article, drawing on our own experiences with an ecosystem approach to digital identity, we describe the potential value of using blockchain technology to address the present and future challenges of identity verification and authentication within a Canadian context. },
	keywords = {blockchain, consumer privacy, cybersecurity, digital assets, digital attributes, digital identity, identity fraud, identity verification, online privacy, online security},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/1112},
	url = {http://timreview.ca/article/1112},
	author = {Greg Wolfond}
}
@article {1068,
	title = {Combining Exploratory Analysis and Automated Analysis for Anomaly Detection in Real-Time Data Streams},
	journal = {Technology Innovation Management Review},
	volume = {7},
	year = {2017},
	month = {04/2017},
	pages = {25-31},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Security analysts can become overwhelmed with monitoring real-time security information that is important to help them defend their network. They also tend to focus on a limited portion of the alerts, and therefore risk missing important events and links between them. At the heart of the problem is the system that analysts use to detect, explore, and respond to cyber-attacks. Developers of security analysis systems face the challenge of developing a system that can present different sources of information at multiple levels of abstraction, while also creating a system that is intuitive to use. In this article, we examine the complementary nature of exploratory analysis and automated analysis by testing the development of a system that monitors real-time Border Gateway Protocol (BGP) traffic for anomalies that might indicate security threats. BGP is an essential component for supporting the infrastructure of the Internet; however, it is also highly vulnerable and can be hijacked by attackers to propagate spam or launch denial-of-service attacks. Some of the attack scenarios on the BGP infrastructure can be quite elaborate, and it is difficult, if not impossible, to fully automate the detection of such attacks. This article makes two contributions: i) it describes a prototype platform for computing indicators and threat alerts in real time and for visualizing the context of an alert, and ii) it discusses the interaction of exploratory analysis (visualization) and automated analysis. This article is relevant to students, security researchers, and developers who are interested in the development or use of real-time security monitoring systems. They will gain insights into the complementary aspects of automated analysis and exploratory analysis through the development of a real-time streaming system.},
	keywords = {anomaly detection, cybersecurity, exploratory analysis, real-time data streams, visualization},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/1068},
	url = {http://timreview.ca/article/1068},
	author = {Ahmed Shah and Ibrahim Abualhaol and Mahmoud Gad and Michael Weiss}
}
@article {1069,
	title = {A Cybersecurity Risk Assessment Framework that Integrates Value-Sensitive Design},
	journal = {Technology Innovation Management Review},
	volume = {7},
	year = {2017},
	month = {04/2017},
	pages = {32-43},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Medical devices today are more effective and connected than ever before, saving more patient lives and making healthcare practitioner{\textquoteright}s jobs more efficient. But with this interconnectedness comes inherent concerns over increased cybersecurity vulnerabilities. Medical device cybersecurity has become an increasing concern for all relevant stakeholders including: patients, regulators, manufacturers, and healthcare practitioners. Although cybersecurity in medical devices has been covered in the literature, there is a gap in how to address cybersecurity concerns and assess risks in a way that brings value to all relevant stakeholders. In order to maximize the value created from cybersecurity risk mitigations, we review literature on the state of cybersecurity in the medical device industry, on cybersecurity risk management frameworks in the context of medical devices, and on how cybersecurity can be used as a value proposition. We then synthesize the key contributions of the literature into a framework that integrates cybersecurity value considerations for all relevant stakeholders into the risk mitigation process. This framework is subsequently applied to the hypothetical case of an insulin pump. Using this example case, we illustrate how medical device manufacturers can use the framework as a standardized method that can be applicable to medical devices at large. Our ultimate goal is to make cybersecurity risk mitigation an exploitable asset for manufacturers rather than a regulatory obligation. },
	keywords = {cybersecurity, framework, medical devices, risk assessment, value propositions, value-sensitive design},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/1069},
	url = {http://timreview.ca/article/1069},
	author = {Aida Alvarenga and George Tanev}
}
@article {1065,
	title = {Editorial: Cybersecurity (April 2017)},
	journal = {Technology Innovation Management Review},
	volume = {7},
	year = {2017},
	month = {04/2017},
	pages = {3-4},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {anomaly detection, automation, big data, cybersecurity, exploration, Hypponen{\textquoteright}s law, Internet of Things, IOT, legislation, medical devices, privacy, real time, risk assessment, security engineering, smart devices, value proposition, vulnerabilities},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/1065},
	url = {http://timreview.ca/article/1065},
	author = {Chris McPhee and Michael Weiss}
}
@article {1079,
	title = {Editorial: Insights (June 2017)},
	journal = {Technology Innovation Management Review},
	volume = {7},
	year = {2017},
	month = {06/2017},
	pages = {3-4},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {competitive intelligence, creativity, cybersecurity, entrepreneurship, internal communication management, Internet of Things, service design, training, university{\textendash}industry collaboration},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/1079},
	url = {http://timreview.ca/article/1079},
	author = {Chris McPhee}
}
@article {1066,
	title = {The Internet of (Vulnerable) Things: On Hypponen{\textquoteright}s Law, Security Engineering, and IoT Legislation},
	journal = {Technology Innovation Management Review},
	volume = {7},
	year = {2017},
	month = {04/2017},
	pages = {5-11},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {The Internet of Things (IoT) and the resulting network-connectedness of everyday objects and appliances in our lives bring not only new features and possibilities, but also significant security concerns. These security concerns have resulted in vulnerabilities ranging from those limited in effect to a single device to vulnerabilities that have enabled IoT-based botnets to take over hundreds of thousands of devices to be used for illegal purposes. This article discusses the vulnerable nature of the IoT {\textendash} as symbolized by Hypponen{\textquoteright}s law {\textendash} and the parts both manufacturers and consumers play in these vulnerabilities. This article makes the case for the importance of security engineering for IoT manufacturers, highlights some significant issues to help consumers address these vulnerabilities, and argues for legislation as perhaps the only reliable means of securing the Internet and its connected devices.},
	keywords = {consumers, cybersecurity, Hypponen{\textquoteright}s law, Internet of Things, IOT, legislation, manufacturers, security engineering, smart devices, vulnerability},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/1066},
	url = {http://timreview.ca/article/1066},
	author = {Mikko Hypponen and Linus Nyman}
}
@article {1084,
	title = {TIM Lecture Series {\textendash} Building Trust in an IoT-Enabled World},
	journal = {Technology Innovation Management Review},
	volume = {7},
	year = {2017},
	month = {06/2017},
	pages = {50-54},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {cybersecurity, Internet of Things, IOT, ransomware, trust, WannaCry, wireless},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/1084},
	url = {http://timreview.ca/article/1084},
	author = {Jeremy Watson and John Marshall and Mike Young and Peter Smetny and David Mann}
}
@article {963,
	title = {Crowdsourcing Literature Reviews in New Domains},
	journal = {Technology Innovation Management Review},
	volume = {6},
	year = {2016},
	month = {02/2016},
	pages = {5-14},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Conducting a literature review in new domains presents unique challenges. The literature in a new domain is typically broad, fragmented, and growing quickly. Because little is known about the new domain, the literature review cannot be guided by established classifications of knowledge, unlike in an existing domain. Rather, it will be driven by evidence that challenges and extends existing knowledge. In a way, exploring a new domain means looking for anomalies in the evidence that cannot be explained by what is already known. This article summarizes lessons from conducting two literature reviews in new domains in the area of cybersecurity. It then presents a design for using leader-driven crowdsourcing to collect evidence and synthesize it into insights in a new domain. The article will be relevant to those who are exploring a new domain, in particular students, researchers, and members of R\&D projects in industry.},
	keywords = {co-creation, crowdsourcing, crowdsourcing platform, cybersecurity, literature review, narrative, new domains, systematic},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/963},
	url = {http://timreview.ca/article/963},
	author = {Michael Weiss}
}
@article {962,
	title = {Editorial: Cybersecurity (February 2016)},
	journal = {Technology Innovation Management Review},
	volume = {6},
	year = {2016},
	month = {02/2016},
	pages = {3-4},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {cybersecurity, intrusion, licensing, literature reviews, machine learning, malware, multisided platforms, new domains, open source},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/962},
	url = {http://timreview.ca/article/962},
	author = {Chris McPhee and Dan Craigen}
}
@article {976,
	title = {Editorial: Managing Innovation (April 2016)},
	journal = {Technology Innovation Management Review},
	volume = {6},
	year = {2016},
	month = {04/2016},
	pages = {3-4},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {creativity, cybersecurity, entrepreneurship, frugal innovation, innovation, managing innovation, national culture, Open innovation, projects, startups},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/976},
	url = {http://timreview.ca/article/976},
	author = {Chris McPhee}
}
@article {965,
	title = {Examining the Modes Malware Suppliers Use to Provide Goods and Services},
	journal = {Technology Innovation Management Review},
	volume = {6},
	year = {2016},
	month = {02/2016},
	pages = {21-27},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Malware suppliers use various modes to provide goods and services to customers. By mode, we mean {\textquotedblleft}the way{\textquotedblright} the malware supplier chooses to function. These modes increase monetization opportunities and enable many security breaches worldwide. A theoretically sound framework that can be used to examine the various modes that malware suppliers use to produce and sell malware is needed. We apply a general model specified recently by Hagiu and Wright to study five modes that malware suppliers use to deliver goods and services to their customers. The framework presented in this article can be used to predict the mode in which a malware supplier will function; to study which types of malware suppliers, agents, and customers are attracted to each mode; to discover new modes; and to better understand the threat a malware supplier presents.},
	keywords = {agents, customers, cybercrime, cybersecurity, malware, modes, multisided platform, suppliers},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/965},
	url = {http://timreview.ca/article/965},
	author = {Tony Bailetti and Mahmoud Gad}
}
@article {964,
	title = {Intrusion Learning: An Overview of an Emergent Discipline},
	journal = {Technology Innovation Management Review},
	volume = {6},
	year = {2016},
	month = {02/2016},
	pages = {15-20},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {The purpose of this article is to provide a definition of intrusion learning, identify its distinctive aspects, and provide recommendations for advancing intrusion learning as a practice domain. The authors define intrusion learning as the collection of online network algorithms that learn from and monitor streaming network data resulting in effective intrusion-detection methods for enabling the security and resiliency of enterprise systems. The network algorithms build on advances in cyber-defensive and cyber-offensive capabilities. Intrusion learning is an emerging domain that draws from machine learning, intrusion detection, and streaming network data. Intrusion learning offers to significantly enhance enterprise security and resiliency through augmented perimeter defense and may mitigate increasing threats facing enterprise perimeter protection. The article will be of interest to researchers, sponsors, and entrepreneurs interested in enhancing enterprise security and resiliency.},
	keywords = {adversarial learning, clustering, cybersecurity, enterprise, intrusion detection, intrusion learning, learning algorithms, machine learning, real-time analysis, resiliency, security, streaming network data},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/964},
	url = {http://timreview.ca/article/964},
	author = {Tony Bailetti and Mahmoud Gad and Ahmed Shah}
}
@article {966,
	title = {License Compliance in Open Source Cybersecurity Projects},
	journal = {Technology Innovation Management Review},
	volume = {6},
	year = {2016},
	month = {02/2016},
	pages = {28-35},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Developers of cybersecurity software often include and rely upon open source software packages in their commercial software products. Before open source code is absorbed into a proprietary product, developers must check the package license to see if the project is permissively licensed, thereby allowing for commercial-friendly inheritance and redistribution. However, there is a risk that the open source package license could be inaccurate due to being silently contaminated with restrictively licensed open source code that may prohibit the sale or confidentiality of commercial derivative work. Contamination of commercial products could lead to expensive remediation costs, damage to the company{\textquoteright}s reputation, and costly legal fees. In this article, we report on our preliminary analysis of more than 200 open source cybersecurity projects to identify the most frequently used license types and languages and to look for evidence of permissively licensed open source projects that are likely contaminated by restrictive licensed material (i.e., containing commercial-unfriendly code). Our analysis identified restrictive license contamination cases occurring in permissively licensed open source projects. Furthermore, we found a high proportion of code that lacked copyright attribution. We expect that the results of this study will: i) provide managers and developers with an understanding of how contamination can occur, ii) provide open source communities with an understanding on how they can better protect their intellectual property by including licenses and copyright information in their code, and ii) provide entrepreneurs with an understanding of the open source cybersecurity domain in terms of licensing and contamination and how they affect decisions about cybersecurity software architectures.},
	keywords = {contamination, copyright, cybersecurity, GPL, license, open source, third-party code},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/966},
	url = {http://timreview.ca/article/966},
	author = {Ahmed Shah and Selman Selman and Ibrahim Abualhaol}
}
@article {982,
	title = {TIM Seminar {\textendash} Transforming a Desert City into an International Cybersecurity Hub and Ecosystem},
	journal = {Technology Innovation Management Review},
	volume = {6},
	year = {2016},
	month = {04/2016},
	pages = {43-45},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {Canada, collaboration, cooperation, cybersecurity, CyberSpark, Israel},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/982},
	url = {http://timreview.ca/article/982},
	author = {Roni Zehavi}
}
@article {887,
	title = {Building Cyber-Resilience into Supply Chains},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {04/2015},
	pages = {19-27},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {The article discusses how an organization can adopt an information-centric approach to protect its information shared in one or more supply chains; clearly communicate the expectations it has for a direct (Tier 1) supplier to protect information; and use contracts and measurement to maintain the protection desired. Building on this foundation, the concept of resilience {\textendash} and that of cyber-resilience {\textendash} is discussed, and how an information-centric approach can assist in creating a more cyber-resilient supply chain. Finally, the article concludes with five steps an organization can take to improve the protection of its information:  i) map the supply chain; ii) build capability; iii) share information and expertise; iv) state requirements across the supply chain using standards, common frameworks, and languages; and v) measure, assess, and audit.},
	keywords = {cyber-resilience, cybersecurity, direct suppliers, indirect suppliers, information-centric approach, procurement, requirements, resilience, supply chain, Tier 1 suppliers},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/887},
	url = {http://timreview.ca/article/887},
	author = {Adrian Davis}
}
@article {889,
	title = {Challenges in Maritime Cyber-Resilience},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {04/2015},
	pages = {35-39},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {The maritime industry has been shown to be under increasing levels of cyber-attack, with future attacks having the potential to severely disrupt critical infrastructure. The industry lacks a standardized approach to cybersecurity, a national approach will be counterproductive, and a global mandatory standard, while needed, will take a long time to implement. In the shorter term, this article recommends that the industry coalesce around a set of voluntary guidelines in order to reduce the risk profile and increase resilience. To provide context for these recommendations, this article examines the specific characteristics of the maritime industry in relation to cybersecurity. Examples of existing vulnerabilities and reported cyber-attacks demonstrate that the threat is current and real. },
	keywords = {container, cyber-resilience, cyber-risk, CyberKeel, cybersecurity, maritime, terminal, vessel},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/889},
	url = {http://timreview.ca/article/889},
	author = {Lars Jensen}
}
@article {888,
	title = {Cybersecurity and Cyber-Resilient Supply Chains},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {04/2015},
	pages = {28-34},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {There has been a rapid growth in the use of communications and information technology, whether embedded in products, used to deliver services, or employed to enable integration and automation of increasingly global supply chains. Increased use of information technology introduces a number of cybersecurity risks affecting cyber-resilience of the supply chain, both in terms of the product or service delivered to a customer and supply chain operation. The situation is complicated by factors such as the global sourcing of technology components or software, ownership of the systems in a supply chain, different legal jurisdictions involved, and the extensive use of third parties to deliver critical functionality. This article examines the cyber-resilience issues related to the supply of products, services, and the supply chain infrastructure considering the nature of threats and vulnerabilities and the attributes of cybersecurity. In doing so, it applies a model for cybersecurity that is adapted from the Parkerian hexad to explore the security and trustworthiness facets of supply chain operations that may impact cyber-resilience.},
	keywords = {cyber-resilience, cybersecurity, risk management, supply chain, threat management},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/888},
	url = {http://timreview.ca/article/888},
	author = {Hugh Boyes}
}
@article {861,
	title = {Cybersecurity Skills Training: An Attacker-Centric Gamified Approach},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {01/2015},
	pages = {5-14},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Although cybersecurity awareness training for employees is important, it does not provide the necessary skills training required to better protect businesses against cyber-attacks. Businesses need to invest in building cybersecurity skills across all levels of the workforce and leadership. This investment can reduce the financial burden on businesses from cyber-attacks and help maintain consumer confidence in their brands. In this article, we discuss the use of gamification methods that enable all employees and organizational leaders to play the roles of various types of attackers in an effort to reduce the number of successful attacks due to human vulnerability exploits. 

We combine two separate streams {\textendash} gamification and entrepreneurial perspectives {\textendash} for the purpose of building cybersecurity skills while emphasizing a third stream {\textendash} attacker types (i.e., their resources, knowledge/skills, and motivation) {\textendash} to create training scenarios. We also define the roles of attackers using various theoretical entrepreneurial perspectives. This article will be of interest to leaders who need to build cybersecurity skills into their workforce cost-effectively; researchers who wish to advance the principles and practices of gamification solutions; and suppliers of solutions to companies that wish to build cybersecurity skills in the workforce and leadership.
},
	keywords = {cyber attackers, cybersecurity, entrepreneur, gamification, training},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/861},
	url = {http://timreview.ca/article/861},
	author = {Mackenzie Adams and Maged Makramalla}
}
@article {902,
	title = {A Design Science Approach to Constructing Critical Infrastructure and Communicating Cybersecurity Risks},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {06/2015},
	pages = {6-16},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Academics are increasingly examining the approaches individuals and organizations use to construct critical infrastructure and communicate cybersecurity risks. Recent studies conclude that owners and operators of critical infrastructures, as well as governments, do not disclose reliable information related to cybersecurity risks and that cybersecurity specialists manipulate cognitive limitations to overdramatize and oversimplify cybersecurity risks to critical infrastructures. This article applies a design science perspective to the challenge of securing critical infrastructure by developing a process anchored around evidence-based design principles. The proposed process is expected to enable learning across critical infrastructures, improve the way risks to critical infrastructure are communicated, and improve the quality of the responses to citizens{\textquoteright} demands for their governments to collect, validate, and disseminate reliable information on cybersecurity risks to critical infrastructures. These results will be of interest to the general public, vulnerable populations, owners and operators of critical infrastructures, and various levels of governments worldwide. },
	keywords = {advanced persistent threats, critical infrastructures, cybersecurity, design propositions, design science, resilience},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/902},
	url = {http://timreview.ca/article/902},
	author = {Steven Muegge and Dan Craigen}
}
@article {939,
	title = {Editorial: 100th Issue (November 2015)},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {11/2015},
	pages = {3-4},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {3D printing, born-global firms, collaborative innovation, cybersafety, cybersecurity, cyberspace, future research, innovation, lean global startups, lean startups, management, Open innovation, social innovation, supply chains, technology, technology innovation management review, TIM Review},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/939},
	url = {http://timreview.ca/article/939},
	author = {Chris McPhee}
}
@article {901,
	title = {Editorial: Critical Infrastructures and Cybersecurity (June 2015)},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {06/2015},
	pages = {3-5},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {botnet, club theory, critical infrastructure, cybersecurity, design principles, design science, healthcare, networked medical devices, project management maturity model},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/901},
	url = {http://timreview.ca/article/901},
	author = {Chris McPhee and Dan Craigen and Steven Muegge}
}
@article {884,
	title = {Editorial: Cyber-Resilience in Supply Chains (April 2015)},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {04/2015},
	pages = {3-5},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {cyber-attacks, cyber-resilience, cyber-risk, cybersecurity, resilience, supply chains},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/884},
	url = {http://timreview.ca/article/884},
	author = {Chris McPhee and Omera Khan}
}
@article {860,
	title = {Editorial: Cybersecurity (January 2015)},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {01/2015},
	pages = {3-4},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {automotive manufacturing, botnet takedowns, botnets, commercialization, critical infrastructure, cyber-attacks, cybersecurity, employee training, gamification, Internet, outsourcing, quantum key distribution},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/860},
	url = {http://timreview.ca/article/860},
	author = {Chris McPhee and Tony Bailetti}
}
@article {893,
	title = {Editorial: Insights (May 2015)},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {05/2015},
	pages = {3-4},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {business ecosystems, cybersecurity, Innovation management, Internet of Things, non-practicing entities, open source policies, open source software, patent trolls, social innovation, transformative innovation},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/893},
	url = {http://timreview.ca/article/893},
	author = {Chris McPhee}
}
@article {890,
	title = {Q\&A. How Can I Secure My Digital Supply Chain?},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {04/2015},
	pages = {40-43},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {cyber-crime, cybersecurity, intellectual property protection, IT security management, supply chain risk, supply chain security},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/890},
	url = {http://timreview.ca/article/890},
	author = {Richard Wilding and Malcolm Wheatley}
}
@article {865,
	title = {Q\&A. Should the Internet Be Considered Critical Infrastructure?},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {01/2015},
	pages = {37-40},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {communication networks, critical infrastructure, cyber-attacks, cybersecurity, information technology, Internet, vulnerabilities},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/865},
	url = {http://timreview.ca/article/865},
	author = {Walter Miron}
}
@article {905,
	title = {Representing Botnet-Enabled Cyber-Attacks and Botnet Takedowns Using Club Theory},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {06/2015},
	pages = {35-44},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {A model for executing and resisting botnet-enabled cyber-attacks and botnet takedowns does not exist. The lack of this representation results in ineffective and inefficient organizational decision making and learning, hampers theory development, and obfuscates the discourse about the {\textquotedblleft}best-case{\textquotedblright} scenarios for the future of the online world. In this article, a club theory model for botnet-enabled cyber-attacks and botnet takedowns is developed. Initiatives to execute and resist botnet-enabled cyber-attacks and botnet takedowns are conceptualized as collective actions carried out by individuals and groups organized into four types of Internet-linked clubs: Attacker, Defender, Botbeheader, and Botmaster. Five scenarios of botnet-enabled cyber-attacks and five scenarios of botnet takedowns are examined to identify the specific dimensions of the three constructs and provide examples of the values in each dimension. The developed theory provides insights into the clubs, thereby paving the way for more effective botnet mitigation strategies. This research will be of particular interest to executives and functional personnel of heterogeneous organizations who are interested in improving the quality of their communications and accelerating decision making when solving botnet-related problems. Researchers applying club theory to examine collective actions of organizations linked by the Internet will also be interested in this research. Although club theory has been applied to solve problems in many fields, this is the first effort to apply it to botnet-related problems.},
	keywords = {botmaster, botnet, botnet takedown, collective action, cyber-attack, cybersecurity},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/905},
	url = {http://timreview.ca/article/905},
	author = {Olukayode Adegboyega}
}
@article {904,
	title = {Secure by Design: Cybersecurity Extensions to Project Management Maturity Models for Critical Infrastructure Projects},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {06/2015},
	pages = {26-34},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Many systems that comprise our critical infrastructures {\textendash} including electricity, transportation, healthcare, and financial systems {\textendash} are designed and deployed as information technology (IT) projects using project management practices. IT projects provide a one-time opportunity to securely "design in" cybersecurity to the IT components of critical infrastructures. The project management maturity models used by organizations today to assess the quality and rigour of IT project management practices do not explicitly consider cybersecurity. This article makes three contributions to address this gap. First, it develops the argument that cybersecurity can and should be a concern of IT project managers and assessed in the same way as other project management capabilities. Second, it examines three widely used cybersecurity maturity models {\textendash} i) the National Institute of Science and Technology (NIST) framework for improving critical infrastructure cybersecurity, ii) the United States Department of Energy{\textquoteright}s Cybersecurity Capability Maturity Model (C2M2), and iii) the CERT Resilience Management Model (CERT RMM) from the Carnegie Mellon Software Engineering Institute {\textendash} to identify six cybersecurity themes that are salient to IT project management. Third, it proposes a set of cybersecurity extensions to PjM3, a widely-deployed project management maturity model. The extensions take the form of a five-level cybersecurity capability perspective that augments the seven standard perspectives of the PjM3 by explicitly assessing project management capabilities that impact the six themes where IT project management and cybersecurity intersect. This article will be relevant to IT project managers, the top management teams of organizations that design and deploy IT systems for critical infrastructures, and managers at organizations that provide and maintain critical infrastructures.},
	keywords = {C2M2, capability maturity models, CERT RMM, critical infrastructures, cybersecurity, NIST, P3M3, PjM3, project management},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/904},
	url = {http://timreview.ca/article/904},
	author = {Jay Payette and Esther Anegbe and Erika Caceres and Steven Muegge}
}
@article {943,
	title = {Securing Cyberspace: Towards an Agenda for Research and Practice},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {11/2015},
	pages = {26-34},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {In this article, we seek to identify the important challenges preventing security in cyberspace and to identify the key questions that nations should set out to answer to play a leading role in securing cyberspace. An important assertion is that the challenge of securing cyberspace transcends the abilities of any single entity and requires a radical shift in our approach in how: i) research is conducted, ii) cybersecurity researchers are educated, iii) new defendable systems are developed, and iv) effective defensive countermeasures are deployed. Our response draws upon extensive source material and our personal experiences as cybersecurity professionals contributing to the establishment of the VENUS Cybersecurity Corporation, a not-for-profit corporation that aims to make Canada a global leader in cybersecurity. We view the challenge to be global and transdisciplinary in nature and this article to be of relevance world-wide to senior decision makers, policy makers, managers, educators, strategists, futurists, scientists, technologists, and others interested in shaping the online world of the future.},
	keywords = {Canada, challenges, countermeasures, cyber security, cybersafety, cybersecurity, cyberspace, detection, Internet of Things, leadership, mitigation, research, security},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/943},
	url = {http://timreview.ca/article/943},
	author = {Renaud Levesque and D{\textquoteright}Arcy Walsh and David Whyte}
}
@article {863,
	title = {Securing the Car: How Intrusive Manufacturer-Supplier Approaches Can Reduce Cybersecurity Vulnerabilities},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {01/2015},
	pages = {21-25},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Today{\textquoteright}s vehicles depend on numerous complex software systems, some of which have been developed by suppliers and must be integrated using "glue code" so that they may function together. However, this method of integration often introduces cybersecurity vulnerabilities at the interfaces between electronic systems. In this article we address the {\textquotedblleft}glue code problem{\textquotedblright} by drawing insights from research on supplier-manufacturer outsourcing relationships in the automotive industry. The glue code problem can be framed as a knowledge coordination problem between manufactures and suppliers. Car manufacturers often employ different levels of intrusiveness in the design of car subsystems by their suppliers: the more control over the supplier the manufacturer exerts in the design of the subsystem, the more intrusive the manufacturer is. We argue that high intrusiveness by car manufacturers in defining module interfaces and subcomponents for suppliers would lead to more secure cars. },
	keywords = {automobile manufacturing, car design, control, cybersecurity, glue code, governance, intrusiveness, outsourcing, supplier, supplier-manufacturer relationships, vulnerabilities},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/863},
	url = {http://timreview.ca/article/863},
	author = {Mohamed Amin and Zaid Tariq}
}
@article {885,
	title = {Supply Chain Cyber-Resilience: Creating an Agenda for Future Research},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {04/2015},
	pages = {6-12},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Supply chains have become more vulnerable in recent years, and high-profile cyber-attacks that have crippled the supply chains of well-known companies reveal that the point of entry for hackers is often through the weakest link in the chain. Exacerbated by growing complexity and the need to be visible, these supply chains share vital streams of information every minute of the day, thereby becoming an easy and highly lucrative target for talented criminals, causing financial losses as well as damaging brand reputation and value. Companies must therefore invest in supply chain capabilities to withstand cyber-attacks (i.e., cyber-resilience) in order to guard against potential threats. They must also embrace the reality that this often-unknown dimension of risk is the "new normal". Although interest on this topic has grown in the business world, less has been reported by the academic community. One reason for this could be due to the convergence of two different disciplines, information technology and supply chains, where supply chain cyber-risk and cyber-resilience appear to have a natural fit. The topic of cyber-resilience in supply chains is still in early stages of development, and this is one of the first journals to focus a special issue on it. Currently, the closest academic literature is within the realms of supply chain risk and resilience, where numerous models and frameworks exist. In this article, this literature is explored to identify whether these models can incorporate the dimension of cyber-risk and cyber-resilience. In doing so, we create a research agenda for supply chain cyber-resilience and provide recommendations for both academia and practice. },
	keywords = {cyber-risk, cybersecurity, resilience, supply chain management, theoretical foundation},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/885},
	url = {http://timreview.ca/article/885},
	author = {Omera Khan and Daniel A. Sep{\'u}lveda Estay}
}
@article {881,
	title = {TIM Lecture Series {\textendash} The Expanding Cybersecurity Threat},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {03/2015},
	pages = {56-48},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {antivirus, cyber-attacks, cyber-espionage, cyber-threats, cybersecurity, data breaches, malware, private-public partnerships, ransomware, scareware, social engineering, Symantec},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/881},
	url = {http://timreview.ca/article/881},
	author = {Cheri F. McGuire}
}
@article {898,
	title = {TIM Lecture Series {\textendash} The Internet of Everything: Fridgebots, Smart Sneakers, and Connected Cars},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {05/2015},
	pages = {47-49},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {Consumer Internet of Things, cyber-attacks, cybersecurity, hackers, Industrial Internet, Internet of Everything, Internet of Things, IOT},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/898},
	url = {http://timreview.ca/article/898},
	author = {Jeff Greene}
}
@article {906,
	title = {TIM Lecture Series {\textendash} Three Collaborations Enabling Cybersecurity},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {06/2015},
	pages = {45-48},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {book launch, collaboration, cybersecurity, entrepreneurship, NSA, research},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/906},
	url = {http://timreview.ca/article/906},
	author = {Deborah Frincke and Dan Craigen and Ned Nadima and Arthur Low and Michael Thomas}
}
@article {903,
	title = {A Value Blueprint Approach to Cybersecurity in Networked Medical Devices},
	journal = {Technology Innovation Management Review},
	volume = {5},
	year = {2015},
	month = {06/2015},
	pages = {17-25},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Cybersecurity for networked medical devices has been usually {\textquotedblleft}bolted on{\textquotedblright} by manufacturers at the end of the design cycle, rather than integrated as a key factor of the product development and value creation process. The recently released cybersecurity guidelines by the United States Food and Drug Administration (FDA) offer an opportunity for manufacturers to find a way of positioning cybersecurity as part of front-end design, value creation, and market differentiation. However, the technological architecture and the functionality of such devices require an ecosystem approach to the value creation process. Thus, the present article adopts an ecosystem approach to including cybersecurity as part of their value proposition. It extends the value blueprint approach suggested by Ron Adner to include an additional dimension that offers the opportunity to define: the potential locations of cybersecurity issues within the ecosystem, the specific nature of these issues, the players that should be responsible for addressing them, as well as a way to articulate the added cybersecurity value as a competitive differentiator to potential customers. The value of the additional blueprint dimension is demonstrated through a case study of a representative networked medical device {\textendash} a connected insulin pump and continuous glucose monitor. },
	keywords = {cybersecurity, ecosystem, market differentiation, networked medical devices, value proposition},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/903},
	url = {http://timreview.ca/article/903},
	author = {George Tanev and Peyo Tzolov and Rollins Apiafi}
}
@article {844,
	title = {Assessing Scientific Contributions: A Proposed Framework and Its Application to Cybersecurity},
	journal = {Technology Innovation Management Review},
	volume = {4},
	year = {2014},
	month = {11/2014},
	pages = {5-13},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Through a synthesis of existing work on evaluating scientific theories and contributions, a framework for assessing scientific contributions is presented. By way of example, the framework is then applied to two contributions to the science of cybersecurity. The science of cybersecurity is slowly emerging. As the science and its theories emerge, it is important to extract the key contributions that characterize actual progress in our understanding of cybersecurity. Researchers and funding agencies will be interested in the assessment framework as a means of assessing scientific contributions to cybersecurity. In a nascent research area such as the science of cybersecurity, this article may contribute to a focused research program to accelerate the growth of the science.},
	keywords = {assessing science, cybersecurity, science of cybersecurity, scientific contributions, scientific progress, societal contributions},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/844},
	url = {http://timreview.ca/article/844},
	author = {Dan Craigen}
}
@article {848,
	title = {Assessing the Intentions and Timing of Malware},
	journal = {Technology Innovation Management Review},
	volume = {4},
	year = {2014},
	month = {11/2014},
	pages = {34-40},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Malware has become a significant, complex, and widespread problem within the computer industry. It represents one of the most prevalent threats to cybersecurity and is increasingly able to circumvent current detection and mitigation techniques. To help better understand when a malware attack might happen, this article proposes an intention-based classification of malware and merges it with an optimal timing model to help predict the timing of malware based on its classification. The classification model is based on an examination of eight malware samples, and it identifies four malware classifications and commonalities based on the dimensions of persistence and stealth. The goal of the article is to provide a better understanding of when cyber-conflict will happen, and to help defenders better mitigate the potential damage.},
	keywords = {cybersecurity, malware, optimal timing, persistence, stealth},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/848},
	url = {http://timreview.ca/article/848},
	author = {Brent Maheux}
}
@article {846,
	title = {Cyber-Attack Attributes},
	journal = {Technology Innovation Management Review},
	volume = {4},
	year = {2014},
	month = {11/2014},
	pages = {22-27},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Cyber-attacks threaten our ability to use the Internet safely, productively, and creatively worldwide and are at the core of many security concerns. The concept of cyber-attacks, however, remains underdeveloped in the academic literature. To advance theory, design and operate databases to support scholarly research, perform empirical observations, and compare different types of cyber-attacks, it is necessary to first clarify the attributes of the {\textquotedblleft}concept of cyber-attack{\textquotedblright}. In this article, attributes of cyber-attacks are identified by examining definitions of cyber-attacks from the literature and information on ten high-profile attacks. Although the article will be of interest to a broad community, it will be of particular interest to senior executives, government contractors, and researchers interested in contributing to the development of an interdisciplinary and global theory of cybersecurity. },
	keywords = {attack characteristics, attributes, cyber-attack, cybersecurity},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/846},
	url = {http://timreview.ca/article/846},
	author = {Mehdi Kadivar}
}
@article {845,
	title = {Cybersecurity Startups: The Importance of Early and Rapid Globalization},
	journal = {Technology Innovation Management Review},
	volume = {4},
	year = {2014},
	month = {11/2014},
	pages = {14-21},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Corporations and government agencies worldwide seek to ensure that their networks are safe from cyber-attacks, and startups are being launched to take advantage of this expanded market for cybersecurity products, services, and solutions. The cybersecurity market is inherently global; therefore, cybersecurity startups must globalize to survive. With this article, we fill a gap in the literature by identifying the factors that make a technology startup valuable to specific stakeholders (e.g., investors, customers, employees) and by providing a tool and illustrating a process to describe, design, challenge, and invent the actions that should be performed to globalize a cybersecurity startup early and rapidly for the purpose of increasing its value. The development of the tool builds on recent advances in the resource-based literature, the review of the literature on born-global firms and business model discovery processes, and the experience gained operating the Lead to Win ecosystem. This article will be of interest to entrepreneurs and their venture teams, investors, business development agencies, advisors, and mentors of cybersecurity startups as well as researchers who develop tools and approaches that are relevant to technology entrepreneurs. },
	keywords = {born global, cybersecurity, globalization, startups},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/845},
	url = {http://timreview.ca/article/845},
	author = {Tony Bailetti and Erik Zijdemans}
}
@article {835,
	title = {Defining Cybersecurity},
	journal = {Technology Innovation Management Review},
	volume = {4},
	year = {2014},
	month = {10/2014},
	pages = {13-21},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Cybersecurity is a broadly used term, whose definitions are highly variable, often subjective, and at times, uninformative. The absence of a concise, broadly acceptable definition that captures the multidimensionality of cybersecurity impedes technological and scientific advances by reinforcing the predominantly technical view of cybersecurity while separating disciplines that should be acting in concert to resolve complex cybersecurity challenges. In conjunction with an in-depth literature review, we led multiple discussions on cybersecurity with a diverse group of practitioners, academics, and graduate students to examine multiple perspectives of what should be included in a definition of cybersecurity. In this article, we propose a resulting new definition: "Cybersecurity is the organization and collection of resources, processes, and structures used to protect cyberspace and cyberspace-enabled systems from occurrences that misalign de jure from de facto property rights." Articulating a concise, inclusive, meaningful, and unifying definition will enable an enhanced and enriched focus on interdisciplinary cybersecurity dialectics and thereby will influence the approaches of academia, industry, and government and non-governmental organizations to cybersecurity challenges.},
	keywords = {cybersecurity, cyberspace, definition, interdisciplinary, security},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/835},
	url = {http://timreview.ca/article/835},
	author = {Dan Craigen and Nadia Diakun-Thibault and Randy Purse}
}
@article {843,
	title = {Editorial: Cybersecurity (November 2014)},
	journal = {Technology Innovation Management Review},
	volume = {4},
	year = {2014},
	month = {11/2014},
	pages = {3-4},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {crimeware, cyber-attacks, cybersecurity, globalization, malware, safety, science of cybersecurity, scientific contributions, startups},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/843},
	url = {http://timreview.ca/article/843},
	author = {Chris McPhee and Tony Bailetti}
}
@article {833,
	title = {Editorial: Cybersecurity (October 2014)},
	journal = {Technology Innovation Management Review},
	volume = {4},
	year = {2014},
	month = {10/2014},
	pages = {3-4},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {cyberattacks, cybersecurity, cyberthreats, information technology, network security, research},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/833},
	url = {http://timreview.ca/article/833},
	author = {Chris McPhee and Tony Bailetti}
}
@article {836,
	title = {Effective Digital Channel Marketing for Cybersecurity Solutions},
	journal = {Technology Innovation Management Review},
	volume = {4},
	year = {2014},
	month = {10/2014},
	pages = {22-32},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Smaller organizations are prime targets for hackers and malware, because these businesses lack cybersecurity plans and the resources to survive a serious security incident. To exploit this market opportunity, cybersecurity solution providers need to leverage the power of downstream channel members. We investigate how a supplier{\textquoteright}s digital channel marketing can encourage value-added resellers to sell that supplier{\textquoteright}s cybersecurity solutions. Our analysis of survey data from 109 value-added resellers of a multinational supplier shows that resellers are more committed to stock and sell cybersecurity products and services if the supplier{\textquoteright}s digital channel marketing provides tools that help them sell the solutions to end customers. This support is likely needed because cybersecurity offerings are technologically complex and systemic by nature, as supported by the finding that value-added resellers pay little attention to supplier{\textquoteright}s campaigns and price discounts. Thus, cybersecurity suppliers should maintain trusted and informative relationships with their resellers and provide them with hands-on sales tools, because a reseller{\textquoteright}s commitment to selling cybersecurity solutions is linked with their ability to understand the offering and with the extent of their supplier relationship. These findings are in line with previous literature on the challenges perceived by salespeople in selling novel and complex technology.},
	keywords = {cybersecurity, digital channel marketing, marketing, retailer, sales, supplier, value-added reseller, VAR},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/836},
	url = {http://timreview.ca/article/836},
	author = {Mika Westerlund and Risto Rajala}
}
@article {834,
	title = {The Online World of the Future: Safe, Productive, and Creative},
	journal = {Technology Innovation Management Review},
	volume = {4},
	year = {2014},
	month = {10/2014},
	pages = {5-12},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {A safer online world is required to attain higher levels of productivity and creativity. We offer a view of a future state of the online world that places safety, productivity, and creativity above all else. The online world envisaged for 2030 is safe (i.e., users communicate with accuracy and enduring confidence), productive (i.e., users make timely decisions that have an ongoing global effect), and creative (i.e., users can connect seemingly unrelated information online). The proposed view differs from other views of the future online world that are anchored around technology solutions, confrontation, deception, and personal or commercial gain. The following seven conditions characterize the proposed view of the online world: i) global-scale autonomous learning systems; ii) humans co-working with machines; iii) human factors that are authentic and transferrable; iv) global scale whole-brain communities; v) foundational knowledge that is authentic and transferrable; vi) timely productive communication; and vii) continuous technological adaptation. These conditions are expected to enable new social-behavioural, socio-technical, and organizational interaction models. },
	keywords = {bisociation, cybersecurity, excludability, future vision, Industrial Internet, Internet, Internet of Everything, Internet of Things, online, productivity, rivalry, safety, security},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/834},
	url = {http://timreview.ca/article/834},
	author = {Tony Bailetti and Renaud Levesque and D{\textquoteright}Arcy Walsh}
}
@article {838,
	title = {Q\&A. What Motivates Cyber-Attackers?},
	journal = {Technology Innovation Management Review},
	volume = {4},
	year = {2014},
	month = {10/2014},
	pages = {40-42},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {cyber-attack, cybercrime, cybersecurity, hackers, motivation},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/838},
	url = {http://timreview.ca/article/838},
	author = {Chen Han and Rituja Dongre}
}
@article {849,
	title = {Safety in the Online World of the Future},
	journal = {Technology Innovation Management Review},
	volume = {4},
	year = {2014},
	month = {11/2014},
	pages = {41-48},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {In this article, we address what it means to be safe in the online world of the future by advocating the perspective whereby improving safety will improve resilience in cyberspace. We adopt a specific approach towards transdisciplinarity; present a weakly transdisciplinary model of the safety context and an initial position about what existing disciplines are most relevant; and link prospect theory to risk-based decision making as one example that could lead to a new paradigm for safety. By treating safety as a transdisciplinary challenge, there is an opportunity to enable the participants of the online world to become more productive and creative than ever before. The beneficiary of this increased productivity and creativity will ultimately be the public. The perspective of this article is of interest to senior decision makers, policy makers, managers, educators, strategists, futurists, scientists, technologists, and others interested in shaping the online world of the future.},
	keywords = {cybersecurity, prospect theory, risk-based decision making, safety, security, weak transdisciplinary},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/849},
	url = {http://timreview.ca/article/849},
	author = {Nadeem Douba and Bj{\"o}rn R{\"u}tten and David Scheidl and Paul Soble and D{\textquoteright}Arcy Walsh}
}
@article {839,
	title = {TIM Lecture Series {\textendash} Cybersecurity Metrics and Simulation},
	journal = {Technology Innovation Management Review},
	volume = {4},
	year = {2014},
	month = {10/2014},
	pages = {43-45},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {cybersecurity, metrics, modelling, simulation},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/839},
	url = {http://timreview.ca/article/839},
	author = {George Cybenko}
}
@article {785,
	title = {TIM Lecture Series {\textendash} The Business of Cybersecurity},
	journal = {Technology Innovation Management Review},
	volume = {4},
	year = {2014},
	month = {04/2014},
	pages = {53-57},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {analytics, banking, cybersecurity, hacking, incident response, information security, intelligence, targets, threats},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/785},
	url = {http://timreview.ca/article/785},
	author = {David Grau and Charles Kennedy}
}
@article {813,
	title = {TIM Lecture Series {\textendash} The Laboratory for Analytic Sciences: Developing the Art and Science of Analysis},
	journal = {Technology Innovation Management Review},
	volume = {4},
	year = {2014},
	month = {07/2014},
	pages = {52-54},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {analysis, analytics, big data, collaboration, cybersecurity, framework, innovation, instrumentation, monitoring, prediction, strategy},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/813},
	url = {http://timreview.ca/article/813},
	author = {J. David Harris}
}
@article {774,
	title = {TIM Lecture Series {\textendash} Web Infections and Protections: Theory and Practice},
	journal = {Technology Innovation Management Review},
	volume = {4},
	year = {2014},
	month = {03/2014},
	pages = {35-},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {attack vectors, countermeasures, cybersecurity, infections, Internet, privacy, security, targets, threat vectors, threats},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/774},
	url = {http://timreview.ca/article/774},
	author = {Arnold Kwong}
}
@article {700,
	title = {Cybersecurity Futures: How Can We Regulate Emergent Risks?},
	journal = {Technology Innovation Management Review},
	volume = {3},
	year = {2013},
	month = {07/2013},
	pages = {6-11},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {This article reviews nine socio-technical trends that are likely to shape the cybersecurity environment over the next decade. These nine trends have reached various levels of maturity, and some {\textendash} such as quantum computing {\textendash} are still theoretically contentious. These trends are: cloud computing; big data; the Internet of Things; the mobile Internet; brain{\textendash}computer interfaces; near field communication payment systems; mobile robots; quantum computing; and the militarization of the Internet.

What these nine trends have in common is that they will be instrumental in generating new opportunities for offending, which will result from an exponential increase in the quantity of data, number of connection points to the Internet, and velocity of data flows that irrigate the digital ecosystem. As a result, more opportunities for malicious exploitation will be available to attackers, {\textquotedblleft}security by design{\textquotedblright} will be harder to achieve in such a fluid and dynamic environment, and the performance of control mechanisms is likely to erode significantly. 

Technical solutions to address these challenges are already being developed by computer scientists. This article focuses on a different and complementary approach, finding inspiration in the work of regulatory scholars who have framed promising theories such as regulatory pluralism and responsive regulation to explore options for the necessary institutional adaptation to these future changes. },
	keywords = {cybersecurity, cybersecurity policies, digital ecosystem, emerging risks, forecasting, regulation, technological trends},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/700},
	url = {http://timreview.ca/article/700},
	author = {Benoit Dupont}
}
@article {711,
	title = {Developing an Innovation Engine to Make Canada a Global Leader in Cybersecurity},
	journal = {Technology Innovation Management Review},
	volume = {3},
	year = {2013},
	month = {08/2013},
	pages = {5-14},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {An engine designed to convert innovation into a country{\textquoteright}s global leadership position in a specific product market is examined in this article, using Canada and cybersecurity as an example. Five entities are core to the innovation engine: an ecosystem, a project community, an external community, a platform, and a corporation. The ecosystem is the focus of innovation in firm-specific factors that determine outcomes in global competition; the project community is the focus of innovation in research and development; and the external community is the focus of innovation in resources produced and used by economic actors that operate outside of the focal product market. Strategic intent, governance, resource flows, and organizational agreements bind the five entities together. Operating the innovation engine in Canada is expected to improve the level and quality of prosperity, security, and capacity of Canadians, increase the number of Canadian-based companies that successfully compete globally in cybersecurity product markets, and better protect Canada{\textquoteright}s critical infrastructure. Researchers interested in learning how to create, implement, improve, and grow innovation engines will find this article interesting. The article will also be of interest to senior management teams in industry and government, chief information and technology officers, social and policy analysts, academics, and individual citizens who wish to learn how to secure cyberspace. },
	keywords = {business ecosystem, cybersecurity, innovation engine, innovation in commercialization, innovation in research and development},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/711},
	url = {http://timreview.ca/article/711},
	author = {Tony Bailetti and Dan Craigen and David Hudson and Renaud Levesque and Stuart McKeen and D{\textquoteright}Arcy Walsh}
}
@article {710,
	title = {Editorial: Cybersecurity (August 2013)},
	journal = {Technology Innovation Management Review},
	volume = {3},
	year = {2013},
	month = {08/2013},
	pages = {3-4},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {Canada, cyberattacks, cybersecurity, cyberthreats, information technology, network security, research, risk assessment},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/710},
	url = {http://timreview.ca/article/710},
	author = {Chris McPhee and Tony Bailetti}
}
@article {699,
	title = {Editorial: Cybersecurity (July 2013)},
	journal = {Technology Innovation Management Review},
	volume = {3},
	year = {2013},
	month = {07/2013},
	pages = {3-5},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {Canada, cyberattacks, cybersecurity, cyberthreats, information technology, network security, research},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/699},
	url = {http://timreview.ca/article/699},
	author = {Chris McPhee and Tony Bailetti}
}
@article {713,
	title = {An Enterprise Security Program and Architecture to Support Business Drivers},
	journal = {Technology Innovation Management Review},
	volume = {3},
	year = {2013},
	month = {08/2013},
	pages = {25-33},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {This article presents a business-focused approach to developing and delivering enterprise security architecture that is focused on enabling business objectives while providing a sensible and balanced approach to risk management. A balanced approach to enterprise security architecture can create the important linkages between the goals and objectives of a business, and it provides appropriate measures to protect the most critical assets within an organization while accepting risk where appropriate. Through a discussion of information assurance, this article makes a case for leveraging enterprise security architectures to meet an organizations{\textquoteright} need for information assurance. The approach is derived from the Sherwood Applied Business Security Architecture (SABSA) methodology, as put into practice by Seccuris Inc., an information assurance integrator. An understanding of Seccuris{\textquoteright} approach will illustrate the importance of aligning security activities with high-level business objectives while creating increased awareness of the duality of risk. This business-driven approach to enterprise security architecture can help organizations change the perception of IT security, positioning it as a tool to enable and assure business success, rather than be perceived as an obstacle to be avoided.},
	keywords = {cybersecurity, cyberthreats, information assurance, information risk, information security, risk, security architecture},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/713},
	url = {http://timreview.ca/article/713},
	author = {Brian Ritchot}
}
@article {703,
	title = {Keystone Business Models for Network Security Processors},
	journal = {Technology Innovation Management Review},
	volume = {3},
	year = {2013},
	month = {07/2013},
	pages = {25-33},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Network security processors are critical components of high-performance systems built for cybersecurity. Development of a network security processor requires multi-domain experience in semiconductors and complex software security applications, and multiple iterations of both software and hardware implementations. Limited by the business models in use today, such an arduous task can be undertaken only by large incumbent companies and government organizations. Neither the {\textquotedblleft}fabless semiconductor{\textquotedblright} models nor the silicon intellectual-property licensing ({\textquotedblleft}IP-licensing{\textquotedblright}) models allow small technology companies to successfully compete. This article describes an alternative approach that produces an ongoing stream of novel network security processors for niche markets through continuous innovation by both large and small companies. This approach, referred to here as the "business ecosystem model for network security processors", includes a flexible and reconfigurable technology platform, a {\textquotedblleft}keystone{\textquotedblright} business model for the company that maintains the platform architecture, and an extended ecosystem of companies that both contribute and share in the value created by innovation. New opportunities for business model innovation by participating companies are made possible by the ecosystem model. This ecosystem model builds on: i) the lessons learned from the experience of the first author as a senior integrated circuit architect for providers of public-key cryptography solutions and as the owner of a semiconductor startup, and ii) the latest scholarly research on technology entrepreneurship, business models, platforms, and business ecosystems. This article will be of interest to all technology entrepreneurs, but it will be of particular interest to owners of small companies that provide security solutions and to specialized security professionals seeking to launch their own companies.},
	keywords = {business ecosystems, business model innovation, commercialization, cybersecurity, platforms, semiconductors, technology entrepreneurship},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/703},
	url = {http://timreview.ca/article/703},
	author = {Arthur Low and Steven Muegge}
}
@article {705,
	title = {Managing Cybersecurity Research and Experimental Development: The REVO Approach},
	journal = {Technology Innovation Management Review},
	volume = {3},
	year = {2013},
	month = {07/2013},
	pages = {34-41},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {We present a systematic approach for managing a research and experimental development cybersecurity program that must be responsive to continuously evolving cybersecurity, and other, operational concerns. The approach will be of interest to research-program managers, academe, corporate leads, government leads, chief information officers, chief technology officers, and social and technology policy analysts. The approach is compatible with international standards and procedures published by the Organisation for Economic Co-operation and Development (OECD) and the Treasury Board of Canada Secretariat (TBS). The key benefits of the approach are the following: i) the breadth of the overall (cybersecurity) space is described; ii) depth statements about specific (cybersecurity) challenges are articulated and mapped to the breadth of the problem; iii) specific (cybersecurity) initiatives that have been resourced through funding or personnel are tracked and linked to specific challenges; and iv) progress is assessed through key performance indicators.

Although we present examples from cybersecurity, the method may be transferred to other domains. We have found the approach to be rigorous yet adaptive to change; it challenges an organization to be explicit about the nature of its research and experimental development in a manner that fosters alignment with evolving business priorities, knowledge transfer, and partner engagement. },
	keywords = {cybersecurity, experimental development, performance indicators, research, research program lifecycle, research-activity descriptions, research-requirement statements, strategic research contexts},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/705},
	url = {http://timreview.ca/article/705},
	author = {Dan Craigen and Drew Vandeth and D{\textquoteright}Arcy Walsh}
}
@article {701,
	title = {Peer-to-Peer Enclaves for Improving Network Defence},
	journal = {Technology Innovation Management Review},
	volume = {3},
	year = {2013},
	month = {07/2013},
	pages = {19-24},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Information about cyberthreats within networks spreads slowly relative to the speed at which those threats spread. Typical "threat feeds" that are commercially available also disseminate information slowly relative to the propagation speed of attacks, and they often convey irrelevant information about imminent threats. As a result, hosts sharing a network may miss opportunities to improve their defence postures against imminent attack because needed information arrives too late or is lost in irrelevant noise. We envision timely, relevant peer-to-peer sharing of threat information {\textendash} based on current technologies {\textendash} as a solution to these problems and as a useful design pattern for defensive cyberwarfare. In our setting, network nodes form communities that we call enclaves, where each node defends itself while sharing information on imminent threats with peers that have similar threat exposure. In this article, we present our vision for this solution. We sketch the architecture of a typical node in such a network and how it might interact with a framework for sharing threat information; we explain why certain defensive countermeasures may work better in our setting; we discuss current tools that could be used as components in our vision; and we describe opportunities for future research and development.},
	keywords = {cyber countermeasures, cybersecurity, dynamic cyberdefence, enclave computing, network defence, peer-to-peer},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/701},
	url = {http://timreview.ca/article/701},
	author = {David W. Archer and Adam Wick}
}
@article {714,
	title = {Protecting Critical Infrastructure by Identifying Pathways of Exposure to Risk},
	journal = {Technology Innovation Management Review},
	volume = {3},
	year = {2013},
	month = {08/2013},
	pages = {34-40},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Increasingly, our critical infrastructure is managed and controlled by computers and the information networks that connect them. Cyber-terrorists and other malicious actors understand the economic and social impact that a successful attack on these systems could have. While it is imperative that we defend against such attacks, it is equally imperative that we realize how best to react to them. This article presents the strongest-path method of analyzing all potential pathways of exposure to risk {\textendash} no matter how indirect or circuitous they may be {\textendash} in a network model of infrastructure and operations. The method makes direct use of expert knowledge about entities and dependency relationships without the need for any simulation or any other models. By using path analysis in a directed graph model of critical infrastructure, planners can model and assess the effects of a potential attack and develop resilient responses. },
	keywords = {critical infrastructure, cybersecurity, directed graph, modelling, path analysis, risk analysis, simulation, strongest-path method},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/714},
	url = {http://timreview.ca/article/714},
	author = {Philip O{\textquoteright}Neill}
}
@article {706,
	title = {Q\&A. Should Startups Care about Application Security?},
	journal = {Technology Innovation Management Review},
	volume = {3},
	year = {2013},
	month = {07/2013},
	pages = {50-52},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {application security, architecture, checklists, code reviews, cybersecurity, design, detection, prevention, software security, startups, training},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/706},
	url = {http://timreview.ca/article/706},
	author = {Sherif Koussa}
}
@article {715,
	title = {A Research Agenda for Security Engineering},
	journal = {Technology Innovation Management Review},
	volume = {3},
	year = {2013},
	month = {08/2013},
	pages = {41-50},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Despite nearly 30 years of research and application, the practice of information system security engineering has not yet begun to exhibit the traits of a rigorous scientific discipline. As cyberadversaries have become more mature, sophisticated, and disciplined in their tradecraft, the science of security engineering has not kept pace. The evidence of the erosion of our digital security {\textendash} upon which society is increasingly dependent {\textendash} appears in the news almost daily.

In this article, we outline a research agenda designed to begin addressing this deficit and to move information system security engineering toward a mature engineering discipline. Our experience suggests that there are two key areas in which this movement should begin. First, a threat model that is actionable from the perspectives of risk management and security engineering should be developed. Second, a practical and relevant security-measurement framework should be developed to adequately inform security-engineering and risk-management processes. Advances in these areas will particularly benefit business/government risk assessors as well as security engineers performing security design work, leading to more accurate, meaningful, and quantitative risk analyses and more consistent and coherent security design decisions.

Threat modelling and security measurement are challenging activities to get right {\textendash} especially when they need to be applied in a general context. However, these are decisive starting points because they constitute the foundation of a scientific security-engineering practice. Addressing these challenges will require stronger and more coherent integration between the sub-disciplines of risk assessment and security engineering, including new tools to facilitate that integration. More generally, changes will be required in the way security engineering is both taught and practiced to take into account the holistic approach necessary from a mature, scientific discipline.},
	keywords = {cybersecurity, information system security engineering, research, risk management, security engineering, security measurement, threat modelling},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/715},
	url = {http://timreview.ca/article/715},
	author = {Rich Goyette and Yan Robichaud and Fran{\c c}ois Marinier}
}
@article {717,
	title = {On the Road to Holistic Decision Making in Adaptive Security},
	journal = {Technology Innovation Management Review},
	volume = {3},
	year = {2013},
	month = {08/2013},
	pages = {59-64},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {Security is a critical concern in today{\textquoteright}s software systems. Besides the interconnectivity and dynamic nature of network systems, the increasing complexity in modern software systems amplifies the complexity of IT security. This fact leaves attackers one step ahead in exploiting vulnerabilities and introducing new cyberattacks. The demand for new methodologies in addressing cybersecurity is emphasized by both private and national corporations. A practical solution to dynamically manage the high complexity of IT security is adaptive security, which facilitates analysis of the system{\textquoteright}s behaviour and hence the prevention of malicious attacks in complex systems. Systems that feature adaptive security detect and mitigate security threats at runtime with little or no administrator involvement. In these systems, decisions at runtime are balanced according to quality and performance goals. This article describes the necessity of holistic decision making in such systems and paves the road to future research.},
	keywords = {adaptive security, architecture, automation, cyberattacks, cybersecurity, game theory, holistic decision making, self-adaptive software, self-protecting software},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/717},
	url = {http://timreview.ca/article/717},
	author = {Mahsa Emami-Taba and Mehdi Amoui and Ladan Tahvildari}
}
@article {704,
	title = {Securing Canada{\textquoteright}s Information-Technology Infrastructure: Context, Principles, and Focus Areas of Cybersecurity Research},
	journal = {Technology Innovation Management Review},
	volume = {3},
	year = {2013},
	month = {07/2013},
	pages = {12-18},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {This article addresses the challenges of cybersecurity and ultimately the provision of a stable and resilient information-technology infrastructure for Canada and, more broadly, the world. We describe the context of current cybersecurity challenges by synthesizing key source material whose importance was informed by our own real-world experiences. Furthermore, we present a checklist of guiding principles to a unified response, complete with a set of action-oriented research topics that are linked to known operational limitations. The focus areas are used to drive the formulation of a unified and relevant research and experimental development program, thereby moving us towards a stable and resilient cyberinfrastructure. When cybersecurity is viewed as an inherently interdisciplinary problem of societal concern, we expect that fundamentally new research perspectives will emerge in direct response to domain-specific protection requirements for information-technology infrastructure. Purely technical responses to cybersecurity challenges will be inadequate because human factors are an inherent aspect of the problem.

This article will interest managers and entrepreneurs. Senior management teams can assess new technical developments and product releases to fortify their current security solutions, while entrepreneurs can harness new opportunities to commercialize novel technology to solve a high-impact cybersecurity problem..},
	keywords = {Canada, cyberdefence, cyberinfrastructure, cybersecurity, entrepreneurship, experimental development program, information-technology infrastructure, management, research},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/704},
	url = {http://timreview.ca/article/704},
	author = {Dan Craigen and D{\textquoteright}Arcy Walsh and David Whyte}
}
@article {702,
	title = {Security Challenges in Smart-Grid Metering and Control Systems},
	journal = {Technology Innovation Management Review},
	volume = {3},
	year = {2013},
	month = {07/2013},
	pages = {42-49},
	publisher = {Talent First Network},
	address = {Ottawa},
	abstract = {The smart grid is a next-generation power system that is increasingly attracting the attention of government, industry, and academia. It is an upgraded electricity network that depends on two-way digital communications between supplier and consumer that in turn give support to intelligent metering and monitoring systems. Considering that energy utilities play an increasingly important role in our daily life, smart-grid technology introduces new security challenges that must be addressed. Deploying a smart grid without adequate security might result in serious consequences such as grid instability, utility fraud, and loss of user information and energy-consumption data. Due to the heterogeneous communication architecture of smart grids, it is quite a challenge to design sophisticated and robust security mechanisms that can be easily deployed to protect communications among different layers of the smart grid-infrastructure. In this article, we focus on the communication-security aspect of a smart-grid metering and control system from the perspective of cryptographic techniques, and we discuss different mechanisms to enhance cybersecurity of the emerging smart grid. We aim to provide a comprehensive vulnerability analysis as well as novel insights on the cybersecurity of a smart grid.},
	keywords = {authentication, cybersecurity, encryption, privacy, smart grid},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/702},
	url = {http://timreview.ca/article/702},
	author = {Xinxin Fan and Guang Gong}
}
@article {696,
	title = {TIM Lecture Series {\textendash} Using Risk to Drive a Security Service},
	journal = {Technology Innovation Management Review},
	volume = {3},
	year = {2013},
	month = {06/2013},
	pages = {42-45},
	publisher = {Talent First Network},
	address = {Ottawa},
	keywords = {cybersecurity, platforms, risk management, security, services, strategy, uncertainty},
	issn = {1927-0321},
	doi = {http://doi.org/10.22215/timreview/696},
	url = {http://timreview.ca/article/696},
	author = {Paul Card}
}
