00919nas a2200349   4500008004100000022001400041245004200055210003900097260004200136300000800178490000600186653002200192653001500214653001300229653001800242653001600260653002100276653002300297653000800320653001600328653002000344653001200364653001400376653002000390653002500410653001800435653002200453653002000475100001800495700001900513856003700532       2017                        eng d  a1927-032100aEditorial: Cybersecurity (April 2017)0 aEditorial Cybersecurity April 2017  aOttawabTalent First Networkc04/2017  a3-40 v710aanomaly detection10aautomation10abig data10acybersecurity10aexploration10aHypponen’s law10aInternet of Things10aIOT10alegislation10amedical devices10aprivacy10areal time10arisk assessment10asecurity engineering10asmart devices10avalue proposition10avulnerabilities1 aMcPhee, Chris1 aWeiss, Michael  uhttp://timreview.ca/article/106500669nas a2200217   4500008004100000022001400041245006800055210006500123260004200188300001000230490000600240653002700246653002800273653001800301653001800319653002700337653001300364653002000377100001800397856003600415       2015                        eng d  a1927-032100aQ&A. Should the Internet Be Considered Critical Infrastructure?0 aQA Should the Internet Be Considered Critical Infrastructure  aOttawabTalent First Networkc01/2015  a37-400 v510acommunication networks10acritical infrastructure10acyber-attacks10acybersecurity10ainformation technology10aInternet10avulnerabilities1 aMiron, Walter  uhttp://timreview.ca/article/86501854nas a2200289   4500008004100000022001400041245011000055210006900165260004200234300001000276490000600286520099200292653002901284653001501313653001201328653001801340653001401358653001501372653001801387653001601405653001301421653004001434653002001474100001801494700001601512856003601528       2015                        eng d  a1927-032100aSecuring the Car: How Intrusive Manufacturer-Supplier Approaches Can Reduce Cybersecurity Vulnerabilities0 aSecuring the Car How Intrusive ManufacturerSupplier Approaches C  aOttawabTalent First Networkc01/2015  a21-250 v53 aToday's vehicles depend on numerous complex software systems, some of which have been developed by suppliers and must be integrated using "glue code" so that they may function together. However, this method of integration often introduces cybersecurity vulnerabilities at the interfaces between electronic systems. In this article we address the “glue code problem” by drawing insights from research on supplier-manufacturer outsourcing relationships in the automotive industry. The glue code problem can be framed as a knowledge coordination problem between manufactures and suppliers. Car manufacturers often employ different levels of intrusiveness in the design of car subsystems by their suppliers: the more control over the supplier the manufacturer exerts in the design of the subsystem, the more intrusive the manufacturer is. We argue that high intrusiveness by car manufacturers in defining module interfaces and subcomponents for suppliers would lead to more secure cars. 10aautomobile manufacturing10acar design10acontrol10acybersecurity10aglue code10agovernance10aintrusiveness10aoutsourcing10asupplier10asupplier-manufacturer relationships10avulnerabilities1 aAmin, Mohamed1 aTariq, Zaid  uhttp://timreview.ca/article/86302669nas a2200229   4500008004100000022001400041245008600055210006900141260004200210300001000252490000600262520197600268653001702244653002002261653001402281653003102295653002002326653002002346100001702366700002002383856003602403       2013                        eng d  a1927-032100aQuantitative Metrics and Risk Assessment: The Three Tenets Model of Cybersecurity0 aQuantitative Metrics and Risk Assessment The Three Tenets Model   aOttawabTalent First Networkc08/2013  a15-240 v33 aProgress in operational cybersecurity has been difficult to demonstrate. In spite of the considerable research and development investments made for more than 30 years, many government, industrial, financial, and consumer information systems continue to be successfully attacked and exploited on a routine basis. One of the main reasons that progress has been so meagre is that most technical cybersecurity solutions that have been proposed to-date have been point solutions that fail to address operational tradeoffs, implementation costs, and consequent adversary adaptations across the full spectrum of vulnerabilities. Furthermore, sound prescriptive security principles previously established, such as the Orange Book, have been difficult to apply given current system complexity and acquisition approaches. To address these issues, the authors have developed threat-based descriptive methodologies to more completely identify system vulnerabilities, to quantify the effectiveness of possible protections against those vulnerabilities, and to evaluate operational consequences and tradeoffs of possible protections. 

This article begins with a discussion of the tradeoffs among seemingly different system security properties such as confidentiality, integrity, and availability. We develop a quantitative framework for understanding these tradeoffs and the issues that arise when those security properties are all in play within an organization. Once security goals and candidate protections are identified, risk/benefit assessments can be performed using a novel multidisciplinary approach, called “QuERIES.” The article ends with a threat-driven quantitative methodology, called “The Three Tenets”, for identifying vulnerabilities and countermeasures in networked cyber-physical systems. The goal of this article is to offer operational guidance, based on the techniques presented here, for informed decision making about cyber-physical system security. 10aavailability10aconfidentiality10aintegrity10aquantitative cybersecurity10arisk assessment10avulnerabilities1 aHughes, Jeff1 aCybenko, George  uhttp://timreview.ca/article/712