Massacci, F., Ruprai, R., Collinson, M., Williams, J., "Economic Impacts of Rules- versus Risk-Based Cybersecurity Regulations for Critical Infrastructure Providers", IEEE Security and Privacy, 2016