Discussing Cybersecurity

About

About Oscar O’Connor FCIISec FRSA

Virtual CISO

I step into organisations that need steady cyber leadership fast, usually as an Interim, virtual or Fractional CISO. My focus is practical: making sure security, risk and governance line up with the business, whether that aims to adopt frameworks such as ISO 27001, NIST CSF, or simply conduct a broader cyber risk review. Over the past 15 years at CISO level, I’ve helped teams strengthen their security posture, build usable governance, and make better decisions about technology risk. I’ve overhauled the cybersecurity posture for World Rugby, driven GRC policy and process improvements at DS Smith PLC, and have taught cyber security and GRC masterclasses through the International Compliance Association. Other experience includes:

– Advised boards on cybersecurity, privacy, and IT risks in more than 20 organisations over the past 25 years, delivering sustainable, actionable strategies;

– Analysed root causes and long-term impacts of strategic decisions, improving security service outcomes by 40%+;

– Served in 10 board and advisory roles, including NED, COO, Trustee, and Ethics Board member, across cybersecurity and risk organisations;

– Published 20+ articles and spoke at 10+ international events across six countries on continuity, risk, and cybersecurity;

– Delivered cybersecurity masterclasses for ICA postgraduate programs, training 120+ professionals in cybersecurity governance, risk, and compliance.

Finally, a note about the use of AI: I am in the early stages of learning to use AI, so I want to be absolutely clear with you how I approach writing blog posts and other content:

  • Ecosia AI Assistant to help me define comprehensive prompts for the content I want to create;
  • Mistral AI to produce first drafts which I then edit for language, grammar, tone, length and flow;
  • Leonardo.AI to generate graphics as I am not the world’s most visually creative but love creative visuals.

All content is reviewed by me for is appropriateness before being published.

  

Contact Oscar O'Connor
Get in Touch

Inspirations

As you may have gathered from the design theme of this site, I am a fan of modern art, particularly the works of Piet Mondriaan, Rene Magritte, Salvador Dali, Marc Chagal,  and Pablo Picasso. I am also fond of the Impressionist such as Pissaro, Monet and Manet. So in addition to factual infographics for my posts I have generated some (hopefully) thought-provoking graphics inspired by these artists.

So let me know what you think.

About this Blog

Over the past year or so, I have noticed a number of themes which feature regularly in news stories and deeper dives. This has led me to going deeper myself into these themes and over time, this blog will assemble posts on these diverse topics, with each post being accompanied by an FAQ and a Myth-Buster.

My goal with this site is to provide explanations for non-experts across the full range of subdomains that exist within cybersecurity. The most common shorthand definition of which is the CIA triumvirate of Confidentiality, Integrity and Availability. But what does that actually mean?

Confidentiality

Making sure that information is only accessible to those who are properly authorised. By implication this also means that information should not be accessible to anyone who is not properly authorised.

This also implies that we need to know that the people (and devices) that want to access the information we manage, are who they claim to be and are entitled to the access they claim.

Integrity

This is probably the least understood of the three principles, and one of the most difficult to explain, but I’ll give it a go…

We need to ensure that information is what it appears to be, and that prior to being stored we have verified that it is accurate, as complete as we can make it, and that it does not misrepresent facts or opinions. Once stored as “valid” we need to ensure that information is not subject to unauthorised change, whether accidental or malicious in intent, so that people (or devices) authorised to access the information can do so confident in the knowledge that is what they expect it to be.

Availability

In an increasingly information-driven world, we need to ensure that information is accessible to the people (or devices) that need it, where and when they need it and in a form that is useful to them.

Published posts, each accompanied by FAQs and a Myth-Buster

Coming soon…

  • The Evolution of the CISO Role

  • AI-Fuelled Cyberattacks: an Active Threat to Critical Infrastructure

  • Data Breaches and their Fallout

  • Compliance and Regulatory Changes

  • Living-off-the-land Attacks: Evading Detection to get up to Mischief

  • Quantum Security Readiness: are you prepared for Post-Quantum Cryptography?