blog.mitcdh

Hearing the Music: A History of the Cyber ITC, 2016–2025

Sat, 05 Sep 2026 07:59:02 +0000

I was asked to write a history of the IAEA Cyber ITC for its 2026 delivery. I have been fortunate to be part of its development from near the beginning, starting with the original hands-on training consultancy meeting and RTC. I later served as the first Project Officer for Learners, the second for the CRP, and Scientific Secretary for the ITC from 2019 to 2024. I inherited parts of that work from colleagues at the IAEA who had carried it before me, and built on the vision they had established.

There Is No Such Thing As Cyber Risk

Sun, 09 Aug 2026 07:34:55 +0000

There is no such thing as cyber risk.

That is deliberately provocative, but the distinction matters. My thesis is neither that cyber-related uncertainty is not real nor that it is incapable of producing material consequences. It is that “cyber” is the wrong boundary at which to express, govern, own, and accept the resulting risk.

Risk arises because an organisation is pursuing an objective under uncertainty. It is something to understand, treat, and sometimes accept because the value of pursuing that objective can justify exposure (within applicable legal, regulatory, ethical, moral, and existing organisational constraints).

The Carousel Before the Feed

Sun, 19 Jul 2026 14:30:00 +1000

There is a scene in Mad Men where Don Draper pitches Kodak’s circular slide projector, “The Carousel”. He barely talks about the technology. Instead, he talks about what it allows people to feel, the ability to travel backwards and return to a place and a time where they still ache to be.

When my dad passed away, I found myself going through thousands of slides from my grandfather’s collection. Many showed my dad growing up with his family. I saw the father I knew as a child, a brother, and a son, living through years that had previously existed for me only as stories.

Parsing Consensus

Sat, 18 Jul 2026 00:00:00 +1000

The idea for this experiment came from a few conversations at CyberCon26. I spoke with people who had asked LLMs questions about IAEA safety and nuclear security guidance and come away with an understanding that the publications did not support. The answers were not always obvious hallucinations. Some quoted genuine passages but lost the distinctions that tell an experienced reader what those passages mean and how much weight to give them.

The Odyssey (2026)

Thu, 16 Jul 2026 12:57:13 +0000

This review may contain spoilers.

My uncle once showed me a copy of The Odyssey carried to Australia, allegedly, aboard the First Fleet. It felt like a beautiful object: an ancient story of wandering, endurance, and homecoming transported across the world. The story I grew up with saw Odysseus as a hero tested by monsters, gods and hostile lands as he struggles home from Troy. Nolan’s film makes that much harder to romanticise.

One Battle After Another (2025)

Mon, 29 Jun 2026 04:24:15 +0000

One Battle After Another feels like TEMU Andor: a discount rebellion against a discount empire, both sides morally flattened and dressed in the same disposable plastic sheen. The resistance has vibes, the regime has spectacle, and history has been replaced by a shopping trolley full of product placements (don’t drink and drive kids!). Contemporary masterpiece.

View this review on Letterboxd

Beyond Mogura Taiji Security

Wed, 17 Jun 2026 14:30:00 +0900

This article has been adapted verbatim from a paper accepted and presented during INCOSE IS 2026 titled ‘Beyond Mogura Taiji Security’ authored by Mona Humes, Mark Winstead and myself.

Abstract

Organizations typically achieve cybersecurity compliance for nuclear and other critical infrastructure through established control-based guidance documents such as NIST SP 800-53, NIST SP 800-82, ISO 27001, and IEC 63096. This paper presents an engineering-driven methodology that leverages the INCOSE Guide to Security Needs and Requirements (GtSNR) and the trustworthy secure concepts and principles defined in NIST SP 800-160 Volume 1 Revision 1 to derive security needs and requirements for critical systems (CS) and critical digital assets (CDA). The resulting requirements are realized through security-informed architecture, design, and implementation, and the resulting engineered security capability might be later mapped to controls to represent and assess that capability for governance and compliance purposes, when needed. By applying systems security engineering (SSE) as defined in NIST SP 800-160 Vol 1 Rev 1 and INCOSE GtSNR selectively to systems and assets of highest consequence, the proposed approach supports incremental adoption, reduces implementation burden, and enhances alignment between systems engineering and security practices.

Why Nuclear Security Needs Information Security

Thu, 28 May 2026 19:00:00 +0300

This article has been adapted verbatim from a paper accepted and presented during the International Conference on Computer Security in the Nuclear World: Securing the Future titled ‘Why Nuclear Security Needs Information Security: The Promise Of NST070’ authored by Mike StJohn-Green and myself.

Abstract

Effective computer security requires information security. Computers, like humans, are actors on information and adversaries target the functions they perform by compromising the confidentiality, integrity, or availability (CIA) of the information itself.

Where to Start — the System or the Function?

Thu, 28 May 2026 18:00:00 +0300

This article has been adapted verbatim from a paper accepted and presented during the International Conference on Computer Security in the Nuclear World: Securing the Future titled ‘Where To Start — The System Or The Function? How The V-Model Clarifies Effective Computer Security’ authored by Mike StJohn-Green and myself.

Abstract

IAEA guidance on computer security calls for two levels of risk management, initially a function-based analysis followed by a systems-based analysis. This concept of multiple levels of risk analysis is also present in other computer security standards (IEC 62443, IEC 62645, NRC), although they differ on the details of whether a graded approach should consider impact, adversarial-skill, or likelihood. However, the most significant practical challenge in implementing this guidance is bridging the functions-systems analyses, resulting in a struggle to translate between impacts, risks, and vulnerabilities.

Project Hail Mary (2026)

Wed, 08 Apr 2026 05:28:17 +0000

I didn’t expect to like this as much as I did. Underneath the sci-fi spectacle, the survival of humanity actually hinges on a brilliant, quiet critique of English as the universal lingua franca along with a powerful push for genuine inter-cultural exchange.

View this review on Letterboxd

Dreams of the Dying

Mon, 02 Mar 2026 00:00:00 +0000

Halfway through the book I preordered the two sequels. By the end I was hollowed out, staring at the ceiling, trying to process what I just read. The last time I felt like this was Deadhouse Gates. A brilliant, devastating debut. Read the trigger warnings, and then read the book.

View this review on Hardcover

Taronga Zoo Sydney, Australia

Sun, 01 Feb 2026 16:10:40 +0000

Avatar: Fire and Ash (2025)

Sat, 31 Jan 2026 11:53:47 +0000

For two movies, Avatar sold us the myth that Pandora was a utopia where nature always equals goodness. This film burns that idea to the ground becoming a genuine tragedy about the loss of innocence. It’s the darker, dirtier turn that proves Pandora isn’t a fairytale, but a real place capable of both the same destruction as Earth and finding the desperate necessity of coming together to prevent it.

View this review on Letterboxd

Akira (1988)

Fri, 30 Jan 2026 11:49:07 +0000

Neo-Tokyo isn’t just a backdrop; it is a character representing a society in late-stage decay. Akira captures the chaotic energy of student protests, religious zealotry, and a government that has lost its legitimacy. Beneath the stunning animation and the tragic friendship of Kaneda and Tetsuo lies a deeper warning: what happens to humanity when technology outpaces our ability to govern it.

View this review on Letterboxd

Children of Men (2006)