Slashdot Mirror
Cybersecurity's Insidious New Threat: Workforce Stress (technologyreview.com)
This week's Black Hat event will highlight job-related stress and mental health issues in the cyber workforce. From a report: The thousands of cybersecurity professionals gathering at Black Hat, a massive conference held in the blistering heat of Las Vegas every summer, are encountering a different type of session this year. A new "community" track is offering talks on a range of workplace issues facing defenders battling to protect the world from a hacking onslaught. With titles like "Mental Health Hacks: Fighting Burnout, Depression and Suicide in the Hacker Community" and "Holding on for Tonight: Addiction in Infosec," several of the sessions will address pressures on security teams and the negative impact these can have on workers' wellbeing.
"A lot of people in this space feel strongly about wanting to protect their users," says Jamie Tomasello of Duo Security, who is one of the speakers. "Where this becomes challenging is when people are under sustained high stress. That increases the risk of depression and mental illness." The impact on cyber defenders' lives is deeply concerning, as are the broader implications for security. In spite of a push for greater automation, many tasks in cyber defense are still labor intensive. Workers experiencing mental health issues are more likely to make mistakes and to have performance issues that require colleagues to pick up the slack, increasing the likelihood they will make errors too.
"A lot of people in this space feel strongly about wanting to protect their users," says Jamie Tomasello of Duo Security, who is one of the speakers. "Where this becomes challenging is when people are under sustained high stress. That increases the risk of depression and mental illness." The impact on cyber defenders' lives is deeply concerning, as are the broader implications for security. In spite of a push for greater automation, many tasks in cyber defense are still labor intensive. Workers experiencing mental health issues are more likely to make mistakes and to have performance issues that require colleagues to pick up the slack, increasing the likelihood they will make errors too.
So in the main article it talks about "Mental Health Hacks". What does "hack" mean any more? It seems that it can mean almost anything. I've seen people talk about, for example, putting hot sauce on vanilla ice cream as a "hack". I wouldn't think that a topic as important as somebody's mental health would involve hacking, yet here we are. It reminds me of what a smart guy I worked with said once - when something is everybody's responsibility, it's nobody's responsibility. Similarly, I guess now that hack apparently can mean anything, it means nothing. Maybe writers need to stop being cute and try for understandability instead. What a concept.
what color hair do the xers leading these talks have
disclosure: I left infosec for the relatively calmer career path of system administration.
infosec is under enormous pressure to deliver a product that cant be hacked, and take the blame for when products are hacked. Developers routinely leapfrog infosec for exceptions to upgrades or coding standards and when theyre caught with their pants around their ankles theres no accountability, only blame. 'IS director' is a revolving door of burnouts that are exhausted from the constant assault and bettery from sales insisting every credit card is a good credit card, and managers insisting you need to stand down from every product meeting or just not attend at all because it somehow negatively affects 'agility.'
I became so jaded eventually that my job morphed from protecting users from malicious actors, to just keeping a running CYA log of poor leadership decisions and whom to attribute them to when the shit hit the fan. no hardened binaries? no standardized two factor? no problem. Just dont expect me to sit quietly in the meeting.
Good people go to bed earlier.
ever since it was used to describe the rats nest of wires under an MIT model train setup: it's a complex and clever solution to a problem.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
and it's happening everywhere. Companies are cutting staff and forcing the ones left to work longer hours. 80% of Americans are living paycheck-to-paycheck (google it). _Everybody's_ stressed out. It's just that when your cyber security guys get that way and start making the mistakes folks under high pressure 24/7 tend to do then your network gets hacked and you've got a PR disaster on your hands.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
...if mgt is placing unrealistic pressure it's time to switch jobs...
nothing to see here - move along
Security isn't stressful. It's the lack of security that is stressful. If your infosec people are stressed, it is because they are failing at security.
Check out his analysis and stories of incredible alcohol consumption at security conferences: http://www.irongeek.com/i.php?...
What they are talking about is basically PTSD. PTSD does not have to be caused by a physical event (e.g. explosion/shell shock) - but can be from an extreme emotional event as well. In the case of security folks - working day & night to ensure that their customers are safe from the bad actors in the world. Emotionally, they are akin to protective parents. A security breach can be as emotionally traumatic as having something awful happen to their child.
I hope the the presenters are taking lessons from folks that have dealt with life and death decisions:
ER Staff (Dr's, nurses, etc.)
Emergency medical staff (paramedics / EMTs)
Parents that have have lost a child / suffered sexual abuse / kidnapped / etc.
Personally I think the sessions are a good thing - it's show's a maturing of the industry.
Fred in IT
It's not just the "protection" issue, it's the stress that can be caused by incident investigation and response. Like investigating porn and child porn, theft and hatred/abuse, etc.. These haunting things (or dismaying immersion into them) can lead to serious stress and anxiety. Adults behave like adults behave: they don't necessarily do the right thing (any of them involved, sometimes!) and somehow its up to InfoSec or SysAdmins to find and figure out (and present) on it because there was a computer or network involved.
Workplace stress, >40 hr work weeks, poor healthcare, and living pay check to paycheck could be solved with unionized bargaining, could it not? IMHO, tech jobs are the new middle class, and it's time to shake off old stigmas and look into unionization as an industry on the whole.
110 with ~10% humidity is much preferable than 90 with 65% humidity.
Perhaps not wearing black in the sun might help.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
I used to be a pen tester/security analyst/firewall engineer and I got out of that element of IT due to stress. I tried private companies and government contractor (far worse) and the IT security domain is very high stress, especially on the government side where you have to adhere to things like Letters of Operation (permission), NIST, FISMA, etc. I was a pen tester in this arena for 3 years and it's a nightmare, despite the high paycheck. My last job in that area was $106k and the stress and anxiety was not worth it.
I started out in Web hosting, which is docile in comparison, and actually prefer it to about anything else at this point. I've been in IT now for 20 years and am leaving at the beginning of 2019 to start a new career for my own sanity. IT has been hollowed out due to outsourcing, insourcing, moving everything to the cloud (you become a point/click monkey), and general democratization of IT from the user on down. I miss the data center where I didn't have to engage with end users. Being a sysadmin now for many years, I want out and am going to the trades where I can have my sanity and a higher paycheck.
Stop the presses! Breaking News! Too much stress adversely affects humans, plants, and animals!
Get out of the ASSES!
Your statement directly contradicts itself. The reason one would be interested in a worker that can do 3-5 times the work, is because it allows them to eliminate 3-5 positions, and hence safe costs.
It *all* comes down to costs.
The reason foreign workers are willing to work such long hours is twofold:
1) Where they live, things are even worse, and American money goes further, so desperation drives them to push themselves too hard. They get suicidal from this eventually, just like American workers do. But they are more easily replaced once they go.
2) Many of them don't have the education, nor even skill, that American technicians do. This is a side-effect of reason number 1 given above. Desperation drives people into the field who are absolutely NOT cut out for it. But they have terrible options every where they turn, so they lose nothing by faking it as long as they can.
The *only* reason that all American-owned software isn't *already* completely coded in foreign countries is the talent deficit. Regulation didn't stop the huge outsourcing push of the late 90s...the steady stream of missed deadlines and non-functional code from the foreign labor supply did.
*All* the complaints that employers have about American talent boil down to this single reason: there aren't enough of them. All the complaints about how lazy or demanding they are would be completely resolved if the labor supply exceeded the demand. The competition for the positions would drive salaries down and work-ethic up. But the situation is exactly the opposite of that, forcing employers to pay much more than they think they should have to pay in order to get software written.
Lastly, the reason the American labor supply of technicians is too low is twofold: 1) It's hard, you have to be of above-average intelligence to be good at it, so not many people can do it. 2) It sucks, because it is super-stressful and employers like to abuse their employees and take advantage of them at every turn.
It can also be pretty stressful if you are an outside consultant being brought in after others have done it wrong for some time. I do agree that management is the main root-cause of the problems in almost all cases though.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Place the blame where it should be, laziness and the feeling of entitlement.
As true of employers as employees.
In my experience, the "feeling of entitlement" is much more true of managers than of those they manage, and this differential is maintained at every level of the hierarchy.
The old way of describing this is "the servant problem".
I think we've pushed this "anyone can grow up to be president" thing too far.
I was under the impression that the talent situation was one where there's not enough people willing to do the job at the price that companies are wanting to pay.
Completely true. I remember starting my IT career in the 90s, and even in college, the professors and instructors pushed and pushed for everyone to get as many certs as they could on top of your degree. I eventually did get a few specialized certs, but after being in the industry a couple of years, I noticed the people that had the certs were largely "paper tigers" and didn't have the experience to back up the certs.
Fortunately, I went into the UNIX world, working largely with Sun Solaris, the BSDs, Perl, and loads of Bash. I OJT'd under some truly stellar people, my favorite of whom has a HS education and knew more about UNIX and scripting than he had a right to know. He several like him were replaced by the aforementioned paper tigers in a layoff purge and the guys that came in were largely Indians and couldn't find their way around a terminal window to save their lives. These guys relied on GUIs alone and we were an enterprise-level Web hosting company that required tons of terminal, scripting, loads of Perl/CGI knowledge, as well as ability to build/configure/maintain UNIX servers. I miss those days. Now, everyone in IT save developers, project managers, and the odd IT security guy is a point and click monkey because everything has either been outsourced, insourced, is PaaS, SaaS, or now DaaS. I'm getting out of IT after more than 20 years. I love the essence of it, but I've had enough.
The fact is that thanks to Ambient Authority, nothing is safe, and can't be made safe. Anyone who works in infosec and thinks otherwise is nuts. The shitstorm is going to come, just hope it doesn't happen on your watch, or that you can deflect the blame enough to survive.