Cybersecurity's Insidious New Threat: Workforce Stress (technologyreview.com)

This week's Black Hat event will highlight job-related stress and mental health issues in the cyber workforce. From a report: The thousands of cybersecurity professionals gathering at Black Hat, a massive conference held in the blistering heat of Las Vegas every summer, are encountering a different type of session this year. A new "community" track is offering talks on a range of workplace issues facing defenders battling to protect the world from a hacking onslaught. With titles like "Mental Health Hacks: Fighting Burnout, Depression and Suicide in the Hacker Community" and "Holding on for Tonight: Addiction in Infosec," several of the sessions will address pressures on security teams and the negative impact these can have on workers' wellbeing.

"A lot of people in this space feel strongly about wanting to protect their users," says Jamie Tomasello of Duo Security, who is one of the speakers. "Where this becomes challenging is when people are under sustained high stress. That increases the risk of depression and mental illness." The impact on cyber defenders' lives is deeply concerning, as are the broader implications for security. In spite of a push for greater automation, many tasks in cyber defense are still labor intensive. Workers experiencing mental health issues are more likely to make mistakes and to have performance issues that require colleagues to pick up the slack, increasing the likelihood they will make errors too.

Comments

its always been a problem

[nimbius]

disclosure: I left infosec for the relatively calmer career path of system administration.
infosec is under enormous pressure to deliver a product that cant be hacked, and take the blame for when products are hacked. Developers routinely leapfrog infosec for exceptions to upgrades or coding standards and when theyre caught with their pants around their ankles theres no accountability, only blame. 'IS director' is a revolving door of burnouts that are exhausted from the constant assault and bettery from sales insisting every credit card is a good credit card, and managers insisting you need to stand down from every product meeting or just not attend at all because it somehow negatively affects 'agility.'

I became so jaded eventually that my job morphed from protecting users from malicious actors, to just keeping a running CYA log of poor leadership decisions and whom to attribute them to when the shit hit the fan. no hardened binaries? no standardized two factor? no problem. Just dont expect me to sit quietly in the meeting.

Re:its always been a problem

[eth1]

I became so jaded eventually that my job morphed from protecting users from malicious actors, to just keeping a running CYA log of poor leadership decisions and whom to attribute them to when the shit hit the fan. no hardened binaries? no standardized two factor? no problem. Just dont expect me to sit quietly in the meeting.

Clueless developers and always getting, "it's too expensive" are what we have to deal with around here. All you can do is the best you can with the resources you have, and make sure keep a record of every stupid order you get from above. Every once in a blue moon, explicitly demanding something in writing (in writing) is enough to make management think twice, because most of them can smell a buck pass from miles away.

Unfortunately, actually getting compromised is about the only way to get the money you need to do anything. My coworkers and I have jokingly said we could best secure the company by hacking it ourselves just to scare management before someone else does... They won't pay for MDM? Start bringing in phones infected with the "Email the CEO's browsing history to everyone" worm. "Well, we brought this risk to your attention last year, but you said there was no money..."

It's just over work

[rsilvergun]

and it's happening everywhere. Companies are cutting staff and forcing the ones left to work longer hours. 80% of Americans are living paycheck-to-paycheck (google it). _Everybody's_ stressed out. It's just that when your cyber security guys get that way and start making the mistakes folks under high pressure 24/7 tend to do then your network gets hacked and you've got a PR disaster on your hands.

Jack Daniel has a great keynote on this

[pierceelevated]

Check out his analysis and stories of incredible alcohol consumption at security conferences: http://www.irongeek.com/i.php?...

Re:Jack Daniel has a great keynote on this

[cavis]

A lecture about drinking presented by Jack Daniel? :-|

The response for stress in IT Security isn't any different than those in other high-stress careers like Fire. EMS, or Law Enforcement, but the local peer support group is much smaller in the IT field. If a firefighter has bad EMS or fire call, I have 30 guys in my own station that are going through or have went through the same thing. How many people in your organization can emphasize with your IT security stress?

Source: Firefighter/EMT with 28 years of experience.

Re:Jack Daniel has a great keynote on this

[wyHunter]

I'm a volunteer EMS and Fire Guy. Do you know what an EMT makes? $10 OR LESS for the most part. No thanks, I'll keep cranking code.

Re:It means the same thing it always did

[NicknameUnavailable]

I agree - a hack is an elegant solution to an old problem - since securing IT is an old problem a hack gets around controls - fits perfectly

That's the exact opposite of what a hack is. A hack is an inelegant shit solution to a problem. Hacks are defined by the absolute lack of skill on the part of their creator, be it in sloppy code to get something hacked together quickly and barely functional with no potential for future adaptation or someone so pathetic they take the easy route of breaking stuff instead of creating things. Hacks are by definition inelegant abominations.

Re:It means the same thing it always did

[ole_timer]

you're thinking of a kludge - see "The Soul of a New Machine" by Tracy Kidder...

Re:Place the blame where it should be...

[HiThere]

In my experience, the "feeling of entitlement" is much more true of managers than of those they manage, and this differential is maintained at every level of the hierarchy.

The old way of describing this is "the servant problem".