Cybersecurity's Insidious New Threat: Workforce Stress (technologyreview.com) 58
This week's Black Hat event will highlight job-related stress and mental health issues in the cyber workforce. From a report: The thousands of cybersecurity professionals gathering at Black Hat, a massive conference held in the blistering heat of Las Vegas every summer, are encountering a different type of session this year. A new "community" track is offering talks on a range of workplace issues facing defenders battling to protect the world from a hacking onslaught. With titles like "Mental Health Hacks: Fighting Burnout, Depression and Suicide in the Hacker Community" and "Holding on for Tonight: Addiction in Infosec," several of the sessions will address pressures on security teams and the negative impact these can have on workers' wellbeing.
"A lot of people in this space feel strongly about wanting to protect their users," says Jamie Tomasello of Duo Security, who is one of the speakers. "Where this becomes challenging is when people are under sustained high stress. That increases the risk of depression and mental illness." The impact on cyber defenders' lives is deeply concerning, as are the broader implications for security. In spite of a push for greater automation, many tasks in cyber defense are still labor intensive. Workers experiencing mental health issues are more likely to make mistakes and to have performance issues that require colleagues to pick up the slack, increasing the likelihood they will make errors too.
"A lot of people in this space feel strongly about wanting to protect their users," says Jamie Tomasello of Duo Security, who is one of the speakers. "Where this becomes challenging is when people are under sustained high stress. That increases the risk of depression and mental illness." The impact on cyber defenders' lives is deeply concerning, as are the broader implications for security. In spite of a push for greater automation, many tasks in cyber defense are still labor intensive. Workers experiencing mental health issues are more likely to make mistakes and to have performance issues that require colleagues to pick up the slack, increasing the likelihood they will make errors too.
What does the word "hack" even mean now? (Score:2, Redundant)
It means the same thing it always did (Score:2)
Re: (Score:2)
Re: (Score:2)
I agree - a hack is an elegant solution to an old problem - since securing IT is an old problem a hack gets around controls - fits perfectly
That's the exact opposite of what a hack is. A hack is an inelegant shit solution to a problem. Hacks are defined by the absolute lack of skill on the part of their creator, be it in sloppy code to get something hacked together quickly and barely functional with no potential for future adaptation or someone so pathetic they take the easy route of breaking stuff instead of creating things. Hacks are by definition inelegant abominations.
Re: (Score:2)
Re: (Score:2)
Hacking is breaking something up, like hacking up a tree. Hacking is breaking the code so I can get access.
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
The word "hack" applied to computers and electronics is an analogy to using a hacksaw to a table leg, hence the name.
Therefore, it is indeed about a quick and simple solution to a problem.
If it should be considered elegant or not to cut the table's other leg shorter to make it less wobbly ... that's anyone's opinion.
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Hacking away at a tree. It's to break something up. Or break through something.
Re: (Score:1)
What have we learned today?
That English majors don't know dick about computer jargon (or much else.)
Comment removed (Score:5, Insightful)
Re: (Score:1, Funny)
No revenge? Your story lacks Shakespearean arc, 3/10 stars.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
I became so jaded eventually that my job morphed from protecting users from malicious actors, to just keeping a running CYA log of poor leadership decisions and whom to attribute them to when the shit hit the fan. no hardened binaries? no standardized two factor? no problem. Just dont expect me to sit quietly in the meeting.
Clueless developers and always getting, "it's too expensive" are what we have to deal with around here. All you can do is the best you can with the resources you have, and make sure keep a record of every stupid order you get from above. Every once in a blue moon, explicitly demanding something in writing (in writing) is enough to make management think twice, because most of them can smell a buck pass from miles away.
Unfortunately, actually getting compromised is about the only way to get the money you need
Re: (Score:2)
> keeping a running CYA log of poor leadership decisions and whom to attribute them to when the shit hit the fan.
abso-bloody-lutely!
I just wanted to thank you for that rant which resonated pretty strongly...
It's just over work (Score:5, Interesting)
Re: (Score:2)
Re: (Score:3)
In my experience, the "feeling of entitlement" is much more true of managers than of those they manage, and this differential is maintained at every level of the hierarchy.
The old way of describing this is "the servant problem".
InfoSec is not stress unless you're doing it wrong (Score:2)
Re: (Score:2)
It can also be pretty stressful if you are an outside consultant being brought in after others have done it wrong for some time. I do agree that management is the main root-cause of the problems in almost all cases though.
Jack Daniel has a great keynote on this (Score:2)
Re: (Score:3)
A lecture about drinking presented by Jack Daniel? :-|
The response for stress in IT Security isn't any different than those in other high-stress careers like Fire. EMS, or Law Enforcement, but the local peer support group is much smaller in the IT field. If a firefighter has bad EMS or fire call, I have 30 guys in my own station that are going through or have went through the same thing. How many people in your organization can emphasize with your IT security stress?
Source: Firefighter/EMT with 28 years
Re: (Score:2)
Blistering heat? (Score:2)
110 with ~10% humidity is much preferable than 90 with 65% humidity.
Perhaps not wearing black in the sun might help.
waiting to fail is always stressful (Score:2)
The fact is that thanks to Ambient Authority, nothing is safe, and can't be made safe. Anyone who works in infosec and thinks otherwise is nuts. The shitstorm is going to come, just hope it doesn't happen on your watch, or that you can deflect the blame enough to survive.