Careers & People

6/14/2018
03:10 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Demystifying Mental Health in the Infosec Community

Security experts talk about burnout, diversity, mental health, and legal issues in a new Community track at Black Hat USA.

Security experts at different companies find common ground in facing the same technical issues: too many alerts, not enough talent, and advanced attackers breaching basic defenses. But many also face the same nontechnical issues: burnout, mental health problems, legal problems, diversity, inclusion, attribution, work-life balance, substance abuse, and career challenges.

This year's Black Hat USA conference, which will take place Aug. 4 to 9 in Las Vegas, welcomes the addition of a new Community track created to shed light on these nontechnical topics. The idea is to open up a discussion of relevant issues affecting the infosec community alongside the usual technical talks.

In an industry as tiny and tight-knit as cyber, acknowledging nontechnical problems is just as important as unpuzzling technical ones. You (usually) see an alert when your systems are breached, but you rarely get the same red flag when a colleague is struggling with a mental condition.

Joe Slowik, adversary hunter at Dragos, says he was planning to submit another topic for his Black Hat talk before deciding to address the issue of post-traumatic stress disorder (PTSD) in cybersecurity during a session entitled "Demystifying PTSD in the Cybersecurity Environment."

He changed his mind after reading the article "Cybersecurity PTSD Affects Many Security Professionals." Its author had swapped "PTSD" for "Job Fatigue" following upset among readers, acknowledging the term was inappropriate. The crux of the article is about how the industrywide skills shortage puts pressure on security professionals, who suffer job fatigue due to long hours, high stress, and growing workloads as threats become more complex and companies can't afford to address them all.

Infosec pros are no strangers to stress, but for those who live with PTSD, use of the term seemed wrong. Slowik, who served in Afghanistan and suffered from medical trauma, is among those who feel that way. "We dance around topics like these without really understanding or addressing them," he explains. "Flippant references to the subject in the community struck me as an ill-informed moment."

The number of diagnosed cases of PTSD is increasing as a result of military service, sexual trauma, and other harrowing experiences, he says. At some point, you or someone you know may live with the condition. In his talk, Slowik will share the story of how PTSD has influenced his life and career in cybersecurity, which he describes as a "cognitive haven."

His idea is to provide a perspective on what the condition looks like and give people a better idea of how they can help co-workers, friends, and others across the security community who struggle. By keeping matters "light," he hopes to give people an opportunity to discuss these subjects while addressing how infosec pros can support PTSD survivors.

There are good and bad ways to approach the subject, he points out. When remarks come from people who understand, that's one thing. When they come from a place of ignorance, however, there's an opportunity to educate the speaker on mental conditions and their effects.

Slowik's Black Hat talk is one of many addressing the issue of mental health in the security community. Christian Dameff and Jay Radcliffe will address the serious and important topic of mental health risk factors during their session "Mental Health Hacks: Fighting Burnout Depression and Suicide in the Hacker Community."

Dameff, a hacker who works as an emergency medicine physician, and Radcliffe, a security researcher who has lived with mental health conditions, will discuss the pressures of high-stress jobs, abnormal sleep schedules, social depersonalization, and other risk factors contributing to substance abuse and suicide. Their idea is also to get rid of the stigma and talk about topics that people are reluctant to mention but are broadly important.

The Community track is packed with sessions related to how security professionals live and work. Other topics include cognitive stress, law and policy, autism, sexual harassment and assault, hiring and retaining female security engineers, and addiction.

Related Content:

 

Top industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Click for more information

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
SchemaCzar
50%
50%
SchemaCzar,
User Rank: Strategist
8/7/2018 | 9:01:51 PM
Moreover... lack of executive support
The "stress" part deserves further examination. I recently talked to a worker at a prominent Boston healthcare establishment where an executive refused to follow password management policy—no password complexity, no password *changes*!—exposing the entire institution to serious breaches.

We'll never have enough money for cybersecurity.  Let's be frank about that.  Like every other part of every organization, different groups want more money than they get.  But even worse, executives for a long time have not made organizational commitments to cybersecurity.  They let infosec pros write policies, but won't enforce them.  They hire well-connected dilettantes for CIOs and CISOs who provide poor leadership or, if the CISO is strong, the other execs freeze him/her out from actually implementing how things work.

Burnout?  Most cybersecurity pros keep on told to make bricks without straw, and know they'll be blamed when a big bad wolf blows the house down.  THAT is stress.
CD17
100%
0%
CD17,
User Rank: Author
6/19/2018 | 3:34:42 PM
Mental health
I'm happy to see issues of mental health getting more daylight. It's such an important topic, especially for a community like security that can be corrosive over time, dealing with bad things day after day. Burnout is a real problem. I'll be interested to hear how this track goes.
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
New Cold Boot Attack Gives Hackers the Keys to PCs, Macs
Kelly Sheridan, Staff Editor, Dark Reading,  9/13/2018
Turn the NIST Cybersecurity Framework into Reality: 4 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Surviving the IT Security Skills Shortage
Surviving the IT Security Skills Shortage
Cybersecurity professionals are in high demand -- and short supply. Find out what Dark Reading discovered during their 2017 Security Staffing Survey and get some strategies for getting through the drought. Download the report today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-1674
PUBLISHED: 2018-09-20
IBM Business Process Manager 8.5 through 8.6 and 18.0.0.0 through 18.0.0.1 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 145109.
CVE-2018-1800
PUBLISHED: 2018-09-20
IBM Sterling B2B Integrator Standard Edition 5.2.6.0 and 6.2.6.1 could allow a local user to obtain highly sensitive information during a short time period when installation is occuring. IBM X-Force ID: 149607.
CVE-2018-3864
PUBLISHED: 2018-09-20
An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy overflows the destination buffer, which has a size of 40 bytes. An attacker can send an arbitrarily long &quot...
CVE-2018-3865
PUBLISHED: 2018-09-20
An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy overflows the destination buffer, which has a size of 40 bytes. An attacker can send an arbitrarily long &quot...
CVE-2018-17254
PUBLISHED: 2018-09-20
The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter.