Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Careers & People

6/14/2018
03:10 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Demystifying Mental Health in the Infosec Community

Security experts talk about burnout, diversity, mental health, and legal issues in a new Community track at Black Hat USA.

Security experts at different companies find common ground in facing the same technical issues: too many alerts, not enough talent, and advanced attackers breaching basic defenses. But many also face the same nontechnical issues: burnout, mental health problems, legal problems, diversity, inclusion, attribution, work-life balance, substance abuse, and career challenges.

This year's Black Hat USA conference, which will take place Aug. 4 to 9 in Las Vegas, welcomes the addition of a new Community track created to shed light on these nontechnical topics. The idea is to open up a discussion of relevant issues affecting the infosec community alongside the usual technical talks.

In an industry as tiny and tight-knit as cyber, acknowledging nontechnical problems is just as important as unpuzzling technical ones. You (usually) see an alert when your systems are breached, but you rarely get the same red flag when a colleague is struggling with a mental condition.

Joe Slowik, adversary hunter at Dragos, says he was planning to submit another topic for his Black Hat talk before deciding to address the issue of post-traumatic stress disorder (PTSD) in cybersecurity during a session entitled "Demystifying PTSD in the Cybersecurity Environment."

He changed his mind after reading the article "Cybersecurity PTSD Affects Many Security Professionals." Its author had swapped "PTSD" for "Job Fatigue" following upset among readers, acknowledging the term was inappropriate. The crux of the article is about how the industrywide skills shortage puts pressure on security professionals, who suffer job fatigue due to long hours, high stress, and growing workloads as threats become more complex and companies can't afford to address them all.

Infosec pros are no strangers to stress, but for those who live with PTSD, use of the term seemed wrong. Slowik, who served in Afghanistan and suffered from medical trauma, is among those who feel that way. "We dance around topics like these without really understanding or addressing them," he explains. "Flippant references to the subject in the community struck me as an ill-informed moment."

The number of diagnosed cases of PTSD is increasing as a result of military service, sexual trauma, and other harrowing experiences, he says. At some point, you or someone you know may live with the condition. In his talk, Slowik will share the story of how PTSD has influenced his life and career in cybersecurity, which he describes as a "cognitive haven."

His idea is to provide a perspective on what the condition looks like and give people a better idea of how they can help co-workers, friends, and others across the security community who struggle. By keeping matters "light," he hopes to give people an opportunity to discuss these subjects while addressing how infosec pros can support PTSD survivors.

There are good and bad ways to approach the subject, he points out. When remarks come from people who understand, that's one thing. When they come from a place of ignorance, however, there's an opportunity to educate the speaker on mental conditions and their effects.

Slowik's Black Hat talk is one of many addressing the issue of mental health in the security community. Christian Dameff and Jay Radcliffe will address the serious and important topic of mental health risk factors during their session "Mental Health Hacks: Fighting Burnout Depression and Suicide in the Hacker Community."

Dameff, a hacker who works as an emergency medicine physician, and Radcliffe, a security researcher who has lived with mental health conditions, will discuss the pressures of high-stress jobs, abnormal sleep schedules, social depersonalization, and other risk factors contributing to substance abuse and suicide. Their idea is also to get rid of the stigma and talk about topics that people are reluctant to mention but are broadly important.

The Community track is packed with sessions related to how security professionals live and work. Other topics include cognitive stress, law and policy, autism, sexual harassment and assault, hiring and retaining female security engineers, and addiction.

Related Content:

 

Top industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Click for more information

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DavidHarris23
100%
0%
DavidHarris23,
User Rank: Apprentice
10/10/2020 | 2:31:08 PM
Mental health
I absolutely agree with previous post. Mental health have a great impact on ourselves, so it's inportant to pay more attention to it. Recently, I've started to learn about mental health of IT sector workers and try to find more info about psychology and mental health at all.
SchemaCzar
50%
50%
SchemaCzar,
User Rank: Strategist
8/7/2018 | 9:01:51 PM
Moreover... lack of executive support
The "stress" part deserves further examination. I recently talked to a worker at a prominent Boston healthcare establishment where an executive refused to follow password management policy—no password complexity, no password *changes*!—exposing the entire institution to serious breaches.

We'll never have enough money for cybersecurity.  Let's be frank about that.  Like every other part of every organization, different groups want more money than they get.  But even worse, executives for a long time have not made organizational commitments to cybersecurity.  They let infosec pros write policies, but won't enforce them.  They hire well-connected dilettantes for CIOs and CISOs who provide poor leadership or, if the CISO is strong, the other execs freeze him/her out from actually implementing how things work.

Burnout?  Most cybersecurity pros keep on told to make bricks without straw, and know they'll be blamed when a big bad wolf blows the house down.  THAT is stress.
CD17
100%
0%
CD17,
User Rank: Author
6/19/2018 | 3:34:42 PM
Mental health
I'm happy to see issues of mental health getting more daylight. It's such an important topic, especially for a community like security that can be corrosive over time, dealing with bad things day after day. Burnout is a real problem. I'll be interested to hear how this track goes.
When It Comes To Security Tools, More Isn't More
Lamont Orange, Chief Information Security Officer at Netskope,  1/11/2021
US Capitol Attack a Wake-up Call for the Integration of Physical & IT Security
Seth Rosenblatt, Contributing Writer,  1/11/2021
IoT Vendor Ubiquiti Suffers Data Breach
Dark Reading Staff 1/11/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25533
PUBLISHED: 2021-01-15
An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch daemon. The privileged service improperly validated XPC connections by relying on the PID instead of the audit token. An attacker can construct ...
CVE-2021-3162
PUBLISHED: 2021-01-15
Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.
CVE-2021-21242
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the `Attachment-Support` header. This Servlet does not enforce any authentication or a...
CVE-2021-21245
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary file upload which can be used to u...
CVE-2021-21246
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only administrators can list user details. However for the `/users/` endpoint there are no security checks enforced so it is possible to retrieve ar...