Careers & People

6/14/2018
03:10 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Demystifying Mental Health in the Infosec Community

Security experts talk about burnout, diversity, mental health, and legal issues in a new Community track at Black Hat USA.

Security experts at different companies find common ground in facing the same technical issues: too many alerts, not enough talent, and advanced attackers breaching basic defenses. But many also face the same nontechnical issues: burnout, mental health problems, legal problems, diversity, inclusion, attribution, work-life balance, substance abuse, and career challenges.

This year's Black Hat USA conference, which will take place Aug. 4 to 9 in Las Vegas, welcomes the addition of a new Community track created to shed light on these nontechnical topics. The idea is to open up a discussion of relevant issues affecting the infosec community alongside the usual technical talks.

In an industry as tiny and tight-knit as cyber, acknowledging nontechnical problems is just as important as unpuzzling technical ones. You (usually) see an alert when your systems are breached, but you rarely get the same red flag when a colleague is struggling with a mental condition.

Joe Slowik, adversary hunter at Dragos, says he was planning to submit another topic for his Black Hat talk before deciding to address the issue of post-traumatic stress disorder (PTSD) in cybersecurity during a session entitled "Demystifying PTSD in the Cybersecurity Environment."

He changed his mind after reading the article "Cybersecurity PTSD Affects Many Security Professionals." Its author had swapped "PTSD" for "Job Fatigue" following upset among readers, acknowledging the term was inappropriate. The crux of the article is about how the industrywide skills shortage puts pressure on security professionals, who suffer job fatigue due to long hours, high stress, and growing workloads as threats become more complex and companies can't afford to address them all.

Infosec pros are no strangers to stress, but for those who live with PTSD, use of the term seemed wrong. Slowik, who served in Afghanistan and suffered from medical trauma, is among those who feel that way. "We dance around topics like these without really understanding or addressing them," he explains. "Flippant references to the subject in the community struck me as an ill-informed moment."

The number of diagnosed cases of PTSD is increasing as a result of military service, sexual trauma, and other harrowing experiences, he says. At some point, you or someone you know may live with the condition. In his talk, Slowik will share the story of how PTSD has influenced his life and career in cybersecurity, which he describes as a "cognitive haven."

His idea is to provide a perspective on what the condition looks like and give people a better idea of how they can help co-workers, friends, and others across the security community who struggle. By keeping matters "light," he hopes to give people an opportunity to discuss these subjects while addressing how infosec pros can support PTSD survivors.

There are good and bad ways to approach the subject, he points out. When remarks come from people who understand, that's one thing. When they come from a place of ignorance, however, there's an opportunity to educate the speaker on mental conditions and their effects.

Slowik's Black Hat talk is one of many addressing the issue of mental health in the security community. Christian Dameff and Jay Radcliffe will address the serious and important topic of mental health risk factors during their session "Mental Health Hacks: Fighting Burnout Depression and Suicide in the Hacker Community."

Dameff, a hacker who works as an emergency medicine physician, and Radcliffe, a security researcher who has lived with mental health conditions, will discuss the pressures of high-stress jobs, abnormal sleep schedules, social depersonalization, and other risk factors contributing to substance abuse and suicide. Their idea is also to get rid of the stigma and talk about topics that people are reluctant to mention but are broadly important.

The Community track is packed with sessions related to how security professionals live and work. Other topics include cognitive stress, law and policy, autism, sexual harassment and assault, hiring and retaining female security engineers, and addiction.

Related Content:

 

Top industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Click for more information

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
SchemaCzar
50%
50%
SchemaCzar,
User Rank: Strategist
8/7/2018 | 9:01:51 PM
Moreover... lack of executive support
The "stress" part deserves further examination. I recently talked to a worker at a prominent Boston healthcare establishment where an executive refused to follow password management policy—no password complexity, no password *changes*!—exposing the entire institution to serious breaches.

We'll never have enough money for cybersecurity.  Let's be frank about that.  Like every other part of every organization, different groups want more money than they get.  But even worse, executives for a long time have not made organizational commitments to cybersecurity.  They let infosec pros write policies, but won't enforce them.  They hire well-connected dilettantes for CIOs and CISOs who provide poor leadership or, if the CISO is strong, the other execs freeze him/her out from actually implementing how things work.

Burnout?  Most cybersecurity pros keep on told to make bricks without straw, and know they'll be blamed when a big bad wolf blows the house down.  THAT is stress.
CD17
100%
0%
CD17,
User Rank: Author
6/19/2018 | 3:34:42 PM
Mental health
I'm happy to see issues of mental health getting more daylight. It's such an important topic, especially for a community like security that can be corrosive over time, dealing with bad things day after day. Burnout is a real problem. I'll be interested to hear how this track goes.
It Takes an Average of 3 to 6 Months to Fill a Cybersecurity Job
Kelly Jackson Higgins, Executive Editor at Dark Reading,  3/12/2019
Cybercriminals Think Small to Earn Big
Dark Reading Staff 3/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: LOL  Hope this one wins
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6149
PUBLISHED: 2019-03-18
An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges.
CVE-2018-15509
PUBLISHED: 2019-03-18
Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
CVE-2018-20806
PUBLISHED: 2019-03-17
Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
CVE-2019-5616
PUBLISHED: 2019-03-15
CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser.
CVE-2018-17882
PUBLISHED: 2019-03-15
An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user.