Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Careers & People

6/14/2018
03:10 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Demystifying Mental Health in the Infosec Community

Security experts talk about burnout, diversity, mental health, and legal issues in a new Community track at Black Hat USA.

Security experts at different companies find common ground in facing the same technical issues: too many alerts, not enough talent, and advanced attackers breaching basic defenses. But many also face the same nontechnical issues: burnout, mental health problems, legal problems, diversity, inclusion, attribution, work-life balance, substance abuse, and career challenges.

This year's Black Hat USA conference, which will take place Aug. 4 to 9 in Las Vegas, welcomes the addition of a new Community track created to shed light on these nontechnical topics. The idea is to open up a discussion of relevant issues affecting the infosec community alongside the usual technical talks.

In an industry as tiny and tight-knit as cyber, acknowledging nontechnical problems is just as important as unpuzzling technical ones. You (usually) see an alert when your systems are breached, but you rarely get the same red flag when a colleague is struggling with a mental condition.

Joe Slowik, adversary hunter at Dragos, says he was planning to submit another topic for his Black Hat talk before deciding to address the issue of post-traumatic stress disorder (PTSD) in cybersecurity during a session entitled "Demystifying PTSD in the Cybersecurity Environment."

He changed his mind after reading the article "Cybersecurity PTSD Affects Many Security Professionals." Its author had swapped "PTSD" for "Job Fatigue" following upset among readers, acknowledging the term was inappropriate. The crux of the article is about how the industrywide skills shortage puts pressure on security professionals, who suffer job fatigue due to long hours, high stress, and growing workloads as threats become more complex and companies can't afford to address them all.

Infosec pros are no strangers to stress, but for those who live with PTSD, use of the term seemed wrong. Slowik, who served in Afghanistan and suffered from medical trauma, is among those who feel that way. "We dance around topics like these without really understanding or addressing them," he explains. "Flippant references to the subject in the community struck me as an ill-informed moment."

The number of diagnosed cases of PTSD is increasing as a result of military service, sexual trauma, and other harrowing experiences, he says. At some point, you or someone you know may live with the condition. In his talk, Slowik will share the story of how PTSD has influenced his life and career in cybersecurity, which he describes as a "cognitive haven."

His idea is to provide a perspective on what the condition looks like and give people a better idea of how they can help co-workers, friends, and others across the security community who struggle. By keeping matters "light," he hopes to give people an opportunity to discuss these subjects while addressing how infosec pros can support PTSD survivors.

There are good and bad ways to approach the subject, he points out. When remarks come from people who understand, that's one thing. When they come from a place of ignorance, however, there's an opportunity to educate the speaker on mental conditions and their effects.

Slowik's Black Hat talk is one of many addressing the issue of mental health in the security community. Christian Dameff and Jay Radcliffe will address the serious and important topic of mental health risk factors during their session "Mental Health Hacks: Fighting Burnout Depression and Suicide in the Hacker Community."

Dameff, a hacker who works as an emergency medicine physician, and Radcliffe, a security researcher who has lived with mental health conditions, will discuss the pressures of high-stress jobs, abnormal sleep schedules, social depersonalization, and other risk factors contributing to substance abuse and suicide. Their idea is also to get rid of the stigma and talk about topics that people are reluctant to mention but are broadly important.

The Community track is packed with sessions related to how security professionals live and work. Other topics include cognitive stress, law and policy, autism, sexual harassment and assault, hiring and retaining female security engineers, and addiction.

Related Content:

 

Top industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Click for more information

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
CD17
100%
0%
CD17,
User Rank: Author
6/19/2018 | 3:34:42 PM
Mental health
I'm happy to see issues of mental health getting more daylight. It's such an important topic, especially for a community like security that can be corrosive over time, dealing with bad things day after day. Burnout is a real problem. I'll be interested to hear how this track goes.
SchemaCzar
50%
50%
SchemaCzar,
User Rank: Strategist
8/7/2018 | 9:01:51 PM
Moreover... lack of executive support
The "stress" part deserves further examination. I recently talked to a worker at a prominent Boston healthcare establishment where an executive refused to follow password management policy—no password complexity, no password *changes*!—exposing the entire institution to serious breaches.

We'll never have enough money for cybersecurity.  Let's be frank about that.  Like every other part of every organization, different groups want more money than they get.  But even worse, executives for a long time have not made organizational commitments to cybersecurity.  They let infosec pros write policies, but won't enforce them.  They hire well-connected dilettantes for CIOs and CISOs who provide poor leadership or, if the CISO is strong, the other execs freeze him/her out from actually implementing how things work.

Burnout?  Most cybersecurity pros keep on told to make bricks without straw, and know they'll be blamed when a big bad wolf blows the house down.  THAT is stress.
DavidHarris23
100%
0%
DavidHarris23,
User Rank: Apprentice
10/10/2020 | 2:31:08 PM
Mental health
I absolutely agree with previous post. Mental health have a great impact on ourselves, so it's inportant to pay more attention to it. Recently, I've started to learn about mental health of IT sector workers and try to find more info about psychology and mental health at all.
Overcoming the Challenge of Shorter Certificate Lifespans
Mike Cooper, Founder & CEO of Revocent,  10/15/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27605
PUBLISHED: 2020-10-21
BigBlueButton through 2.2.8 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject to attacks related to a "schwache Sandbox."
CVE-2020-27606
PUBLISHED: 2020-10-21
BigBlueButton before 2.2.8 (or earlier) does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
CVE-2020-27607
PUBLISHED: 2020-10-21
In BigBlueButton before 2.2.8 (or earlier), the client-side Mute button only signifies that the server should stop accepting audio data from the client. It does not directly configure the client to stop sending audio data to the server, and thus a modified server could store the audio data and/or tr...
CVE-2020-27608
PUBLISHED: 2020-10-21
In BigBlueButton before 2.2.8 (or earlier), uploaded presentations are sent to clients without a Content-Type header, which allows XSS, as demonstrated by a .png file extension for an HTML document.
CVE-2020-27609
PUBLISHED: 2020-10-21
BigBlueButton through 2.2.8 records a video meeting despite the deactivation of video recording in the user interface. This may result in data storage beyond what is authorized for a specific meeting topic or participant.