Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Careers & People

6/14/2018
03:10 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Demystifying Mental Health in the Infosec Community

Security experts talk about burnout, diversity, mental health, and legal issues in a new Community track at Black Hat USA.

Security experts at different companies find common ground in facing the same technical issues: too many alerts, not enough talent, and advanced attackers breaching basic defenses. But many also face the same nontechnical issues: burnout, mental health problems, legal problems, diversity, inclusion, attribution, work-life balance, substance abuse, and career challenges.

This year's Black Hat USA conference, which will take place Aug. 4 to 9 in Las Vegas, welcomes the addition of a new Community track created to shed light on these nontechnical topics. The idea is to open up a discussion of relevant issues affecting the infosec community alongside the usual technical talks.

In an industry as tiny and tight-knit as cyber, acknowledging nontechnical problems is just as important as unpuzzling technical ones. You (usually) see an alert when your systems are breached, but you rarely get the same red flag when a colleague is struggling with a mental condition.

Joe Slowik, adversary hunter at Dragos, says he was planning to submit another topic for his Black Hat talk before deciding to address the issue of post-traumatic stress disorder (PTSD) in cybersecurity during a session entitled "Demystifying PTSD in the Cybersecurity Environment."

He changed his mind after reading the article "Cybersecurity PTSD Affects Many Security Professionals." Its author had swapped "PTSD" for "Job Fatigue" following upset among readers, acknowledging the term was inappropriate. The crux of the article is about how the industrywide skills shortage puts pressure on security professionals, who suffer job fatigue due to long hours, high stress, and growing workloads as threats become more complex and companies can't afford to address them all.

Infosec pros are no strangers to stress, but for those who live with PTSD, use of the term seemed wrong. Slowik, who served in Afghanistan and suffered from medical trauma, is among those who feel that way. "We dance around topics like these without really understanding or addressing them," he explains. "Flippant references to the subject in the community struck me as an ill-informed moment."

The number of diagnosed cases of PTSD is increasing as a result of military service, sexual trauma, and other harrowing experiences, he says. At some point, you or someone you know may live with the condition. In his talk, Slowik will share the story of how PTSD has influenced his life and career in cybersecurity, which he describes as a "cognitive haven."

His idea is to provide a perspective on what the condition looks like and give people a better idea of how they can help co-workers, friends, and others across the security community who struggle. By keeping matters "light," he hopes to give people an opportunity to discuss these subjects while addressing how infosec pros can support PTSD survivors.

There are good and bad ways to approach the subject, he points out. When remarks come from people who understand, that's one thing. When they come from a place of ignorance, however, there's an opportunity to educate the speaker on mental conditions and their effects.

Slowik's Black Hat talk is one of many addressing the issue of mental health in the security community. Christian Dameff and Jay Radcliffe will address the serious and important topic of mental health risk factors during their session "Mental Health Hacks: Fighting Burnout Depression and Suicide in the Hacker Community."

Dameff, a hacker who works as an emergency medicine physician, and Radcliffe, a security researcher who has lived with mental health conditions, will discuss the pressures of high-stress jobs, abnormal sleep schedules, social depersonalization, and other risk factors contributing to substance abuse and suicide. Their idea is also to get rid of the stigma and talk about topics that people are reluctant to mention but are broadly important.

The Community track is packed with sessions related to how security professionals live and work. Other topics include cognitive stress, law and policy, autism, sexual harassment and assault, hiring and retaining female security engineers, and addiction.

Related Content:

 

Top industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Click for more information

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Frank Sterle Jr.
50%
50%
Frank Sterle Jr.,
User Rank: Apprentice
2/18/2021 | 5:09:14 PM
Mental illness still not taken seriously enough
 

Although progress is being made on this front, for me there is still too much platitudinous lip-service towards proactive mental illness prevention as well as treatment.

And mental healthcare needs to be as universally covered as is physical care.                           

When it comes to the social reality of (at least for the foreseeable future) the prevalence of mental illness I'm often left frustrated by the contradictory proclamations and conduct coming from one of the seven pillars of our supposedly enlightened culture—the media, or more specifically that of entertainment and news.                         

They'll state the obvious—that society must open up its collective minds and common dialogue when it comes to far more progressively addressing the real challenge of more fruitfully treating and preventing such illness. After all, its social ramifications exist all around us; indeed, it's suffered by people of whom we are aware and familiar, and/or even more so to whom so many of us are related to some degree or another.                            

This most commonly occurs when a greatly endeared celebrity passes away or dies an untimely death. This fact was in particular exemplified immediately following the many predictable platitudinous sound bites and mini-memorial commentaries from the late actor/comedian Robin Williams' contemporaries as well as in many newspaper letters and editorials following his tragic suicide.
DavidHarris23
100%
0%
DavidHarris23,
User Rank: Apprentice
10/10/2020 | 2:31:08 PM
Mental health
I absolutely agree with previous post. Mental health have a great impact on ourselves, so it's inportant to pay more attention to it. Recently, I've started to learn about mental health of IT sector workers and try to find more info about psychology and mental health at all.
SchemaCzar
50%
50%
SchemaCzar,
User Rank: Strategist
8/7/2018 | 9:01:51 PM
Moreover... lack of executive support
The "stress" part deserves further examination. I recently talked to a worker at a prominent Boston healthcare establishment where an executive refused to follow password management policy—no password complexity, no password *changes*!—exposing the entire institution to serious breaches.

We'll never have enough money for cybersecurity.  Let's be frank about that.  Like every other part of every organization, different groups want more money than they get.  But even worse, executives for a long time have not made organizational commitments to cybersecurity.  They let infosec pros write policies, but won't enforce them.  They hire well-connected dilettantes for CIOs and CISOs who provide poor leadership or, if the CISO is strong, the other execs freeze him/her out from actually implementing how things work.

Burnout?  Most cybersecurity pros keep on told to make bricks without straw, and know they'll be blamed when a big bad wolf blows the house down.  THAT is stress.
CD17
100%
0%
CD17,
User Rank: Author
6/19/2018 | 3:34:42 PM
Mental health
I'm happy to see issues of mental health getting more daylight. It's such an important topic, especially for a community like security that can be corrosive over time, dealing with bad things day after day. Burnout is a real problem. I'll be interested to hear how this track goes.
Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-24913
PUBLISHED: 2021-03-04
A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.
CVE-2020-24914
PUBLISHED: 2021-03-04
A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request.
CVE-2020-24036
PUBLISHED: 2021-03-04
PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code.
CVE-2020-24912
PUBLISHED: 2021-03-04
A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.
CVE-2019-18629
PUBLISHED: 2021-03-04
Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200 allow an attacker to execute an unwanted binary during a exploited clone install. This requires creating a clone file and signing that file with a com...