06 - Throwing gasoline on the fire: The causes and impact of stress and burnout in cybersecurity

Okay, thank you for the introduction. Uh, yeah, um, I've been in the field 25 years. I've seen stress. I've seen burnout. Uh, I thought it was very important to discuss it because it's something people don't discuss. Quick show of hands, how many people here in the room right now either A are still in school or B have just started in the last 2 years in the field? Quick show of hands. Yeah, a few of you. Okay, and then how many of you are team leads or managers? Show of hands. Yes, you guys should pay attention as well. Please. Um, cuz it's not just you that gets impacted, right? It's it's your team. Uh, so yeah, who am I? Well, actually before

we do that, let's do the uh, Okay, that's a cool picture. I like that one. What are we going to talk about today? Well, we're going to define what we mean by stress and burnout first off. Then we're going to discuss whether it's actually a problem and you can see some interesting statistics. We're going to talk somewhat about the causes of stress and burnout and then what we can do about it and then actually future research areas, things that could probably be looked into. Um, this uh, presentation actually came about, well, actually let's go to the next slide. Who am I? I am currently doing a doctorate in cybersecurity at City University of Seattle. Although I

live in Toronto, the commute is really interesting. Uh, I'm doing it remote and I'm also teaching there. Uh, one of the things that I was doing, I had to find a topic for my dissertation. This is one of the areas I looked at but discarded. Not because it wasn't an interesting area, but because I found a different area that I thought was more interesting. Uh, so this research is kind of building on what I was doing when I was first uh, finding a topic for my dissertation. So this is all based in the literature. This is based in actual fact. This is probably going to be a little bit different. It's definitely very different from the previous

presentation. I'm not hacking anybody's brain here. Uh, but it's something that we should all be aware of, definitely. So, I've been working in the field in cybersecurity and audit roles uh for 25 years now, which is something I try not to think about too much. I swear 1989 was yesterday. Or at least last week, I don't know. Um years go by. I have a master's degree from Western Governors University in cybersecurity and information assurance, I think it's called. And I'm like I said, I'm working on my doctorate. Uh I finished the coursework and I'm currently writing my dissertation on a completely different area from this presentation. It's actually on cybersecurity competitions. Um I'm also teaching part-time at uh City

U, uh which is what we call City University of Seattle. Uh I teach, again, in cybersecurity. And I am not a medical professional. I do not even play one on TV. None of this is medical advice. But, it's trying to open that conversation up as uh as you said, you know, we we seen people that we've lost in the community. I've seen people get burned out. I saw somebody who basically left the field to become a baker. Um which is a very radical career change, needless to say. So, what do we mean when we talk about stress? Well, stress is actually something perfectly normal. It is a normal bodily response to external or internal challenges,

particularly when the demands that you're perceiving exceed what you believe is your ability to cope, which triggers what's called an autonomic hormonal response. In other words, you don't have any control over it. Stress is something that happens to you, and then your body goes, "Hey, uh we're under stress. So, I'm going to release all these hormones." Um your body's autonomic nervous system is the one that controls your heart rate, your breathing, your vision, and a whole lot more. Uh the built-in stress response that everybody has, which we often call fight or flight, helps your body face stressful situations. So, like for example, if a I don't know, a a big vicious dog suddenly lunges out of the bushes at you

and your heart races and all these other physiological changes happen cuz you're facing an immediate stress, right? The stress being a giant dog. When you have long-term or chronic stress, um this happens over a long period of time. You get these hormones flooding your system over a long period of time, and that is just not good. Uh continued activation of the stress response causes wear and tear on your body in a very severe way. You can develop stress symptoms that are physical, psychological, or behavioral. So, for example, uh physical, you could end up with high blood pressure um as a common one. Uh stress has been implicated in the middle-age spread as people get bigger down here, right? Um

some of the hormone responses cause you to uh build up extra fat in the midriff. Uh it can be psychological. Uh you know, we're going to be talking today about burnout, for example. It can be behavioral. You can become short-tempered. Right? These are all normal responses to long-term or chronic stress and having these hormones just always flooding your uh system. So, the slide says we've got three kinds of stress. Acute is just something's happened, it's stressful, you get over it, you move on. Then we get episodic acute, which is yep, uh you're experiencing a stress, the stress ends, but before you completely recover from it, another one comes up, and then another one, and then

another one, and then another one. Um like, you know, tests at school, for example. And then chronic is long-term stress, weeks, months, years of living with stress. And as I mentioned before, these can be uh mental, physical, or behavioral issues. So, that's stress. Um long-term stress can weaken immunity, increased risk of heart disease, uh and various other uh issues. Long-term stress is not good for you. The other thing we're talking about today is burnout. What is burnout? Burnout is what happens when you take stress to the extreme. It is, uh a state of emotional, mental, and physical exhaustion caused by prolonged, unmanaged stress, usually work-related, to the point that the World Health Organization recognizes that burnout is

an occupational phenomena. Nobody gets burned out from, I don't know, being chased by dogs. Um, we get burned out at work, or or from work. Right? Uh, again, the symptoms include exhaustion, uh, both physical and mental. You know, you just you you you drag yourself out of bed in the morning, you drag yourself to bed in the evening, you don't care about anything. Cynicism, uh, and cynicism is already pretty prevalent in this field, I think. So, you know, to to say cynicism, everybody's going, "Yeah, well, what else is news?" Um, difficulty in concentrating. Hm. I won't I won't ask anybody here by asking what percentage of the room has ADHD, but, you know, this isn't help

that. Uh, and then reduced reduced motivation and defect efficacy, which means, you know, how well you do your job basically. It can lead to increased mistakes, reduced productivity, disengagement. Basically, if you're a boss, you should be concerned about your employees getting burned out, because they're not going to be as effective. And if you are experiencing burnout, you should be concerned, because, well, life just isn't fun anymore. It kind of all of the joy is kind of sapped out of your life, um, when you're experiencing burnout. Even things that used to be fun for you, like uh yeah, I know, I know it's my favorite series in the whole world, and there's new episodes, but I don't want to watch

them. I know that's the new Marvel movie that's coming out, but nah, I can't get out of bed. Right? Burnout taken to the extreme disrupts your life very badly. So, we should be able to recognize it and um hopefully treat it or seek treatment for it. How do we measure burnout? Is the next question. Well, there is actually a way we do this. It's called the Maslach Burnout Inventory or MBI. This has three scales. Uh emotional exhaustion, cynicism, that goes back to you know, hello cybersecurity. And then personal accomplishment. And the interesting thing is these three scales they're independent. Two of them the first two, if you score higher on them, you're more burned out. The third

one, if you score higher on it, you're less burned out. So, it's kind of two in one direction, one in the other. It's interesting. Uh the way we measure it uh we use what's called a Likert-type scale. So, Likert-type scale is any scale that goes from like never to always and has a range of numbers in between. That's what we mean when we talk about a Likert scale. So, we measure these each of these 16 questions using a Likert-type scale. Questions like I doubt the significance of my work. Again, that's the cynicism dimension, right? Uh now, there is criticism. Uh I love this quote. "The MBI is neither grounded in firm clinical observation nor based on sound

theorizing. Instead, it has been developed inductively by factor analyzing a rather arbitrary set of items." And yet, even though that criticism was 23 years ago, if you do any research at all on burnout, it's all MBI. So, yeah, we we recognize that it's flawed, but we don't have any other tools, basically, is what it amounts to. Now, there are field-specific versions of MBI for things like uh medical staff and educators. Otherwise, there's what's called the MBI General Survey or MBI-GS. So, let's define these three scales. Exhaustion, feelings of being emotionally overextended and being depleted. Like you just you know, you're you feel gray, you feel zeroed out, basically. Cynicism, indifference or a distant attitude towards work more so than usual

for some of us. Sometimes called depersonalization as well. And then professional efficacy or personal accomplishment is do you feel a sense of competence and achievement at work? Basically, do you think that you're doing a good job? And this is key. So, we get the I should say we get these three subscores. Uh One switch to mention, yeah, mentioned how two of them measure greater burnout, one so shows less burnout. If you want to do any research using MBI, somebody actually has the copyright for that and you have to pay them, which is kind of annoying. Um so, that was one of the reasons I didn't choose that for my dissertation topic is because I didn't want to have

to pay somebody. I'm already paying enough for my education. I don't want to have to pay more for my dissertation. Right, I've got the clicker. Let's use that. Come on, clicky click. Uh what is going on here? I think I clicked on something I shouldn't have. There we go. All right. So, I mentioned before we have actual numbers. Um when I was researching this for my potential dissertation topic, I had to do literature review. So, had to go dive into literature and see what was out there. Turns out this is actually a reasonably well-studied area. There are still some research questions that I'll come back to at the end, but there are a lot of

things that we could be researching in this area. Or a lot of things we know in this area, rather. 90% of CISOs would take a pay cut if it meant less stress. Cool. Uh 28% of those CISOs reported impeded performance due to high stress, and 17% of them reported that they were medicating or using alcohol to cope. Okay. Um, that's at the CISO level. At the other end of the scale, um, the front lines, 67% of cyber incident responders experience stress or anxiety in their daily lives outside of work due to responding to cyber incidents and nearly 65% have sought mental health assistance. That's according to an IBM study from 2022. In another slightly more recent study

from 2024, it was a small study, total of 35 people surveyed, but more than half of them, 19, 54%, of incident responders reported symptoms of burnout. Uh, research have cannot speak English today, sorry. Researchers have also found stress levels in cybersecurity workers can approach those that we would expect to see in first responders, so fire, EMS, and police. Uh, and we'll talk a little bit more about why that might be in the next slide. And as I mentioned before, some security or surgeon some cyber professionals think about leaving the field entirely. Uh, they get so burned out. It's like, yeah, I don't want to I don't want to do anything in cybersecurity anymore. I'm going to go, I don't know, uh, be a

farmer or something. Or or be a baker. Uh, because things like that you feel like you're actually making a difference. Right? So, what contributes to this? A lot of things. It's like this field was built to induce stress, I swear. Um, at work, we have budgetary pressures, right? It's always oh, do more with less. Because cybersecurity is always a cost center. It's always something that costs the business money. It's not a profit center. Unless of course you're working for a cybersecurity company. Um, so you're always going to be told, okay, yeah, we need to do 10% more next quarter, but we need to do it with 5% like less budget. And then do that every quarter for the

next 24 quarters. Really. Um, this is one of the things that contributes to understaffing, Uh one of several things that contributes to understaffing. You guys ever heard the stat there's 4 million open vacancies worldwide in cybersecurity? 4 million less job less people than jobs. That's huge. What does that mean? Well, that means that you're doing the work of two people or three or five. Good luck. Right? Um accelerating rates of change. Uh first off, the threat landscape. The threat landscape uh has evolved so much over the course of my career. There was a time, believe it or not, when working in cybersecurity did not mean that geopolitics affected your day-to-day life or your or your work

satisfaction. There was a time where I didn't need to worry about what the Russians were doing or the Iranians were doing or whatever on a day-to-day basis. Uh that those days are over, unfortunately. Um there's new technology coming out every week, it seems like, and you know, your users want to use it before you can understand it before you can understand how to use it securely. You guys have heard about shadow IT, right? This is where your users can't wait for the company to figure out how to safely deploy technology X, so they go and they buy it themselves. Thanks, guys. Love you, too. Um and then [clears throat] technology uh certain technologies that are either

upon us now or about to be upon us are upending job roles. Uh quantum computing for one. Uh quantum computing promises/threatens to break uh encryption within the next 3 to 5 years. Uh NIST has published uh quantum resistant computing standards, and they recommend everybody move to those within within the next couple of years. So, if your company isn't already investigating and planning how to move towards uh quantum computing, then that's going to increase your stress level even more. Sorry. And then AI. Uh generative AI, right? Uh AI is going to replace your job. Good luck. Workplace factors are big. Where you work, work culture in particular. One of the things I like to say is

for most companies the security team is an itty-bitty little piece of a much larger organization. And if it becomes an us versus them where the security team are kind of a little island against the storm of the users, you're already you've already lost that particular war just by sheer numbers. Right? So, you need to make sure that the culture supports um you know, security positive environment, I guess. Leadership issues. Uh Anybody work for a bad boss? I have. Few of you have? Yeah. It can really screw up a team if you've got a bad boss. Right? It like immensely. Um They can poison the team, quite frankly. Another problem that's kind of unique to security is that we have to be the bad

guys sometimes. And and I don't mean in the cool way. I don't mean in the in the red team way. I mean in the hey, there's this new security policy that everybody hates and it's your job to enforce it. That's not going to impact on your job satisfaction at all, is it? The fact that people are now throwing darts at your picture in the cafeteria. Um potential high cost of failure. Right? So, my brother-in-law was a security guard. And he used to say, well, you know, I don't see what what you're so stressed about with your job. I'm like, dude, if you have a bad day, maybe somebody gets run over by a car and dies. If you have a really bad day,

maybe the factory burns down. If I have a bad day, the bank that I was working for at the time, you know, they would go under, they would drag the rest of the western financial institutions with them and the entire world economy for the next 5 to 10 years. So, you tell me what a bad day means. But, there is no pressure. No pressure at all. Right? So, yeah, we're not under any pressure from that. Constant vigilance because, you know, we always say we have to be right every time. The bad guys only have to be right once. Uh and then, family factors. If you've got stress at home as well, um and we have we can't talk about our

job with our spouse, probably. Nine times out of 10, unless your spouse is also in the field, either A, you're under NDA anyway, or B, they're not going to understand what you're ranting about when you go home. So, a lot of things contribute to stress. Um came up with this. Uh one area in particular is the stress and staffing cycle. Company start out uh we're short-staffed, which means that you have to do more, which means you have increased stress because you're trying to do more with less, which leads to higher stress, which leads to more lost time or somebody quitting for greener pastures, which means we're more short-staffed, which means repeat the cycle. Yay! So, what do you do about it?

If you're an individual contributor, enforce work-life boundaries. Take your vacation, all of it. If you're given 3 weeks a year, take it. Uh maybe find a sense of purpose in work in your work, but we'll come back to that. Uh physical activity, like jogging or whatever, is supposed to help, as is having hobbies or other interests outside of work. Set your Set goals, uh daily, weekly, monthly, and track those. Track the goals. Track what you accomplish, not what failed. If you're a manager, all the other things apply, plus recognize stress not just in yourself, but also in your team. Uh look for opportunities to reward your team. Training opportunities, send them to conferences. Uh give them bonuses, take time off.

Promotions are always nice. Hard to get, but nice." Um possibility for job rotations. Uh Some firms have um a permanent incident response team. I would actually recommend that you rotate security staff on and off of the incident response team because doing incident response and nothing but incident response is going to probably age you about five times as fast. And then, again, fill the vacant job roles quickly because the longer a job role is open, the more um you're going to uh be putting additional stress on your other employees. Now um I mentioned before this was a dissertation topic, so there were several potential research questions that I came up with. Uh so, if anybody's bored and wants to

do some research, here you go. Here's your opportunities. Uh first is what's the baseline stress level in the field versus the baseline stress in the general population? I think it's higher. But I don't have any numbers to back that up, so that would be an interesting study. Second is not all cybersecurity job roles are the same. Right? So, we talked about CISOs, and we talked about um incident responders. But like, if you're a security architect, do you have the same level of stress? Probably not. I'm not sure. Uh but it would be interesting to do a study where you take like the NIST uh job roles, for example, and get people across all the different

job roles and measure their stress levels, and see how job role correlates to stress. And that would be an interesting study. And then the third one is um career calling. Because I have conflicting evidence here. I've got one study out of China uh from Wu et al. that says if you feel like this is your career calling, you can actually endure more. But then I've got other uh evidence from Ugbenu and Spears um that says no, it it actually if if this is your like if this is your one true calling, it becomes more stressful. So, that's kind of an interesting conflict in the literature that needs to be resolved. Now, a more recent study um that I found

says that the career calling idea might mask symptoms and push people closer to burnout. So, again, we don't we don't know. So, these are interesting areas for future study. Um if one of you snaps one up, great. If not, once I'm finished my doctorate, I might come back to this stuff. Uh there's my refer- the uh Come on. Are we going to do this? There we go. There's the references if you're curious. These are all came out of actual scientific literature. Uh and questions. Do you have questions? Yeah. Nope, hang on. We've got a microphone here for you. >> I I'm curious how what do you or how do you define an instant responder becau-

because one of the examples you said was a security architect. And if there is a security incident, there there may be a a security incident lead, but that person brings in the subject matter experts, and it's stressful for everyone, including if you bring in the security architect because uh some particular system has been penetrated, and who knows best about that system but the security architect? >> Yeah, so that is a great question. I would define here somebody as an instant responder if their primary role is incident response. >> Okay. >> Um because then they're going through incident response day after day, week after week. >> Mhm. >> Right? Whereas if you're being called in on one or two instance a year, that's

Yeah, it's going to be stressful, but But not going to be the major stressor in your life. >> Correct. Okay. Thank you.

>> Hi, thanks for the talk. A bit of side question, but I'm wondering if you have read or looked into the psychological impact of people being hacked, whether it's like personal, like phone laptop compromise, whether it's like your system was hacked, whether it's at work, whether it's your an IT or security company and your system are hacked, and how much that affects a critical psychologically. >> Yeah, that's a good question. It's an interesting question to unpack. Um short answer is I've not dug too deep into it. When I was doing my literature review for this research, I did find some evidence that uh people who have been the target of a security incident, like they were the

person who clicked the link they shouldn't have, that can obviously be a a short-term stressor anyway. Um usually, hopefully that same person isn't the cause of incident after incident and therefore isn't getting continually hacked and therefore the the second half of this, the burnout, should not be the impact, and if it is, they should probably question some life choices. Um just to to be the the glib answer there. The real answer is that I have not dug too deep into that side of it. I've been focusing more on cybersecurity cuz my main research area, for the most part, is these millions of job vacancies and what we can do to either A, fill them, or B,

make them less likely to become 5 million. >> Last quick question and quick answer, please. >> Um any studies that have been done regarding generalists versus specialists, i.e., those who were execute multiple roles. Like your incident response plus. >> I'm not aware of any. It's great question again. I'm not aware of anything like that. Certainly the idea of somebody who has to wear multiple hats versus somebody whose main job is X. It would be another potential research area, but I'm not aware of anybody that's actually done anything in that area. Great. Okay. Thank you all. >> Thank you, George.