BSidesCharm -2017 - Micah Hoffman - Imposter Syndrome: I Don't Feel Like Who You Think I Am

hi welcome everybody sorry we're getting started a little bit later but uh i think we've got some fun stuff to cover here my name is michael hoffman we're here to talk about imposter syndrome this is the obligatory about me slide i've been working in the industry for many years i teach sans classes i work for bruce allen hamilton visit our booth visit our recruiting thing we've got a position open for a junior pen tester yeah um but that's not really why i'm here to talk to you today all right i want to talk to you about this guy anybody know who he is yeah yeah and alfred einstein thank you sir yes so albert einstein so albert einstein

right physicist in fact albert einstein is the quintessential physicist if you ask somebody what does a physicist look like you get this how do i know wikipedia yeah yeah i mean and albert einstein's done amazing things right i mean he in the past he knew he did things with nuclear energy with with amazing time space bending and gravitational it's amazing what he did and yet albert einstein didn't feel like his contributions to the world were really that worthy i know this because again there's a quote and that quote says the exaggerated esteem in which my life work is held makes me very ill at ease einstein said this the man who was just an amazing amazing contributor to how we

understand the very basic part of our world of our universe einstein felt like a fraud he couldn't internalize his success i mean his entire life's work by any other standard would have labeled it a massive success i mean it gave us big leaps forward in how we understand things the most important thing is that how he interpreted the success that he was getting was not representative of what the rest of the entire world thought of his work this is something that's going to be important as we talk about imposter syndrome i had a very big bout of imposter syndrome back in 2012. i went to derbycon anybody derbycon out in louisville yeah good conference and i was out there um i

think it's my first derbycon and i remember going out there and and visit and listening to some of the talks uh there had rock stars there's infosec rock stars like hd moore who talks like a million miles a second and he talks very deep he knows so much he was talking colonel ownage uh chris gates was was dropping some knowledge and i was listening to these people talk about powershell and scanning the entire internet in minutes i was like whoa what the heck am i doing in this field i i just test web apps that's all i do i just test web apps it's like huh well i don't have any o days that i know

about i got nothing to trade on the black market i didn't know how to program yeah i knew how to do things in bash the born-again shell if any unix linux people out there i could bash like a mofo but i had no power shell i had no python no ruby i couldn't hack cars which was getting started around that time and so my my subjective perception of myself when comparing myself to these other people is actually quite low um in reality though 2012 was a great year uh objectively speaking i had my health my family was awesome things were going well in my career i had a team that that was very supportive and just

terrific people but when i started comparing myself to other people that reality that i had for myself uh was a little bit different and it was so profound that i felt this this overpowering burden that i'm a fraud that i actually started looking for it outside of the infosec field now i didn't find anything that was as fun and exciting and allowed me to play with electronic toys as much as i do now um so i'm still here but i did i did a search and i i took a little bit of time off of work and i started looking around for other positions and i remember when i was doing this i was listening to

some podcast don't remember which one and i heard these two words imposter syndrome i was like posture syndrome i understand posture i understand syndrome talk to me tell me a little bit more and that is when things started to make sense for me personally you see impostor syndrome is not necessarily a psychological syndrome and something that's that's bad and and is like a disease it's not it's more a collection of feelings and and perceptions that you have about how the world interprets you and how you interpret the world it was first described in 1978 in a research paper by dr iams and dr clancy dr clancy has done a whole bunch more work on it and essentially what they did

was they were working at dr clancy uh starting dr clance sorry dr clance started working on this when she herself a phd well-respected researcher and lecturer professor at a at a very prestigious university she herself started feeling inadequate that what she was doing was not worthy of the praise or or just of recognition so she started to talk to dr eins and they said well you know let's let's look into this more and they conducted a a research study of 95 women at that time they were mainly focused on women they conducted a research study of 95 women that were high achieving that were in phd programs even some undergraduate program undergraduate students what they found was that many times

the subjective perception that their subjects had overpowered the actual real world perception of their work and they couldn't really figure it out they said well this is an interesting phenomenon these are interesting feelings that these people have and what they do is they really they see themselves different from the rest of the world they perceive themselves differently now of course if i'm perceiving my actions and my my um my successes differently and then you are that might open me up to some real psychological disorders from depression anxiety fear of performance low self-confidence and these things in and of themselves can be the symptoms of something like imposter feelings now i'll tell you this imposter feelings

they come and they go it's not necessarily in all the time oh my god i'm feeling adequate in every aspect of my life that's not the case myself my personal journey i actually have certain times when i feel more inadequate than others when i feel more like a fraud than others and that's okay that's how i work that's how i am i'll tell you this though there were other research studies out there since 1978 one of them found that up to 70 percent of people in the world just 70 of everybody in the world at some point in their life feels like a fraud feels like what the heck am i doing on this stage in this

event or whatever it is that you are who am i to be presenting to the ceo of my company or lecturing a bunch of students who am i to do this imposter feelings they come in a continuum uh dr clance went on to create an imposter feelings test that you can take online um there's an uh there's a url i'll give at the end that has some resources that you can take a screenshot of or whatever and uh and and look up but dr klantz today uh uh some a test and there's a scoring mechanism there that sets people with imposter feelings into four distinct categories from few to intense feelings and as you move up

that spectrum obviously the your ability to do things your your the things that you choose to do will vary it impacts everybody or can impact everybody men women different religions races it it's really a universal thing in fact some of the most important people that you probably recognize every day that are on your tvs on your movie screens they themselves have admitted to having imposter feelings everybody from tom clanks and jalen tom hanks and j-lo to harry potter and liz lemon and some other people as well um all of these people if you google them and imposter feelings you'll come up with um articles where they say hey i can't believe people still go to my movies

um jlo was like i sold 70 million records in a year and still i was like oh why would people want to listen to me posture feelings now imposter feelings come many times they are more intense many times during times when you have a pressure to achieve to get a report out to do a briefing to do a talk to do something that you normally wouldn't do in fact in one of my other talks i gave a talk here last year the keynote and it was one of the things that i said was uh it's important for you to surround yourself with people smarter than yourself because they're going to be the ones that challenge you right

they're going to be the ones that you learn from they're going to be the ones that make you feel inadequate so many times what happens is is that when you do surround yourself with people that are smarter than you you compare yourself to much like what i did in 2012 at derbycon it's like huh here's where i am there's hd more oh my god what the heck is my relevance in this world and that could be very very discouraging some other times when imposter feelings might pop up is when you're starting a new task a new project you've got a new job you're unsure of yourself you maybe are lacking a little bit of confidence all right

here's one that might be a little bit interesting to you the longer you are in a field the more likely you are to have imposter feelings and that sounds a little counter-intuitive because what we would normally expect is that the longer you feel that you are in a field the more confident you are in your abilities to do work let me introduce you to another another study or another phenomena some called the dunning-kruger effect now this dunning-kruger effect was discovered and first noticed in cornell university many decades ago and here's what they studied they noticed that they essentially had a confidence level and an actual experience level so they went around and they interviewed people they

said hey you know what tell me for your current job right now where you are how confident are you that you know what you're doing and then they also scored them on how good they are at their work and this is what the outcome of that looks like so the dunning-kruger effect has a phenomenon is a phenomenon that you will probably notice if you've been in any field for a while and you've dealt with junior people you'll see this all right if we start on the lower left where the know nothing and low confidence in your abilities are we start there everybody starts there i don't know anything and i know i don't know anything

okay cool but then as junior people do they might get in there and in penetration testing this is very common they get into a place and they're like oh i popped a box i got a shell i got a cert ceh baby and they are on top of mount stupid because they feel like of all the things that they know of they rock it and that's the case at that point in time but to those people you say well what about reverse engineering what about hiding an invasion what about you know malware and and other things and they're like what and that's when they start realizing that they're going into the valley of despair because their

small little narrow world that they thought they had mastered now becomes this huge pyramid of oh crap i don't know half of what i thought i knew i didn't even know there were things that i didn't know that i thought i knew and that's where you get to the valley of despair now in normal people the valley of despair comes you still are learning you still are becoming competent and you get that slope of enlightenment and eventually the plateau of sustainability which is great except with imposter syndrome that curve flatlines a little bit so instead of me continuing to learn i do continue to learn and and people with imposter feelings they continue to learn and they

continue to grow and your team knowledge but their estimation of what they can do their estimation of of how confident they are that they can get stuff done that is underestimated and i see this a lot too so with junior people we sometimes see this massive over estimation in their abilities and they don't have them with senior people i see an underestimation in their abilities and they do have them so it's kind of an interesting effect that happens here in infosec and it happens in other industries as well um so uh yeah that was kind of interesting now one of the other things that i hear commonly about about giving talks about teaching infosec about doing what other is

um well i'm a big proponent of of working with hacker groups i i'm a member of nova hackers anybody know the hackers here yeah oh nice okay so nova hackers is a group that we we meet in northern virginia and we give talks on stuff we we talk about whatever it is that we feel we want to talk about it can be how i set up a raspberry pi to to work with my tv system or how i hacked an infrared camera whatever it can be but everybody has to participate and so we'll say to somebody new that comes to the group hey it's your turn to get up on stage there and they'll be like hi

i don't know anything that everybody else doesn't know you've been doing this for 20 years how am i going to know something that you don't know and so what we get is this really neat kind of image on the left is the impostor feelings mentality where you're that red dot in the middle and that red dot in the middle is i don't know very much everybody else knows so much more than me that if i was to speak people would know more and and you know my my opinions my ideas it wouldn't reach anybody it wouldn't change anything it doesn't matter because y'all already know this the reality is much more like on the right

where everybody knows a little bit about about other things i know a little bit about reverse engineering malware but i don't know as much as as you over there or i don't know as much as cryptography but you sir you might know more about cryptography than me we all can share and it's having that perception change of you know what everybody has things that they don't know that other people don't know about to share that's what makes nova hackers unallocated space in these other groups so important is that we help everybody feel welcome now imposter feelings have a cycle and the cycle goes pretty much like this if we start in the red area in the bottom there's the

i've got a new project i have to do i it might be a new speech it might be starting a new task at work it might be oh my god i have a child now how am i going to care for this little thing i'm not supposed to be a daddy um not saying that that actually happened to me um yeah here we go um and then going around the circle it's oh my god this is gonna be a disaster this is terrible i'm gonna fail at it and then you do work you apply yourself you you do the research or whatever and you achieve the task and you get the mom you're like hey that

didn't fail as much as i thought it would that's all right oh i have to do it again and it's this wonderful cycle that's the simplified version and that's what happens many times you do a good job speaking at a conference or on one project they're like hey bob you need to come over here and do this project you did so well briefing the ceo there brief this uh our customer ceo now and you're like oh crap i have to do it again um so that's the simplified version the complex version looks something more like this and again if we start in the upper left side you have some kind of achievement related task as i said

speaking on stage talking at work doing a new task and then moving off to the right you have this anxiety this worry this self-doubt that i could never do this who am i going to be to do this with imposter feelings the next and the next step is very important we either procrastinate push it off find other things to do i can't tell you the number of times that i've heard people oh i'll finish my slides right before my talk there's plenty of time they have a speaker room that i can do my my slides in i'll be fine and if we take the procrastination route what happens is you may succeed you may give a great talk and everything's fine

but then instead of attributing that success to you your efforts your knowledge what did you say well that was lucky you know i was just lucky that i had some quiet in that room and i threw some stuff together and people liked it the other way to do it is over preparation these are the people that never stop editing their slides as i was doing just in that room a little while ago um never stop tweaking or modifying oh this is a different perspective or this slides out of order and it keeps going and going because you feel that the more work you do the better it's going to be and then what happens is you get success

you're like yeah i stood up there managed to make some people laugh that's great and then at the end you're like you know what that really wasn't me doing that conveying that information that was the overwork that i did that was that all that that that sacrificing of my time all throughout the week that's what it was that was what the success is it wasn't mine and so what do you do the next time you have one of these tasks you over prepare even more i got to prep for a talk i got four weeks i have to do way back and i have to to start doing things and outlining things and you get this kind of

ritual thing going because that is what you attribute your asses success to instead of internally now with imposter syndrome we have this wonderful or impostor feelings we have this wonderful kind of double-edged sword not only are we afraid of failing but we're also afraid of succeeding as well because because fear of failure means you didn't prep enough right or you didn't put enough into it fear of success is oh crap i gotta do this again and that can be equally as debilitating so that leads to a failure to try these are things um i was reading some articles that about this that that said that this happens a lot with women nowadays where they will get some have some

imposter feelings they get put into a place where they have to present or something and they achieve success or failure there it doesn't matter but the next time that they are going to be put in a situation they might not even apply for that speaking position or apply for a promotion in fact one of the things that is very common for anybody with imposter feelings is that they don't put themselves in the situation where they might get rejected or get accepted because again it stirs those feelings in them i can't tell you the last time i can tell you the last time i did a webex for sans you know they're like hey would you like to do a webex

like yeah that sounds great and then after committing to it the date i'm like oh crap i'm going to be speaking to people and then those people are going to hear me and what if i don't give them enough information or what if they already know what i'm and you have that self-doubt and the cycle starts that leads me to my next point is that many people with imposter feelings have negative self-talk that's inside of our brains we can start and have this whole conversation of why this is not going to work or why would somebody want to listen to me and it's just it's that negative feeling that keeps going around and around and

around that keeps pushing you down or generating depression anxiety guilt and so at this point in the talk you either are ready to just bolt out that door and grab a beer or um you might be asking yourself well do i have uh impostor feelings and so i ask you to think about i ask you to think about well no you know i have impostor feelings do you have an apostrophe um yeah is there anyone in this room who doesn't have that um i'm not going to ask people to out themselves if they don't have imposter feelings but um you can think about it [Music] um so the so think about a time when you attributed your success to

other people or other things like think about this you know you when somebody says hey that was a great home run you hit and you're like ah it wasn't me it was the team no that was pretty sure to be you that was up there at the bat and you hit the ball or something or a great job on that that report that you made all by yourself ah it wasn't me you know bob over there he edited the report for me it was his magic deferring that success to other people hmm what if you belittled your worker accomplishments you know uh there's times when you know i'll put something on my blog i'm like oh i block

and people go that's great i'm like uh yeah you know it's just words on a page it is what it is and i kind of push down the atta boy great job type of things or you discounted your contributions to the overall team effort or just the effort going on in your life it really boils down to two main questions one do you actually feel like a fraud you feel like an imposter and two are you unable to internalize success if the answer is yes to those things then yeah you probably have some kind of imposter feelings now remember they're on that whole continuum it doesn't have to be debilitating and if you recognize it

that's one of the steps towards actually getting better and there are tests out there of course um here's a google short url i'm not here to like infect your computer with malware or anything like that [Music] or am i yeah um so uh this is actually to um to uh just a google query of inter uh imposter feelings uh tests dr clance has a great test and it gives you the results right there but as you're working through the questions i was like yes yes yes yes yes i i know what this is going to say at the end also know this that if you have imposter feelings as was brought up right here you're not

alone in fact i'm willing to to bet that you know pro there's a good poor portion of you in this audience that have actually had some kind of impostor feelings at some point in your life the problem with this is that many people with imposter feelings suffer in silence because for me to stand up here and say hey i have imposter feelings is confirming the fact that i feel like an imposter and then you know that i feel like an imposter and then i am an imposter so for me to say that for other people to stand up and say hey i have imposter feelings or i had imposter feelings that generally doesn't happen but just know that there are a lot of

people out there from tom hanks and harry potter to other people that have imposter feelings i know what his real name is but it's so much more fun i'm going to see it now on my twitter feed get a rock clip so also know this that if you do have imposter feelings at some point in your life you can work to overcome it and i say work to overcome it because much like many other things when dealing with our brains there's no there's no completely recovered from there's no it's changing the way way that you think it's changing the way that you receive information it's changing the way that you process things and it's a continual

process the first step in the process is to recognize trigger feelings when you are in a situation where you have to stand up and make a speech in front of other people or when you have to write that report or whatever it is if you find yourself out you know cutting the grass and trimming the hedges or maybe you know planting some new flowers and it's like december you might want to consider are you procrastinating why are you procrastinating the next is very powerful and it really does take that meta interpretation and meta position you have to recognize your feelings you got to recognize that you're feeling anxious you got to recognize that you're like holy cow who

am i to do this once you start doing that i urge you to talk to people one talk to yourself about it if you have that negative self-talk that's okay hey i was selected to stand up here on that stage that means that at least five other people at b-sides charm think that this is a worthwhile talk they believe in me so gosh darn it i'm good enough i'm smart enough and people like me thank you thank you um thank you yeah so you know counteract that negative soft self-talk in your head if you got it talk to a mentor talk to a friend talk to somebody because by saying things out loud it sometimes can lessen the anxiety

lessen the impact the next is talk to people that will give you honest feedback i do this a lot with some of my friends i do this in nova hackers i do this at work tell me what you really think you think it's crap you think it's awesome but you have to do this to people that are going to give you honest feedback many of you might be talking to your your spouse or your boyfriend or girlfriend or kid and you're like hey what do you think about this that's great daddy well okay but is that really great are you just saying that because you want to go off and play your xbox or something

so make sure that you're talking with somebody that will give you real world feedback i've already mentioned this a little bit take those negative thoughts of self-doubt and anxiety and reframe them i can do this there are people that believe in me i'm a real big proponent of this next one tracking our achievements tracking your accomplishments and your progress get a wall calendar and put all the cool things that you did on there put it in google calendar or whatever it is that where you record it because you know what those times when you're feeling low those times when you're feeling anxious or that you're not worthy you can take a look at that calendar or whatever and page back

through and go damn i did a hell of a lot of things last week last month last year and that can help lessen those feelings of of self-doubt the next thing is very important it's to take all those things and own them i'm speaking up on this stage right now i made it here because those people and besides sharp they believed in me okay but i'm standing up here and talking so i need to own this time in this moment whatever and you have times in your um in your lives when you also need to own the success own your achievements and own your progress that you made i'll take questions at the insert i'm sorry the

next thing is stop demeaning yourself right how many times have you said something well i just did this i just posted that blog post right i'm pretty sure i kind you equivocate or your language whether it's in an email a text a snap or or even you know an uh spoken out loud is very powerful in reinforcing those feelings using words like just or i only i only formatted the reporter i only found 15 of the 17 findings in the report all of these things lessen internally your feelings about the the the experience this is a hard one practice accepting the compliments many many times on twitter i will get something that says hey not great whatever i'm like oh uh it

really wasn't me you know this is a derivative work of leslie carhart because she's she's so awesome and it wasn't really me it was leslie yeah but i tried to start saying thank you i've tried to start you know changing the way that i i accept those con compliments remember what you do well write it down keep track of it teach a class on it do a brown bag on it to talk to your kids about it what you do well is something you can be proud of those are things that other people can't take away from you and mostly you know recognize that nobody's perfect we all you know anybody read that book to your

kids everybody poops yeah everybody does everybody makes mistakes mistakes are what help us learn and they are and the more you become friends with making mistakes and learning and growing and failing the less of an impact it has on your overall psyche the less anxious you're going to be cool when i gave this talk uh back at um besides nova a couple months ago i stood up here and i had this great example in my head about how edison failed and all and i was i couldn't get it out of my mouth and and somebody in the audience janitor over here was like hey here's how you say it i was like yeah that's what i meant and i just kept

going on with the talk but through my negative self-talk i keep remembering that and i keep going over oh that was so stupid why didn't i remember that be okay with that are you a perfectionist or do you have perfectionist friends colleagues whatever be okay with good enough there's never going to be a perfect product you're always going to be able to choose a different font for the or or change the font size or or maybe use insta uh you know it italics was a little bit much for perfectionist maybe i should have bolded it and people like that people that are perfectionists they will keep modifying the work draw a line in the sand if you're a

perfectionist and say you know what that's what we're going with i'm going to focus on other areas of my life and if you're a perfectionist that keeps doing this make yours make sure that you put a time limit on revisions hey that that's that speech that presentation is going to be tomorrow at noon i'm not touching it after 10 o'clock in the morning or you know 11 59. use safe environments to practice because by practicing by by working through some of those things that make you anxious that make you feel like an imposter it can help you through those events it makes you more comfortable with it nova hackers unallocated space talking at conferences just doing things with your friends

whatever it happens to be that makes you anxious or gives you that imposter feeling work through that in a safe supportive environment a lot of people will practice speeches in front of mirrors that works unless you're critiquing yourself in the mirror going oh i don't like the way you recognize this this is a process this is going to take time we can't take a pill and everything be better it's the way that people with imposter preheat and feelings perceive the world and it will take time now when i was researching the imposter feelings um i i came across uh nicholas means is you're not an imposter video great video i highly recommend if if you're interested in this

you take a look at his video and there's a google a short url to it and in there he get he's such an eloquent speaker and he talks about his struggle with imposter feelings and at the end of it you know he the funny thing is that after listening to his talk i was like oh that's like exactly the talk i wanted to give crap who am i to give this talk it was yeah it was a little challenging um but nicholas has a really interesting way of of talking about his struggle with imposter feelings and what he said is that he strives to be a high functioning imposter and so do i so do i

so i wanted to say if you have imposter feelings strive to be a high functioning posture i've got some resources here at that short url on my website webbreacher.com um that might be helpful to you and uh thank you very much i'll take some questions i think we have time for a couple questions sir yes basically listing out your successes and being able to use that justify what you are doing

so i think what you're asking is how do you deal with from an apostrophe standpoint how do you deal with those successes that are attributed to you or given to you or thrust upon you that you don't really feel like you earned or you don't know why you earned right employee of the month it's like hey bob it's your turn to be employee of the month it's april um and you don't know why recognize that in our world at least in the united states at least in this area everybody gets participation trophies for something right and when we're kids we get them for soccer everybody's a winner there's going to be times when you when there is

there are false things that are thrust upon you um but what i would do is i would challenge myself to figure out one i would ask somebody and say you know what why did i earn uh that that award or or why did i get that recognition what was the specific thing or things that i did because one of the things that you're asking for there is feedback you're asking for what are the actions that i can do that i can repeat so i can do get this award again or that i can help others achieve this award so i would go back to whomever gave it to you and ask for more information if it's

just one of those it's your turn to be you know head fry cook or whatever that's okay take that smile nod and move on with your life cool other questions yes sir

so the question is how do you work with colleagues family members and other people around you if you notice that they are maybe doing the procrastination having that anxiety maybe they have impostor feelings obviously it's going to depend on on you and that other person's relationships as as my manager and i would work out i would feel perfectly comfortable with him coming to me and go hey are you feeling anxious about that speech or this report or whatever you know maybe we can break it down maybe we can set some arbitrary and some deadlines for when your revisions have to be in so to prevent that procrastination um maybe you know that you could just

talk about it if it's somebody that's close to you it depends on if they're willing to listen uh sometimes sending them the recorded version of this talk is is what's helpful or posting it to facebook what i found is as i mentioned i gave this talk in uh besides nova and uh just a couple months ago and i did a 25 minute version of this talk and that talk i was posted to the internet thanks to adrian and his wonderful team um and i i tweeted it out and i got such a great outpouring of hey i'm so glad that people are talking about this because i wouldn't have ever thought about it so if you sir were to go to somebody and

say i think you might be you know having imposter feelings do you feel this you know uh and helping somebody work through it they might thank you because they might not have been able to put a name to what they've been feeling so they might also hit you or something yes sir

so the point is if we can head off uh the imposter feelings or the situations that might lead up to imposter feelings in in uh young people kids uh young adults then maybe we could prevent imposter feelings would you say i haven't looked into that i do have a psychology degree that's my undergraduate degree but um i've been in computers way too long to to do a scientific study at this point so but there might be there are lots of other research out there lots of other research out there about imposter phenomenon and posture feelings be interesting to look at anybody else okay well thank you very much everybody