Information Security Burnout

RSA Conference is winding down and one of the most interesting and meaningful talks was actually the first I attended - a Jack Daniel moderated panel discussion on stress and burnout in the information security industry. The pannel was really focused on the science and statistical analysis of stress and burnout. It was a great presentation. That said, I'm not going to restate their discussion but rather talk about what it means to me.

When people talke about stress in our industry, a common, if not often spoken response goes something like - "Shut up you baby and quit whining. You get paid well for sitting in a chair typing on a computer all day!" To be honest, that is a valid point. We typically do get paid pretty well and we do sit and type on a computer. Unfortunately, the story is not that simple. During the pannel discussion, a couple of the members mentioned an individual they knew who used to be a tactical narcotics officer and then transitioned to information security. In his prior life he dealt with guns, drugs and really bad guys. After spending a year in his new career he stated that information security was FAR more stressful. That may seem crazy but I think it makes a lot of sense.

When acting as a tactical narcotics officer, a good day is one where everyone goes home alive. The metrics were simple. You could get to the end of your shift and know that you did what was expected of you. When you are done you can go home, relax with the family, take vacations, etc. While the risks are definitely higher, success and failure are easy to define and when you are done, you are done.

Now let's look at the world of information security. In our industry, success is largely determined by nothing happening. We are largely successful when nobody notices what we've done. We work in an industry that was once described by Dan Geer as one of the most challenging intellectual pursuits in the history of mankind - "Too deep to master, too wide to know and to fast to photograph." There are few metrics and it can be argued that we, those who defend computer networks from attack, are losing and have been losing for a long time. We have to be right 100% of the time and the bad guys need only be right once.

If that were the only problem, I think it would be fairly manageable. Unfortunately, there are other aspects to this industry that make things more difficult. Our industry tests to attract a particular type of person. We tend to be extremely driven and competitive. I think there is also some level of insecurity (pun only partially intended) in many of us. We always want to be better and never think we are good enough. As a result, we put pressure on ourselves - often more pressure than our employers put on us. This self-induced pressure does adds to the level of stress we feel.

As an industry, we do little, collectively, to help. We spend all of our time looking for weaknesses. This is great when we are analyzing our networks, applications or operations. Unfortunately, we often find those weaknesses in ourselves and/or in others. When we find weaknesses in ourselves, we feel the need to work harder or feel guilty for not working harder. When we find weaknesses in others, we tend to call them out on them - often publicly. This only adds to the problem and does little to help.

Pulling everything together - we work in industry where there are real good guys and real bad guys and, arguably, the bad guys have the advantage. At best, when we win, nobody notices. At worst, when we win we become the target of those bad guys. Our employers often have little or no understanding of what we really do and thus the pressures we are placed under are largely self induced. When we put ourselves out there, we do so at the risk of attack from bad guys and from our own community. Finally, we do this to work in an industry where there are no clear metrics for success but obvious indications of failure. It's no wonder we are at such high risk of failure.

I guess the real point of this posting is to put out a challenge - don't continue to make the situation worse. We who work in the information security industry know what it is like. If you know someone who is doing a good job, tell them. If you know someone who needs help, help them. If you know someone who seems at risk of burnout, try to help. Information security may be a highly analytical and technical industry but we who practice it are people. We need to keep that in mind.