At the SOURCE Boston security conference yesterday, I ran a session with former colleague and friend Josh Corman on the topic of security burnout. It’s an issue I’m increasingly dedicated to, given my own history with mental illness and high-profile deaths in the community.
When I think of the suicide of Aaron Swartz and the accidental overdose of Barnaby Jack, something in me screams out to act. I’m also inspired by the efforts of people like Amber Baldet and Akamai colleague Christian Ternus and want to help.
But some think this effort is a curious sideshow.
Mood music:
After reading about the session, one infosec practitioner took to Twitter and asked, “How many of us have lost it and started shooting up a place?”
It’s true there hasn’t been an explosion of people in the industry losing it and gunning down a bunch of co-workers. Therefore, he feels, the problem isn’t worth the efforts some of us have embarked upon. He added, “Something is wrong, alright. But let’s not make a big deal here.”
My skeptical friend isn’t the only one to make these points. Others have pointed out that the SecBurnout effort is a waste of time because antisocial, caustic behavior is a staple of the profession. Nobody will change those people, nor should anyone try to.
Those who can’t handle it simply need to grow a set of balls or go do some other kind of work.
I agree with that — to a point.
As Corman noted yesterday, this effort isn’t going to “cure cancer.” We can’t tell people how to think, and we don’t want to. We’re advocating more kindness and civility in the profession, but we know the more negative elements will always be there.
Also true is that you can’t cure things like depression, bipolar disorder and OCD. We can learn to manage these things better, however, and keep them from controlling us.
But all that is beside the point of SecBurnout and similar efforts.
We don’t expect to change the world. We do believe it’s worth trying to suggest a better approach. If we can inspire just a few security shops to adopt a more humane environment that inspires people instead of crushing them — and if that leads to fewer cases of depression and suicide — it will be worth it.
Maybe this isn’t a big deal to you. If that’s the case, congratulations for staying above it all. But if you or your friends and colleagues are casualties of burnout, it’s a big deal.
I do see progress. When I was stuck in the deepest depths earlier in my career, you simply didn’t talk about this stuff. It was a sign of weakness and could get you fired.
That’s not as true today. I and many others are talking openly about our demons, and it’s making a difference. As a community we’ve recognized there’s a problem. Amber Baldet took it a step further by sharing suicide intervention techniques.
The next step is to attack the conditions that fuel depression in the first place, to tear at the roots of the problem so fewer people reach the point where they need an intervention.
And so we press on.
Yessir I have burned out. Except I haven’t admitted it yet. I’d like to see everything crash and burn, down to the ground. Except that I don’t know what else I am good for. If I wasn’t doing security, maybe I’d be selling beaded necklaces on the street. I’ve been abused by customers, bosses, peers, cops, and my so-called friends. Each day I wake up and think – hey, this is it, I am going to walk out the door, get in my car and keep on driving, leaving life in the rearview mirror and making a clean start somewhere, washing dishes in Washington or shining shoes in Sheboygan. But it doesn’t happen. I was kind of hoping this Heartbleed thing would do it, and I’d finally get the balls and quit. Nope, somehow I made it through the week. I passed by a strip club with a really bad reputation while driving home. I wanted to go in there, get loaded, and start a fight. But I didn’t. So now I am at my home, feeling exhausted and wondering what to do with my Friday night. I wish I hadn’t quit drugs, so many years back, and now have no connections. I’d really like to do something bad for me.
( Not my real handle)
After 18+ years doing infosec work, I bailed and now do IT operations management. It’s better in terms of not getting outright disrespect as soon as I walk into the meeting room. And, there’s still a lot of risk management to be done, so I’m still using a lot of my security skills. Sometimes I miss not doing infosec, but not enough to go back!
So here it is. I burned out. Fucking pride. Sitting at home, drinking cheap beer. 3 days since I went to work. ignoring their calls. I wish they’d hurry up and fire me. There was this guy I used to know, handle of Minus, who went and join some eastern orthodox monastary in alaska. sounds like a good idea, except i don’t believe. i wish i did.
you know when you’re young and a freak and loner, yet people tell you you have special ‘talents’, it’s alienating. you’re supposed to feel that the beating you get from the bullies is not because you’re a sucker, but because you’re a special person. So, the more alienated you get, the more beatings or social humiliation you get, or just general awkwardness, is all chalked up to ‘I am different, they are inferior’, because if you believe you’re inferior, like the bullies say, that’s a one way street to oblivion. so you’re alienated, but you have this wierd, alternating ego. then what-do-you-know, in some sort of pathetic grasp, you find yourself wanting the ultimate last word against online asswipes as well, and hack some BBSs. The feeling is like some fantasic drug when you can play the abusers like puppets on a string or erase them entirely. you pursue this, to get control over any and ever board, even if the population there has never done any harm. power is addicting. [more later]