Loading summary
Transcript34 lines
- [00:05]
A
Welcome to the RSAC cyberatthettop podcast, where security leaders across industries share the strategies, hard lessons and real experiences shaping modern cybersecurity and AI insights are grounded in community and built for every level of profession.
- [00:27]
B
Hello, listeners, and welcome to this edition of the RSAC Cyber at Top podcast series. Thank you for tuning in. I'm your host, Casey Zerkis, and I'm excited to be joined by Jen Easterly and Peter Coroneus for today's episode where we're talking about something every security leader knows is real, but very few can actually quantify. It's burnout. In cyber teams. We know that cybersecurity professionals are some of the most pressured workers on the planet. And, and burnout in this space isn't just a personal problem, it's an operational one. So before we get started, Jen and Peter, I'd love to ask you both to talk to our listeners about why this discussion is so important to you. Jen, let's start with you.
- [01:14]
C
Awesome. Thanks so much, Casey and Peter, I'm so excited to be here with you. It's great to see you again. So you and I, I think, first got acquainted almost four years ago when you launched Cyber Minds. And just my kind of journey. This. When I first got to CISA, it was the summer of 2021. It was after a series of high profile breaches and hacks. Folks will remember Solar Winds and Hafnium and Colonial Pipeline and JBS Foods and Kaseya. And I remember coming in in July and started a series of sensing sessions and I used to do these office hours and one of my teammates who was a threat hunter came in and sat down in my office. It was just the two of us and we started talking about what he was working on and some of the challenges over the past few months. And you know, he almost started tearing up because he was clearly under this enormous stress and enormous pressure from all of the things that he was doing to try and make sure that we were protecting and defending critical infrastructure, obviously the mission of cisa. So we had a great discussion about, you know, what are the resources available to incident responders and threat hunters and cyber defenders more broadly. We talked about, I think Christina Moslak at that point in time, and you can talk a little bit more about how that intersects with your work. But, you know, what are the tools, frankly, that cyber defenders can use to help deal with the incredible stresses and pressures and to help deal with burnout? And off the back of that, we actually made 2022 at CISA the year of what we called mental health and well being and looked at all of the things that we could do, the resources that we could help provide, our teams to help them deal with all the stress and all the burnout. And so when I discovered the work that you were doing and had been doing with other cyber defenders, I think it was in Australia is where you kicked off. I was just really excited about the ability to provide more tools in the toolbox for our cyber defenders at CISA and then more broadly around the country. So that's where this whole motion picture starts, started. But that's why, you know, I'm, I'm equally passionate about it. And frankly, the stress and the burnout has only gotten more intense, frankly now with all of these new AI powered tools. And so I think it's a really, really timely topic just for us to chat on this podcast, but also to talk about the study that you just did. So over to you, Peter.
- [03:59]
D
Thank you very much, Jen. And can I just say what a delight it is to be talking to you again and how grateful we are for the leadership that you've shown in this space. You know, even before we came on the scene. I know that it's a personally important issue for you as well. And I also acknowledge the generosity that you'd showed to us early when we launched in the US actually in 2023, encouraging people to come in and check out what we were all about. So we've now established in the U.S. australia, where we began and, and the UK as a non profit. My own journey, I had prior to that about 25 years in cyber leadership. I used to run the Australian national association for the Internet and we started focusing on Cyber back in 97. So we'd done some really interesting work around resilience building, awareness raising, industry codes of practice, even the I code, which ultimately found its way into a US variant through five eyes in the White House. And I guess that's one of my proudest achievements that we were able to build something that was best practice in Australia, but also then became something that could support our broadband Internet users in the States and elsewhere. But it really showed me that if you came up with an idea that was very timely and it was solving a real problem, that you could actually make an impact. And so back before COVID I was already back in a leadership role within the Cyber Security Advisors Network, which is a global non profit, originally started in Paris by a friend of mine, Jean Christophe Le Tocan. He's a great leader in his own right, but we were seeing burnout in our colleagues within this organization. I started doing stress management, just very ad hoc sessions with people that I been working with and saw that there was a real appetite for this. And then of course, we got hit by the pandemic and we saw burnout rates basically escalating. I won't say going through the roof, but they definitely. We saw an uptick because we weren't able to travel. I decided I'd go back and do some more development and study on the back of a long history of my own. The way in which I took care of myself and studied the Irest protocol, integrative restoration under Dr. Richard Miller in California. So this is a really powerful methodology that they've used in many domains, but principally in the military. And I, I think I understood at that point that we had something that we could bring into cyber security for the first time. And that's effectively we built cyberminds, the organization, around this principal methodology that we're now bringing to teams around the world.
- [06:54]
C
That's awesome. You've published a new study, I think recently, and it really focuses on specifically resilience training. And then what I think is one of the most valuable things is how do you actually measure the real world impact? And so seeing some of the specifics statistics on things like sleep and how you manage stress and burnout risk. So I think, as I mentioned earlier, I've been around a lot of talented defenders, particularly in the last role that I had at cisaw that were under enormous stress. And as part of that study, I think you cite some stats, right? About 74% of CISOs reporting team attrition driven by stress. Roughly 2/3 of incident responders have sought mental health assistance after major incidents. I do want to pause on that for a second though, because I actually take that as a very positive thing. I mean, you mentioned the military. I grew up in the military. I spent more time in the military than I have done anything else is 21 years, after four years at West Point, and particularly the post 911 generation of folks dealt with massive amounts of stress and post traumatic stress syndrome and all of that. And it was really difficult to get folks to seek out mental health assistance. So, you know, some of the stats, around 2/3 of IR incident responders seeking out mental health assistance after major incidents. I actually take that as kind of a positive thing that people are actually doing that. But, you know, I think as we both know, this type of burnout, this type of stress has massive impacts on your ability to be operationally effective. And productive. So it's not just a human resources issue, frankly, it's a, it's truly a leadership issue. A leadership issue that, you know, CEOs, boards and then of course CISOs and their teams, you know, treating burnout as an operational risk, not an HR issue. So I love that your work broadly, and then this study specifically really illuminates all of that. But, you know, I'll let you respond to that.
- [09:13]
D
Yeah, but agree. And definitely on that last point, we had to start changing our messaging away from wellness, although that's important that we were finding we weren't getting enough traction with the senior leadership and the C suite when we were talking about these things in terms of wellness. So we decided, we kind of pivoted about a year and a half ago and started framing it in terms of operational risk because of course it is, it does carry those consequences. And I think that we're trying to give CISOs the language and the way back in to the board discussion around why this is important because it goes to resourcing. You know, for as long as it's sitting in the wellness bucket, the training budgets are going to be discretionary and they're going to be quite limited. The more we can move it into risk and particularly mitigation and managing it as any other risk.
- [10:10]
A
Right.
- [10:10]
D
Really for the organization, if you're defenders are not optimized or performing optimally, then that has a negative impact on your organizational risk posture. To the contrary. The more that we can bring in interventions to actually improve their sleep, improve their stress scores, improve and reduce their burnout symptoms and pre burnout indicators. That is all going to translate into better decision making, less errors, higher confidence in the decisions they're making, whether to escalate to triage or whatever. And so I think it is really, I mean, we still want to ensure that the wellness and the wellbeing is taken care of. But I just think, as you indicate, the implications are far more broad ranging than that. And I think that's really where we're now focusing our discussions.
- [11:04]
C
That's so interesting. So a lot more traction, characterizing it as operational risk.
- [11:11]
D
Yeah, because you go to these big conferences and I think these days the discussion's more around, you know, when a CISO goes into the board to seek further funding and support, not just to hit them with statistics and technical stuff, but more about the narrative of what this means for us. And so more and more the leaders are being equipped with the language to go and have that almost business level discussion. And I guess we're just tagging onto the back of that to say, don't forget the psychological piece should be part of that discussion.
- [11:44]
C
Yeah, 100%. Well, the study itself paints a pretty stark picture, frankly, of where participants were before the training started. And I also want you to talk a little bit about what the training is, but study cites things like excessive workloads, you know, shocker, right, Excessive workloads for cyber defenders. But you know how some are relying on alcohol, some, you know, already out sick. So can you talk just a little bit about what that baseline told you about the scale of the problem?
- [12:21]
D
In fact, we've done a couple of studies now. The first one, which is ongoing, we started in 2022, is where we are measuring the industry as a whole, across the us, uk, Australia, principally. And we're tracking sleep, we're tracking the stress indicators and we're tracking the burnout indicators. And what we're finding as we aggregate and update those findings is we've got about half the cyber population is reporting bad or very bad quality sleep. And we use a special metric called the Pittsburgh Sleep Quality Index, which is the gold standard for measuring sleep. Pqsis, known as, when you look at the other studies outside of cybersecurity, particularly around aviation, is a really good example, and you look at where pilots are deemed fit to fly. The short point is that based on what we're finding, half the population, if we were pilots, would have to self disclose unfit to fly. And yet here we are trying to defend critical infrastructure. But I mean, that just puts it in a bit of perspective.
- [13:32]
C
Crew rest. Crew rest for cyber defenders.
- [13:35]
D
Yeah, right. But it's not there, Jen. It's not legislated, it's not regulated in any way. And yet so much of our critical functions are all hanging off the back of cyber defenders being able to perform when we look at other metrics, like carrying two or more concurrent burnout indicators. So you mentioned Christina Maslach, who developed the core standard for burnout. She identified three main dimensions of burnout and we track all three. One is exhaustion, emotional depletion, we call it. The second is cynicism, or sometimes called depersonalization. And I can explain each of these a bit more. And the other one is professional efficacy, how well you regard yourself as doing well in your job. On those numbers, we're doing quite badly. In fact, in our original study, we released a finding that showed that on the professional efficacy metric, we were performing worse than frontline healthcare workers. And that was on the tail end of a pandemic so doubting our ability to do well in our job. And partly that's because of the lack of visibility of success. In cyber. We know maybe when we're winning to the extent we're preventing breaches, but we can't really demonstrate that in any tangible way. And so you don't get the kind of validation that let's say a frontline healthcare worker will get. If you save a patient's life, even if you lose a patient, they're not going to blame you personally. Because in cyber we're working in a different mindset. In terms of the exhaustion, we're tracking levels of around 66% reporting high or moderate levels of emotional exhaustion, just completely wrung out to the point where you're starting the working day and you're already tired. And then the cynicism is really quite a concerning one because that is the predictor of resignation intent. When your levels of cynicism go up, basically you're not feeling connected with the mission like you were when you first came in. So a lot of what we do when we do our training with organizations is to really help people track back into the why they came in and really connect back in with purpose. Because that actually turns out to be a bit of a buffer that if you've got a strong why and you're part of a team and you're all heading on the same, you know, on the same trajectory and you know why you're doing what you're doing, that can actually be very supporting. But alone, it's not enough. But it's definitely one of the strategies that we think we can implement on the sleep. Did I mention about half of sleeping poorly?
- [16:23]
C
Yeah. Well, what I want to know is, I want to know how do you improve sleep?
- [16:29]
D
Right, well, that's right.
- [16:30]
C
I'm asking for myself.
- [16:33]
D
Well, so this is really interesting and we could do a whole podcast just on sleep. The short point is that if you are in a high stress job and you are not allowing for sufficient time for recovery, you get to the point where not even sleep is restorative for you. So we need something deeper than sleep actually to reset because all our ancient physiology is getting triggered. The flight and fight mechanism, which is all predicated on a physical threat actor. Remember when we were in back in caves, supposedly the proverbial saber toothed tiger and everything's designed to escalate in the face of a threat and all your limbic system switches on and cortisol goes up and adrenaline starts to pump and then of course, what's meant to happen is you're meant to de escalate after the threat has passed. But if the adversary is virtual, you can't see them, and it's constant, then there's nothing actually to signify to the nervous system that you're ever actually safe. And that's the reason why often sleep is disrupted because part of you is still running cycles and the subconscious mind is still turning over. And we see that with incident responders, say in a mid breach, their sleep is terrible because they're waking up in the middle of the night thinking, what did I miss? And if you're a SOC analyst, we see that they have very high levels of what we call sleep latency, where it's harder for them to get to sleep. So there's the idea of getting to sleep and then there's the idea of how do you stay asleep? And the dynamics basically translate back into what can you do to de escalate the system before you go to bed? Because if you can actually install. What we effectively do with the training is we're actually installing a manual override that evolution didn't have time to develop for us yet, where we can actually go and de escalate in a more conscious way. And then we found him with sleep, we're giving them an extra 26 minutes a night. It's about three hours a week, which is pretty significant. And the number of good sleep has doubled from 27% up to 47% after the eight week.
- [18:49]
C
So it's fascinating to me because I've been, you know, I'm a big sleep tracker. I have all these, like, whatever it is, these devices, things on my phone, because I found when I was growing up, I slept like three and a half, four and a half hours, you know, growing up, meaning when I was a young soldier in the army. And so I am now obsessed with getting like seven hours of sleep a night, which I rarely do. To me, it's like a lot of routine, you know, go to bed at a certain time and then be very disciplined about when I get up and work out and all of that. But talk to us a little bit like, give us a sense of this training and then I want to hear the results.
- [19:29]
D
Yeah, it's really interesting. So Richard Miller is a clinical psychologist. He's been practicing about 50 years now. He's actually on our board. So we're just so privileged to have the actual developer of the protocol directly involved in the work of cyberminds. And he's actually shepherding the way in which we customize his protocol, which has had that widespread application in military and emergency responders and other domains. But Richard's actually helping us to optimize it for cyber security, which is amazing in itself. But the Protocol is a 10 step sequence. It's a guided technique where you have a facilitator or a recording of a facilitator. Once you've done the training and you're walking through different levels of your own being. So you're working with the physical body. So we're working with breath sensing. Actually, I should backtrack. The first thing we do before we start the training is we show people where they have within themselves already a center of psychological safety. We call it the inner resource, for lack of a better word. So we say that we each have this internal resource that is always resilient, always. Okay. And we're showing them how to ground back into that. So that even during the process, as we train them, if anything comes up, like a past memory or a trauma or something, you've already got somewhere to go that is safe. And that's how he got such great success in the military. Working with veterans from Iraq and Afghanistan was able to bring their PTSD down from the highest clinical levels down to subclinical levels in about 12 or 18 sessions.
- [21:13]
C
Wow.
- [21:14]
D
So we do the same thing. So basically you're actually giving them a grounding in a safe psychological space where they can sit and do the practice. And then progressively working through body sensing and then breath sensing, you're starting to move into slower brainwave activity. So you're taking them down to the edge of sleep and you're getting into that little drifty state. You know how you are just before you fall asleep. And it's a very powerful state because there you tend to get direct access to things that may not be necessarily aware of, but maybe the things that are keeping you awake or keeping you anxious. And so you get to bring them in and then progressively you start to work with beliefs, underlying beliefs, or unprocessed emotions, or unprocessed anything really that's there that's going to get triggered. And so this is why it's very different from like the classic talk therapy where you just sit down and talk about it. Not to say that doesn't have a role, but we're going much deeper back into the. Essentially you think about root cause analysis, right? We're coming down into the operating system of the mind where the really big powerful tectonic plates that move around that govern how you respond to Life, that's where it's all stored. And we're going in there and we're starting to diffuse the embedded stressors that have been sitting there maybe for 10, 20, 30 years in some cases, or trauma even from childhood. And we're working with that. And so progressively, it's also very pleasurable. It sounds a bit scary, but really what you're doing is you're feeling very relaxed, very in control, and then you gently start to work over the weeks of training with some of the things that are more challenging for you, and you actually start to reach a level of reconciliation internally, a sense of peace that you essentially. Sometimes these stressors, all they want to have is to be acknowledged, and then often they'll just release. But it's the more that we repress and deny and just don't pay attention to it, they tend to hang around. So this is what we're doing. And so over the number of weeks of training, we find that they report the people that we work with, cyber defenders in all different roles, leaders all the way through to individual contributors. They start to say they're sleeping better, they're maybe feeling a better sense of perspective over their work. They're making better decisions because they feel like they've got more clarity because there's less noise going on in their heads. Yeah, right. And you get this recursive thinking loops that we all get stuck in when you're working on a problem and, you know, you're feeling frustrated or whatever. And we're teaching them how to actually move into other parts of the brain. So we're deactivating or de energizing unhelpful brain processes and networks. And we're re energizing the parts of the brain that correspond to emotional regulation, sense of perspective, your ability to concentrate and focus, all that. And overall you just start to feel a lot better because finally you, you know, you're cleaning out the attic effectively and coming back into a state of what we'd like to think as equilibrium. So that's in a very short way, the methodology. We also take them back into a sense of joy and gratitude within themselves so that we start to ground within them, anchor them back into better places within themselves, show them how to find that. And then ultimately, by reinforcing the why, the connection with mission as well, you end up with teams that have a lot in the morale improves. We love to do it within the whole group, even with the leader as well, so that they're modeling the right kind of behavior. Empathy improves your sense of Concern for others because you're now not suffering as much yourself. So you've got more bandwidth to give to the people around you. So it has all these beautiful sort of flow on effects. And then I think this is like what the short term intervention looks like. In the long term we really think that we've got to build this in as part of a sustainability plan. Because the trap here is that an organization will come into a short term pilot, will get all these great results. But three months down the track, everything's back to where it was.
- [25:49]
C
That was going to be my other question. I mean we're going to provide the study I think in the notes and if you look at the stats, I think they're pretty impressive, right? The reduction in 26.5% lower cynicism, 10.3%, higher professional efficacy, 19.3% lower emotional exhaustion. Like those are all fantastic. What leader would not want to have those results for a team? But then how do you sustain that? I think is the question.
- [26:19]
D
Right, I think that's where we want to focus next because we've worked with a lot of organizations now, Defense, national security, or through the private sector defense contractors here in the U.S. you know, that's the thing. We want to give them the stats, we give them the metrics. And then we say now we have to help you go back in and advocate that we can make this a long term thing because you know, cyber, the stress or stresses are never going to go. This is inherently stressful work. But the key is it's about baking and recovery periods. It's the key is how do we institutionalize recovery. That's the key. And if we can get that right, then I think, you know, we're bringing a message of hope to cyber teams. That you can be in this profession that you love, but you're not going to lose your health, you're not going to lose your own internal sense of who you are and why you're doing this. And I think that's really the vision here for cybermind is just as we optimize networks and all the physical infrastructure, we've got to progressively now re optimize the humans. And you made the point at the beginning about AI. I mean, if you want to talk about that a bit, I can share some perspectives on what we see there.
- [27:37]
C
So many different questions that I know we don't have that much longer and I really want people to be able to read through this report. But yeah, tell me a little bit about the AI aspect of it and then I Do want to just close with, like, the one message that you want cyber defenders to take away from this research? Because I want folks to check out the study, to look at the protocol and really just to have a sense of, you know, the big bumper sticker I'm taking away is, you know, reject cynicism, embrace joy. That is key to human resilience. And, you know, it's part of my own personal ethos as I get older and try and find those wellsprings that really help me manage stress and issues and be the leader that, you know, folks depend upon to inspire and to get hard things done. But talk a little bit about the AI angle and then give me your one big takeaway.
- [28:35]
D
Yeah, I shall do that. So the AI thing is really interesting. I mean, you can't go to any conference these days and you go onto the exhibition floor and everyone's flogging an AI tool. And I mean, it's great and we need it. But if anyone believes that somehow AI is going to solve the burnout problem, I think that's probably very premature, if anything. And you know, Jen, from your work, the history of technology is that technology tends to favor the adversary. There's an asymmetry there because they're not bound by laws or jurisdictions or ethics or morals, and they're often the early adopters as well. So I think in the short to medium term, prognosis is that we're going to see all these automated attacks increasing sophistication and tempo. At the same time, organizations and cyber team leaders are under pressure to downsize to save costs. So they're culling headcount. So you've got this dual almost perfect storm where you're going to get attrition through organizations seeking to leverage AI to replace humans. At the same time as the attackers are implementing advanced AI to actually improve their success rate in breaching organizational security. So whoever's left behind in that new world is going to be under increasing pressure. And I think if we can get ahead of the curve and really recognize that this is something that's likely to occur, the more that we can come in and do. We love the preventative work, Jen. We come in and we can help major organizations during a breach or after a breach and try and get the trauma back under control. But it's always better to have resilient teams before the incident because they're less likely to suffer the consequences, the fallout from whatever the psychological impacts will be. In Australia, we've got new workplace psychosocial workplace regulation, hazard reduction is now a corporate compliance requirement.
- [30:44]
C
I didn't know that. Interesting.
- [30:46]
D
Yeah, just every state's doing it now, so. And we've worked with a law firm that's given advice around this is a foreseeable risk in a cyber team in a major incident, that the psychological harm is something that is predictable and needs to be managed. So the short point on the AI is I think probably things are going to be more challenging before they start to resolve. And therefore, we really need to be going in and giving the teams the support and the encouragement and the tools and the systems and the embedded recovery processes so that they can be better there to withstand what's coming. As to my message of hope, which is really, I love the bumper sticker analogy, I'd go a step further. You know, I put a post on LinkedIn, I don't know, three or four months ago, which you liked, about bringing love back into cybersecurity.
- [31:41]
B
Right.
- [31:41]
D
If you will indulge me for a moment. I'm not talking about romantic love, although, you know, that can happen. But it's more about love of the brotherly and, you know, sisterly. We're part of a movement here, all the cyber defenders. We generally love the mission, we love the work. And if you don't like love, then you can substitute kindness. But it's about how do we build an environment in which we all feel that we're supporting each other, that we have the empathy and the capacity to sit back and just check in and see how people are faring on the team. And I think when you yourself are in burnout, particularly as a leader, you lose the capacity to actually have those conversations because you're struggling yourself. So the more that we can start to equip people with the restoration and the recovery and we rebuild their cognitive and emotional reserves so that they've got more to give themselves initially, but also then to give their families and everyone else in their lives, then I think that's a better world for cybersecurity. So I think, you know, if I want to be have anything carved on my epitaph when I go, it would be something like bringing love back into cyber defense, cyber security. I think anything that we can do in a positive way that we can measure that we know nervous systems can recover and heal, we can do all that. I think that's the contribution that we're here to make. And I think with, you know, your kind of leadership and advocacy and others. We're working a little bit with Tim Brown now. He's loving what we're doing fantastic. So we're really trying to get all the leaders in the room and basically say, look, this is a movement. This is not just some sort of small initiative. This is a big vision, but I think it's a necessary one and I think the time really is now. Should be doing this.
- [33:36]
C
Fantastic. So bring in the love. Bring in the love to cyber.
- [33:40]
A
Rock on.
- [33:42]
C
That is a great, great place to leave it. Well, look, my friend, it is great to see you again. Thanks for everything that you are doing for our community and I hope to see you sometime soon. Casey, back over to you.
- [33:58]
B
Yeah, thanks so much, Jen and I agree that's such a powerful place to land. There are two lines that will stay with me. One from the study, which is the performance of security systems depends on the resilience of security teams. And one from this conversation is that question that you asked Peter, how do we institutionalize recovery? And you know, the conversation, I go back to the sleep and developing a real, very clear routine sleep pattern and the breath work really does calm that parasympathetic nervous system and prepare us all for resilience. So really powerful, valuable conversation. We spend billions hardening our technology and this research makes the case with data that we need to just be as rigorous about sustaining our people. So, Jen and Peter, thank you so much for being here with us today, for joining us and bringing real measurement to a problem the industry has felt for years but rarely been able to quantify. Listeners, thank you for tuning in. Please keep the conversation going in the RSAC community using our hashtag rsac and be sure to visit1rsac.com for new content posted year round. Until next time,