Mental Health and Security

Mental health and mental wellbeing is very important and is often overlooked in the security industry. This post discusses the four most common issues and proposes some solutions.

Mental Health and Security
"Every person you meet is fighting a personal battle you know nothing about" - Unknown, 2019

A bit off from the norm of writing but a very important topic. Mental health and mental wellbeing is very important and is often overlooked in the security industry. It is not an issue that affects us as a community exclusively however I'll take a stab and say we can be in very tense and high stress environments which wouldn't seem it from the outside as its a passion or a hobby that we as hackers/techies get paid for.

However, it is very important to take a step back now and again and re-evaluate what you are doing, if you are healthy from a physical and mental standpoint. It can be very easy to just stick the head down and think everything is fine till it is not later down the line. It is an area where I struggle a lot is talking to people about my feelings and what's going on. It is the reason I took a step back  in October to re-find my feet and try to find where I could alleviate some of my stresses in life.

The Problems

Fucked Up Insecure Neurotic and Emotional (FINE)

There are lots of issues surrounding mental health and I'm not going to even attempt to cover them all because 1) I don't know about them all and 2) I'm not an expert. The four most common that I've experienced and seen in this industry fall loosely into these:

  • Imposter Syndrome
  • Burnout
  • Depression
  • Anxiety

Imposter Syndrome

This is probably one of the most experienced problems/issues, the feeling of not belonging and not knowing what you're doing is one that affects all of us in this industry of information security. It happens throughout our careers, be it the first job you're on as a consultant or the first CTF challenge you encounter as a seasoned professional.

Working in offensive/defensive/general information technology/hacking/security risk/all of the above, you will likely encounter a lot of individuals who feel the same way but rarely let on that they do. Recently I sat an exam and the others sitting the exam were, like me very nervous (even though they'd sat it before and passed); this got me thinking. How many individuals does imposter syndrome actually affect? And, how can we collectively as an industry work to change that?

Do you ever sit on a test or in a meeting with clients and just think, "one of these days I'm going to be found out I know nothing!", yeah? Me too and many other folks do too. It's not just exclusive to infosec either, I have many friends who are in other industries who have been doing what they do for twenty plus years who feel the same way.

Burnout

Stress is the faceless demon which eats at all of us

No not that kind of burnout, but yet a pretty picture to perk you up a bit. The burnout I'm discussing here is the feeling of being overworked and over stressed. Being burned out also referred to as burnout is a state of emotional, physical, and mental exhaustion caused by excessive and prolonged stress. It occurs when you feel overwhelmed, emotionally drained, and unable to meet constant demands.

You, yes you reading this right now may have experienced that feeling before of not seeing a way out and being on projects back to back, maybe you're a project manager taking on many topics one after the other, or a security consultant who's working with clients all the time one after the other week on week or maybe you're just stressed from long days of learning and expanding your knowledge. Nine times out of ten it is fine but sometimes it can build up to a crux where it is too much and you cannot cope.

Having the issue of burnout is important to notice when you are too stressed or worked out, and realize that taking a step back is the right thing to do. Taking some time out or making space is the correct action to alleviate your stresses and make space to get your head above the metaphorical water that you are drowning in.

Depression

That feeling that your mind is on fire and nobody else can see it or the days where you wake up and feel empty inside or the other days where you cannot bring yourself to get out of bed, not because you're lazy but because you feel you physically cannot. Sound familiar? Yeah some of us have been there, some of us are there right now, depression is a horrible feeling and it happens to the best of us.

I've seen many people on top of their game in this industry have dark days, I've seen others burnout overnight and remain in a negative state, from personal experience that is not a fun place to be but as a community we need to lookout for each other.

Depression is a serious condition. Don’t underestimate the seriousness of depression. It can  drain a person of all of their energy, optimism, and motivation. People suffering from it cannot just “snap out of it” by sheer force of will.

The symptoms aren't personal, depression makes it difficult for a person to connect on a deep emotional level with anyone, even the people he or she loves most. In addition, depressed people often say hurtful things and lash out in anger.

Hiding the problem won’t make it go away. Don’t be an enabler. You can’t “fix” someone else’s depression. Mental health is different to something like a cold or a broken leg, you cannot just tough it out or attempt to fix it. Ultimately, recovery is in the hands of the depressed person.

Anxiety

The higher you become, the further there is to fall, the more fear there is of falling

Self-doubt, fear, worry, imposter syndrome, these are all symptoms of anxiety and much like the other topics above they all fall together. If you suffer from one you have probably experienced one of the others too.

Anxiety makes us question ourselves both from a matter of being but also from an angle of 'do I belong here', 'am I good enough at this really?!'. Once self-doubt beds itself within your thoughts anxiety makes it grow and it takes control of how we view ourselves, we fear what we enjoy will be taken from us when anxiety sets in. Ever been told something and felt yourself fearful of a meeting, an encounter or something else, losing sleep over what from the outside would be deemed minute and silly? Yeah, I've been there, others have too, it is an awful feeling and it can turn into a vicious circle of worry and fear.

Fear not though there is light at the end of that tunnel, there are solutions, even when each day might feel like a vertical struggle you have got this.

One thing I would say that can help prevent anxiety and burnout is learning when to manage other people’s expectations, and learning when to say no. Especially in a work setting, telling someone a piece of work can’t be started for a couple of weeks is both good for them, and stops pressure building on you before it’s even started.  

Feeling like you have to take on every bit of work, or commit to every project is storing up anxiety, and potentially creating problems for others down the line. It takes confidence to say no, but it’s better than working more and more hours trying to keep on top of an out of control hamster wheel.  

There’s also a disconnect between what we accept from other people, and the allowances we will make, and the pressure we will put ourselves under. Give yourself the same allowances you give other people. Set expectations the same.   And, especially at work, if you feel like you can’t stop, or can’t take a break, because you’re too important to the company and things will go wrong if you’re not there, the company has a problem, not you.

Highlight it, put mitigations in place, take the pressure off yourself. This helps both you and your employer.   Don’t be the guy troubleshooting an issue on the phone while wandering round the Doge’s Palace in Venice, marveling at a collection of enormous antique globes.

Proposed Solutions

I've talked and blogged before about how important it is to have life escapes and switch off, my two choices in these fields are driving and karate. Both require a level head and can also carry their own stresses but the main thing is they take my hands off a keyboard and apply them to other things.

As an industry and in general I think the best way to go about helping is to recognise and praise folks where praise is due. Don't be afraid to tell someone that they're doing well or that you appreciate the work they're doing in a particular area. Not everyone knows that they're great, or even believes that what they do is making a difference/helping others.

We're human after all, and no matter the subject matter; it doesn't need to be security, this applies to everything and anything ask questions, keep learning. Help others where you can and just be genuine about things, try to be honest when you don't know.

Remember it's all in your head, believe in yourself. Treat Every Day as a school day, an opportunity to learn something new or an opportunity to pass on knowledge. Be yourself, don't compare yourself to others, accept that being wrong doesn't make you a fake or a fraud it is human nature; we can't be right all the time(no matter how hard we want to be!).

When it comes to tackling internal struggles like stress, don't be afraid to take a step back re-evaluate where you're at, take a holiday even a long weekend and unplug spend it just chilling out with your family or your friends, take a walk get fresh air even if it is just for a minute, take a deep breath, whatever you're doing just now just breath for a second just focus on that breath, slow in try to relax then exhale slowly.

The biggest escape I find works a lot is music, find something that calms your mind, chuck on some headphones and forget about the world. Look after yourself, you are the most important thing, you do you and take your time. Here's a bit of LoFi hip hop jazz that I chill out to sometimes:

Educating Yourself / Helping Others

Sometimes it can be difficult to know what to do for someone who is struggling, I know what it is like watching someone suffer in silence and to feel useless or helpless. There are steps you can take to help someone in need though;

  • Be there for them, even just someone to talk to can make a world of difference, let them know that you care and GENUINELY care don't be that person that says 'I'm here for you' when you're not really.
  • Tell them they are not alone in this. And that it will get better one day.
  • When you want to give up, tell yourself you will hold on for just one more day, hour, minute—whatever you can manage.
  • Ask them what you can do to help them and try to support them.

There are lots of options out there, we as a community should look out for our own, look after ourselves and help others in need. There are lots of initiatives out there setup to support those with poor mental health;

We all have good days and bad days, know that it is  okay to not feel okay and there are options out there for you.