Posted: 4 Min ReadFeature Stories

RSAC 2019: Stress and Burnout Takes its Toll on the Security Industry

It’s now common to find employees suffering daily doses of stress in an industry where burnout is common, overlooked, and, unfortunately, often rewarded

When they think about the challenge they face from attackers, the people who work in computer security usually have a clear idea what they’re going to be up against. But while they throw themselves into the daily struggle to protect their organizations from malicious hackers, many aren’t aware of another, equally insidious threat lurking in the shadows: Stress.

"More attention is focused ensuring a nearly infallible security posture, and little on security teams," said Josh Corman, the chief security officer at PTC, a computer software and services developer headquartered in Boston.

It’s a topic that Corman knows from first-hand experience. During the recent RSAC 2019 conference, Corman delivered a personal and frank keynote about the consequences of stress and the burnout it generates. Through the years, Corman said he has witnessed many friends and colleagues change and diminish as employees and as people under the weight of mounting and sustained stress. He also saw how companies reward people for high-performing herculean efforts, only to label them as weak under pressure when they have nothing left to give.

Corman recalled attending an industry conference in Las Vegas, where he interviewed several of the participants asking if they ever suffered from stress and burnout. He was stunned by the admissions of suicide attempts, drug and alcohol abuse, and guilt and shame over putting work before family events.

At the same time, Corman said that attitudes also change when it comes to stress - reaching the point where employees start treating each other with increasing toxicity. Even though companies want to bring more security people on staff, many often fall by the wayside due to high stress on the job. It leaves companies pushing a boulder up a hill only to never reach the top.

Corman raised the possibility that the hard-charging tech business could do itself a double favor: If empathy replaced competitiveness as a dominant principle, he suggested, might it not also lead to a stronger industry?  Berkeley psychology professor, Dr. Christina Maslach, the inventor of the Maslach Burnout Inventory, the most commonly used instrument for measuring burnout, offered some statistical ammunition to back up Corman’s idea.

Daily Doses of Stress

Maslach got the term "burnout" from people she interviewed, while discussing their issues and their stress. "Burnout is a response to chronic stressors," advises Maslach, "every day stuff, not just the crises or emergencies, but the things that take away the good of life over time."

In the Maslach Burnout Inventory, there are three main areas where she takes a measurement of a person's wellbeing:

  1. Exhaustion – the classic stress response to the demands put on a person when there's not enough resources.
  2. Cynicism – to become negative, cynical, even hostile about the job and the other people involved. This hardening of the human heart has ripple effects that contribute to poor performance, absenteeism, and mental health issues. People in deep cynicism turn on each other, creating a toxic space where no one is thriving.
  3. Perceived Self-Efficacy – when a person loses her sense of "I'm really good at this" and it becomes "what am I doing here?" or "did I make a mistake being here?" This person no longer feels competent or confident in her work environment.

In addition to the three area measurements, Maslach talks to people about whether the jobs they are in are a good fit for them. She discusses six possible mis-matches or imbalances:

  1. Workload – is there an imbalance of expectations to resources?
  2. Autonomy – is a person allowed discretion and choice on how the job is done?
  3. Reward – is social reward and recognition given (often more powerful than monetary rewards)?
  4. Community – are the workplace relationships supportive or is there unresolved conflict like bullying?
  5. Fairness – are things done fairly like who gets the next opportunity or raise or nice office space? The work place needs to be fair to everyone.
  6. Values – does the work and the environment give value, purpose, and meaning to one's life?

Maslach is often asked whether it's the person causing the burnout and she says no. The usual corporate response is to say that the person caused the burnout: she needs a better diet, better sleep, try meditation, exercise more, or just toughen up – but it's the environment that has to change.

Corman believes we need to change the tone of how we talk to each other. Maslach agrees that a culture of fear is present in companies where people don't dare to say no or show a sign of weakness. People fear they'll go down the list as a person who will be supported and promoted.

Also, when people reach out for help they may get slapped down. Toxicity deadens the communication that helps us grow.

The usual corporate response is to say that the person caused the burnout: she needs a better diet, better sleep, try meditation, exercise more, or just toughen up – but it's the environment that has to change.

The advice that Corman and Maslach offer on what we can do as employers and individuals is to work back from the burnout. The burnout comes from exhaustion, cynicism, and poor self-efficacy –the result of some or all of the six imbalances listed above. An excellent place for a company to focus is the toxicity that has developed in the culture. Work on how people talk to each other.

In his work place, Corman found that not having toxicity in the community led to solutions to the imbalances that cause burnout. Instead of coming up with a "diversity initiative," a company may want to employ an "empathy initiative." People are attracted to safe places with honest support. They are drawn to a well-built culture. Employees will do all they can to promote their company's bottom line and presence in the industry because they want to protect the place where they thrive. The problems of diversity, a shortage of people, and burnout? Those simply disappear.

You might also enjoy
Feature Stories3 Min Read

RSAC 2019: The Human Side of Security and Privacy

Research in three key areas looks into how to work with common human behaviors

About the Author

Rebecca Donaldson

Symantec Cyber Security Staff Writer

Rebecca Donaldson is a writer and community manager for Symantec. For over ten years, she has had the privilege of publishing content that captures the guidance and information of Symantec experts, customers, and partners.

Want to comment on this post?

We encourage you to share your thoughts on your favorite social platform.