As published in the July/August 2020 edition of InfoSecurity Professional Magazine
By Deborah Johnson
How to stay sane and manage stress during a most unusual time, no matter where you live and work.
Every day, cybersecurity professionals face pressure, from the daily demands of protecting data and people’s privacy to the worst-case scenarios of a breach’s financial and reputational repercussions. That’s nothing we didn’t already know. But what’s changed in the past six months is the level and severity of those demands since the world’s response to COVID-19 required companies, citizens and cybersecurity professionals to abruptly pivot in almost all ways.
Managing added levels of stress takes some internal assessment: What’s causing it? What can I do about it? Do I need professional help? And how do I determine what stress reducers work best for me?
RECOGNIZE THE SIGNS
Even before a pandemic forced a new way of life, cybersecurity leaders were feeling the pressure. Of 400 CISOs surveyed prior to the coronavirus outbreak for The CISO Stress Report 2020 commissioned by London-based Nominet, 88% considered themselves to be under moderate or high stress.
“Security professionals are very aware of what the risks are,” says Nashville, TN-based Lucie Hayward, CISSP, CISA, PMP, the senior vice president of cyber risk at Kroll. “A good security professional is always ahead of the latest news, trends.”
The responsibilities at work can sometimes overwhelm and lead to frustration, says Leah Aguirre, a licensed clinical social worker and psychotherapist based in San Diego. “For a lot of folks, it’s losing focus. They’re working really hard, but they’re not really being effective with their work.”
Psychologists and other clinicians offer clues that your stress level may be entering dangerous territory:
- Difficulty in concentrating, inability to retain information
- Constantly worrying, expecting the worst
- Feeling isolated
Everyone experiences these symptoms at some point in their life or career. This includes cybersecurity professionals pressed into action to lock down systems without locking out remote workers during sudden shutdowns.
Anxiety on and about the job tops the list of symptoms, says clinical psychologist Kevin Chapman. “Many of the clients that I see have anxiety about performance, whether that be social, or negative evaluation from superiors or col-leagues, whether or not they’re meeting their marks.” The anxiety is also carried home, adds the founder and director of the Kentucky Center for Anxiety and Related Disorders in Louisville. There’s “also the financial reality of needing to provide for their families.”
The challenge is how to manage the stress associated with chronic or acute anxiety.
TAKE CHARGE OF YOURSELF
The Nominet survey revealed 48% of CISOs reported stress had affected their mental health, and 35% said it affected their physical health.
“Is there any way you can work smarter?” clinical psychologist Melanie Greenberg, Ph.D., based in Mill Valley, CA, asks. “Increasing your exercise, turning to people you’re close to for support. Perhaps taking up meditation.”
Greenberg, author of The Stress-Proof Brain, says that while you may not be able to change your workday, you need to “try to be a little bit creative” to make time for yourself, such as finding somewhere to eat your lunch rather than at your computer.
Aguirre, the licensed clinical social worker, agrees.
“If you’re sitting at a desk all day long, it’s good to have a change of scenery. Go for a walk.” And, she advises, don’t forget to eat regularly and drink lots of water. “People neglect their appetite and basic needs when they’re stressed, focusing on prioritizing work.”
The American Psychological Association suggests an online tip sheet to adequately respond to increased stress. “It’s not always possible to escape a stressful situation or avoid a problem, but you can try to reduce the stress you are feeling,” an APA web post says. “Evaluate whether you can change the situation that is causing you stress, perhaps by dropping some responsibility, relaxing your standards or asking for help.”
Making time for yourself can help manage the stress:
- Find personal outlets, such as exercise, meditation, diving into a new hobby like crafting or model building—all to engage you beyond work.
- Break up the day when possible with mini exercises and walk breaks.
- Eat lunch somewhere other than your workstation.
- Don’t forget to eat regular meals and drink lots of water throughout the day.
- Analyze the stressful situation for options.
Fortunately, these can still be done when ordered to shelter in place to help stop the spread of a killer virus. But the sudden disruptions COVID-19 caused and the ongoing fallout, especially for those on the front lines, can make it difficult to follow these simple-yet-proven tactics.
If you continue struggling to manage your stress and address your anxiety, it’s likely impacting your personal relationships and job performance—creating the exact conditions you want to avoid. According to the Nominet survey, nearly a third of CISOs reported that stress affected their ability to carry out their jobs, up from just a quarter in the previous year’s survey. (This figure likely has risen since the pandemic hit businesses in a big way.)
UNDERSTAND ‘OFFICE’ DYNAMICS
Whether you’re a manager or a team member, knowing what is expected of you, as well as your expectations of others, is another key to handling stressful situations.
As a manager, all eyes are on you.
“Whatever your title is, people are looking to you to be calm, logical, provide answers,” Ping Look, a senior director of Microsoft’s Detection and Response Team
in Seattle, says.
There also are those who may take on too much. “It becomes overwhelming. People want to ‘boil the ocean’—‘I want to solve all the problems, all the time.’” What’s necessary, advises Look, is prioritization. “What’s really important [is] ensuring that your workforce has what it needs. In the end … you have accountability for your decisions, and you have to think about the meaningful impact that you’re making.”
Communication is another key to helping ease the stress. As a manager, Kroll’s Hayward advises: “Definitely make sure that you are planning for employee communications and how you’re going to keep them in the loop.”
Share your plans with the full staff, she adds, even those who are not directly involved in a crisis but who are worried about completing their own assignments and even getting paid. “Really be transparent with employees to the extent that you can. They should be reassured by their employer that you’ve got things under control.”
Team members, says Microsoft’s Look, also need to have an open line to managers by keeping their leadership informed and communicating things, such as “This is what we’re doing and this is how we’re accomplishing everything.”
But what if things are not working out? “It is unfruitful to just complain and say, ‘We just can’t do it.’”
The better course, she advises, is compromise. “Speak with your managers. Speak with your peers. Compromise to come to a solution.” But beware, she adds, of the “blame-storm—people finding something to blame.”
And, finally, learn to let it go. “There is a moment when you have to say, ‘OK, we’re just going to move forward. I’m going to do the best with what I have,’” Look advises.
When a major incident occurs, a key action to help man-age stress is to show coordinated leadership, advises Diana Contesti, CISSP, chief operating officer, DL Consulting. When leadership isn’t clear, “the stress level for the team goes through the roof because they don’t know who to lis-ten to.” Once team members know “who they are supposed to take directions from, the tech team has one less stressor.”
THE HOME OFFICE TRAP
Even before the COVID-19 pandemic, working from home was a growing trend. A 2019 survey by the International Workplace Group revealed that 54% of the 15,000 professionals who responded from different industries worked remotely at least 2.5 days a week.
By the time the novel coronavirus spread across the globe in the first quarter of 2020, companies large and small sent many, if not most, of their employees home to work.
Working from home has unique challenges and stressors. It requires structure and balance.
“If you have a family, there are so many distracting things,” Aguirre says. She urges setting up a daily routine. “It’s hard to stay motivated without routine and structure. People aren’t showering as often because they don’t need to. Wearing pajamas all day … those things make it hard to stay motivated and focused.”
Also crucial, she says, is a dedicated workspace. “I know a lot of people who will answer work email from bed and the thing about that is that your bed becomes associated with work. Your bed is supposed to be for rest and sex. It’s supposed to be where you decompress. We have all this technology that allows us to work from anywhere, including the bedroom, that can create a weird, blurred boundary between work and personal life.”
Another stress-inducer when working from home is getting work done, warns Greenberg, the clinical psychologist. “There may be some less accountability at home. Meetings may not be as productive. Sometimes people may be doing something else during the meeting.” A solution, again, is structure. “Set specific goals for yourself—and for your team as well, such as ‘What do we want to accomplish this week?’”
WHEN HELP IS NEEDED
For some (perhaps many) professionals, self-help might not be enough. Psychologist Kevin Chapman says there are clear warning signs. “When anxiety meets a threshold and crosses it to the point that it’s messing up things like sleep, concentration, ability to eat, fatigue and a whole host of symptoms, that’s when it crosses over into getting professional help.”
Other signs to watch for, adds Aguirre, include “being consumed by thoughts related to work. Having less interest in things you used to enjoy. Not engaging with your support system.”
Chapman adds that it might take more to get someone to seek help. “In most work settings, and I know that cybersecurity is no exception, it’s a very team-driven work environment that requires everyone to participate.”
The cybersecurity professional’s world—from data breaches to daily maintenance—is rife with stress land mines that each of us should avoid or address when we encounter them. As Microsoft’s Ping Look reminds us: “Sometimes people get bogged down with the assumption that just because they work in a technology field, it’s really about software, hardware, machinery. But it does come down to a people business.”
Deborah Johnson edits Field Notes and columns for InfoSecurity Professional. Her last feature for the magazine, which appeared in the September/October 2019 issue, was on how to avoid a layoff.