It is Monday morning and 9am has come too early. You did not sleep well; that unfinished client report weighed heavily on your mind. There is still sleep in your eyes as you log on, hoping that morning coffee will kick in soon. You worked through the weekend, there was just no way around it. Even so, you find you have 85 unread emails, the missed messages light on your phone is blinking, and there was more than one note left on your desk. All those messages have one resounding need: they need to be addressed ASAP. You already know you are in for a long day; the stress has already settled on your shoulders.
While we wish that this scenario was only fictional, we know that for many, this is an all too real description of their work life. And while we recognize this is a problem that affects everyone in all professions, this type of burnout is severely affecting the cybersecurity community.
The Statistics of the Burnout Pandemic
According to the Chartered Institute of Information Security (CIIS) 2020/21 State of the Profession report, job stress keeps 51% of cybersecurity professionals up at night. Of the hundreds of security professionals surveyed, the majority mentioned that stress and burnout have become a major issue during the COVID-19 pandemic. 47% said that partly this was due to overwork, with most working over 41 hours a week, and some working up to 90. 65% said that the pandemic made security reviews, audits, and overseeing processes more difficult. 66% said that the cancellation of events such as training sessions widened the skills gap.
How bad is burnout in the cybersecurity community? 54% of those interviewed by CIIS admitted that they had either left a job due to overwork or burnout, or have worked with someone who has. While the internal concerns were mounting, there were other things to worry about as well.
The Security Impact of Burnout
While a lot of the world came to a halt during the pandemic, cybercriminals did not. In fact, cybercrime was reported as “thriving during the pandemic,” especially driven by a surge in phishing attacks and ransomware. For companies, the average cost of a data breach soared to over $21,000 per incident during the pandemic and 5% of them cost businesses $1 million or more. 85% of successful data breaches involved defrauding humans rather than exploiting flaws in computer code. Schemes tied to phishing attacks comprise 61% of all data breaches.
This thought weighed heavy on the majority of employees across organizations. According to CIIS, 80% said that staff across organizations have been more anxious or stressed during the pandemic. In a recent UK survey, one in five workers report feeling more vulnerable to cybercrime since the start of the COVID-19 pandemic. 35% cite stress or fatigue as the most common factor, followed by 19% who contribute it to lack of skills and training to stay safe from cybercrime while working from home. With this a major concern, it did not help that 57% of cybersecurity professionals said their budgets are rising but not enough to keep up with their organization’s threats and needs.
These numbers and statistics are overwhelming but paint a very real picture of the current state of cybersecurity. So, are you completely lost and hopeless if you are feeling the effects of burnout? No, certainly not. But first it’s important to recognize the symptoms of burnout.
The 5 Stages of Burnout
Burnout is caused by many factors, such as overworking, unclear job expectations, and even workplace dysfunction. Since, unfortunately, these things are often common in the workplace it is imperative that we are able to spot and identify burnout symptoms before they progress.
-
The Honeymoon Phase
When we are assigned a new task, we often start by experiencing a huge surge of job satisfaction, commitment, energy, and creativity. In this first phase of burnout, you can begin to experience stress that is based around your new task.
-
Onset of Stress
The second stage of burnout begins with an awareness that some days are starting to become harder than others. You might find that your optimism is waning, and you notice common stress symptoms that affect you physically, mentally, and emotionally. Common symptoms can include anxiety, inability to focus, fatigue, irritability, and even high blood pressure.
-
Chronic Stress
The third stage of burnout is chronic stress. This is a marked change in your stress levels, going from motivation to experiencing stress on an incredibly frequent basis. This will be a more intense experience than in stage two. Some common symptoms are feeling pressured and out of control, chronic exhaustion, anger or aggressive behavior, and can include physical illness.
-
Burnout
Stage four is burnout itself and where the symptoms become critical. At what point you reach burnout is unique to you. We all have our own individual limits of tolerance, and no two cases are ever the same. You know you’ve reached burnout when trying to act like things are “normal” is often not possible. It will now become too difficult to cope with your feelings. Common symptoms in this stage can include behavioral changes, feeling empty inside, and obsession over problems at work or in life.
-
Habitual Burnout
The fifth and final stage of burnout is habitual burnout. This indicates that the symptoms of burnout, like the ones we discussed in the previous points, are so embedded in your life that things have increased and do not stop. You are more likely to experience mental, physical or emotional problems as opposed to occasionally experiencing stress or burnout. Common symptoms can include chronic sadness, mental fatigue and physical fatigue. Burnout also tends to create or increase feelings of depression.
Take Action
The wisest course to prevent burnout is proactively taking action. Whether you are currently experiencing burnout or not, the best thing to do is to take up self-care practices and build your mental resilience. The Mayo Clinic has a list of things they recommend to help you conquer burnout.
- Evaluate your options – Discuss your concerns and feelings with your supervisor. Work together to change expectations and reach compromises or solutions. Try to set a goal for what must get done and what can wait.
- Seek support – Reach out to talk to someone – co-workers, friends, loved ones, family members. If you have access to an employee assistance program, take advantage of these services. Virtual or in-person therapists also allow a professional to help you work through burnout.
- Get exercise and sleep – Regular physical activity can help you deal with stress and take your mind off work, while sleep restores your well-being and helps protect your health. Both are very important to take action against burnout.
- Mindfulness – Mindfulness is the act of focusing on your breath flow and being aware of what you are feeling at the moment, without judgement. By taking time each day to practice mindfulness, you can help face situations with openness and patience.
Don’t Suffer in Silence
There are other things that you can do to help yourself work through and take action against burnout. On the Social-Engineer Podcast, we have a series called the Security Awareness series. In that series, we interview C-level professionals and many have given their advice for conquering burnout. In a recent episode with Ed Skoudis, he mentioned that he personally has rituals that help keep him focused. For instance, every Saturday he calls his mom, eats a good bagel, and goes for a morning walk. While these things may not seem like they are anything big, the little things are often what keeps us focused in the hardest times.
Please note: if you ever feel that the weight of burnout is becoming too much, there are organizational hotlines that are set up to help you in an emergency. If you are in the U.S., sites like mentalhealth.gov have a list of several numbers you can call to immediately speak with someone.
If you are in the UK, please reach out to the NHS Hotlines.
“When you reach the end of your rope, tie a knot in it and hang on.” — Franklin D. Roosevelt
Written by: Amanda Marchuck
Sources:
https://www.ciisec.org/
https://www.cbsnews.com/news/ransomware-phishing-cybercrime-pandemic/
https://www.infosecurity-magazine.com/news/uk-workers-vulnerable-cybercrime/
https://www.social-engineer.org/social-engineering/the-impact-of-covid-19-on-security/
https://www.mayoclinic.org/healthy-lifestyle/adult-health/in-depth/burnout/art-20046642
https://www.social-engineer.org/podcasts/ep-154-security-awareness-series-whispering-sweet-security-nothings-with-ed-skoudis/
Images:
https://www.eatthis.com/signs-drinking-too-much-coffee/
https://www.researchgate.net/figure/Simplified-5-stage-model-for-the-development-of-burnout-which-is-most-frequently-used_fig3_346432309