Anyone in this business knows how fun and exciting hacking can be,
but also the emotional and physical toll it can take. Mental health
is a longstanding dirty secret in the infosec community, and we are
just now learning how to talk about it. The wear and tear of
everyday stress combined with an 'always on' aspect of an
operational environment creates a perfect storm for burning out.
While stress can have a negative impact on job performance, my
primary concern is on the health and safety of infosec
professionals themselves. Not only does stress have short term
effects on cognitive abilities and performance, but recurrent acute
stress can have long term effects on health (mental and physical)
as well as burnout and turnover. There are many sources of stress
in infosec operations, some of which can be managed while others
are simply the nature of the job. Activities that require long
periods of vigilance and creativity will deplete cognitive
resources and increase fatigue. Some of these activities have
unpredictable results that can increase frustration. Other times,
external factors unrelated to the activity itself may introduce new
sources of stress that are not normally present. A certain level of
stress is to be expected in these operations because they are
considerably difficult, have a high risk vs. reward trade-off, and
require a significant amount of knowledge and skill. But, how much
stress can you take on and still be a happy hacker? In this talk I
will discuss why infosec is so stressful, how this stress affects
you and your network, and some things you can do about it. I will
also discuss lessons learned from my research study of tactical
cyber operations that studied fatigue, frustration, and cognitive
workload in operators.