Stress is a given across all IT cybersecurity jobs. Journalist and author Dan Harris explored with attendees at ISC2 Security Congress 2024 whether this is natural and inevitable or if it should be approached like any other problem?

Dan HarrisCybersecurity is a rewarding and usually well-paid career but even the most enthusiastic champion of the profession wouldn’t deny that it can also bring moments of intense stress.

Sometimes it can feel as if this job stress is inevitable, natural and unavoidable, an occupational hazard that comes with the territory. IT is inherently stressful and cybersecurity is unavoidably at the extreme end of that scale.

It’s a role that involves long periods of watchful anxiety peppered with frantic interludes. One might say the same about other jobs – being an airline pilot for example – but at least pilots know when their plane is scheduled to take off or land.

In his keynote presentation at ISC2 Security Congress 2024 in Las Vegas, Cyber Under Stress: Take Back Control Before Burnout Strikes, former Good Morning America host, journalist and author Dan Harris offered his alternative view of stress that’s in a form that’s rarely aired at cybersecurity events.

To Harris, what is natural is pressure, not stress, which is a reaction to pressure. Stress is what happens when someone can’t cope even if they convince themselves they are coping. Its effects can be serious, as he discovered for himself after returning from a long six-month posting to Iraq in the early 2000s.

When Stress Gets Too Much

Presenting the news in 2004, live on air, Harris had what he now describes as a panic attack. But unlike the panic attacks others talk about in their lives, this happened in front of millions of U.S. TV viewers.

“Once the fear subsided, humiliation rushed in,” observed Harris at the time, “I knew with rock solid certainty that I had just had a panic attack on television.” He eventually traced the event back to the stress of his job over many years.

“I did something incredibly stupid and started to self-medicate with recreational drugs including cocaine.”

It was later pointed out to him by a therapist that having a panic attack was hardly a surprising consequence of taking drugs. The experience caused Harris to reassess himself before stumbling on the power of meditation to contain job stress.

What observations and lessons would Harris pass on to security professionals?

Overcome the Stigma

A catch is that talking about the issues might not get a sympathetic hearing. People might see doing this as a weakness. “When I first published my book and admitted I took cocaine and had a panic attack I was terrified. But it worked out.”

People generally applaud, said Harris. It’s more difficult if you are worried about your boss being unsympathetic. If that’s not possible, it might be time to look for another job.

Manage Client Stress

The problem is that stress is simply assumed in security. It extends beyond the organization to a person’s home life. It is affected by what they eat, how they sleep and their personal relationships. The culture of an organization can make stress worse, but also better.

Clients phone security teams in moments of stress, sometimes crisis. It is hard for security teams not to absorb some of this because that seems to be their job. The ultimate example of this is being phoned up in the middle of the night because an attack is unfolding.

This is where Harris advocates for meditation as a way of removing yourself from the randomness of stress, emptying the mind.

“The goal in meditation is not to clear the mind, it is to focus the mind a few nanoseconds at a time, very briefly on something like your breath. And then every time you get distracted, start again.”

The Role of Leaders

Security leaders play an important role in shaping how their staff approach stress, collectively and individually.

“Every facial tic is being examined by your team. Understanding how much influence you have is a great way to examine how what I’m doing is contributing to this,” advises Harris.

The Smartphone Effect

One of the biggest challenges in today’s work culture is that workers can be reached anywhere at any time. This acts to amplify stress because employees are always on guard for communication. IT is notorious for this because IT never sleeps.

The biggest offender is the smartphone. “The phone is not the thing that is going to help. Don’t keep your phone by your bed. Charge it in another room. I put my phone away for an extended period of time in the evening,” he cautions.

His advice is not to see stress as something that can’t be contained. Stress management is not on any cybersecurity course, nor is it part of any qualification. Nobody puts it on their CV. But it is as vital to do the job as any of these letters people put after their names. It will ensure their effectiveness at their job and their long-term personal survival. Stress wears people down until they fold or learn to cope, as Harris did.

“If you have no distance from your thoughts, you’re constantly on the string of a malevolent puppeteer of your mind,” he said.