CyberSecPsych

“They should study with their passion.  The way you have a great career in technology, is you do what you’re passionate about.  There is so much demand, there are so many opportunities, there are so many options.  Don’t study the thing they tell you to, study what stimulates your passions.  That’s where you will be the happiest, that’s how you find the best work.”

-Bruce Schneier

Intel’s international study, Hacking the Skills Shortage, found that 82% of IT professionals say there is a shortage in cyber security talent within their organization.  We can surmise from these findings that existing cybersecurity teams in most companies are overstretched, resulting in staff that are tired, stressed, make mistakes, and inevitably, are more likely to burnout.

Information Security jobs are stressful because:

1. Infosec breeds a culture of paranoia
2. There is antagonism between security requirements and business processes
3. No clear endpoints
4. No clear wins
5. Job requirements change daily
6. Difficulty in calculating how much risk has been reduced
7. Regulatory compliance
8. Lack of staffing
9. Lack of senior leadership support
10. Metrics are based on breach or no breach

 

The Dualistic Model of Passion

Passion is defined as a strong inclination towards an activity, object, concept, or person that one loves, highly values, regularly engages in, and has some ties to one’s identity, leading to the investment of time and energy into the activity and the development of long-lasting involvement in it.  Passions develop as a reaction to a one’s desires around self-growth.  Passion for activities leads to the highest levels of self-growth.

There are two types of passion, harmonious passion and obsessive passion.  Harmonious passion is a passion that is freely chosen for the pleasure that comes from the activity.  Conversely, obsessive passion is a passion that is instilled by wanting to please others or to maintain a certain status that is important to self-esteem.

Harmonious/Obsessive Passions Self-Assessment
Please rate the following as: Strongly disagree, moderately disagree, slightly disagree, slightly agree, moderately agree, and strongly agree.

General Passion:

1. I spend a lot of time doing my job as a security professional.
2. I like my job as a security professional.
3. My job as a security professional is important for me.
4. My job as a security professional is a passion for me.

 

Harmonious:

1. My job as a security professional is in harmony with other activities in my life.
2. The new things that I discovered about doing my job as a security professional allow me to appreciate it even more.
3. My job as a security professional reflects the qualities I like about myself.
4. My job as a security professional allows me to live a variety of experiences.
5. My job as a security professional is well integrated in my life.
6. My job as a security professional is in harmony with other things that are a part of me.

 

Obsessive:

1. I have difficulties controlling my urge to do my job as a security professional.
2. I have almost an excessive feeling for my job as a security professional.
3. My job as a security professional is the only thing that really turns me on.
4. If I could, I would only do my job as a security professional.
5. My job as a security professional is so exciting that I sometimes lose control over it.
6. I have the impression that my job as a security professional controls me.

 

---

Conclusion

Burnout has significant repercussions for both employee and employer.  Employees experience negative affects both physically and psychologically, putting them at risk in both their careers and personal lives.   Employers experience a compromised workplace quality, causing more absenteeism, accident risk, and cynicism, while lowing the morale and commitment of the rest of the team.

Reshifting the focus to see if workers are happy for the right reason and if they feel in control should be a priority for managers going forward.  Self-efficacy is the principle component that employees need to cultivate to discover their true passions, and promoting this feeling by asking employees when and how they feel they have mastered something not only reinforces the learning process, but also creates more internal engagement.  These small wins in an industry where there are no clear wins can have a dramatic effect by increasing one’s harmonious passion in reaching the organization’s cybersecurity goals and ensuring less employee turnover.