Episode 57
EPISODE SUMMARY
Subscribe or listen now: 
Joseph Carson:
Hello, everyone. Welcome back to another episode of 401 Access Denied, brought to you by both Cybrary and Delinea. I'm Joseph Carson, your co-host for the episode today, and I've got some exciting news for you. I'm joined by an awesome guest and we've got something to announce today. So the awesome guest is joining me is Chloe, and Chloe is going to be my new permanent co-host of the episode moving forward. So it's a pleasure to have you join me today. So Chloe, do you want to give the audience a bit of a background? What yourself, what you do and ...
Chloé Messdaghi:
Sure.
Joseph Carson:
And we can take it from there.
Chloé Messdaghi:
Yeah. Well, thanks for having me on here, Joe. It's going to be fun to do some episodes with you. So basically, I'm the chief impact officer over at Cybrary. And what I basically do is I'm helping the business grow and really getting those feedback loops from customers. If that is on our team side or if that's individuals, but making sure that their voice is being heard and that when we develop products that it's incorporated. And adding new features, because it's something that they've been wanting. And so that's my job is basically is to enhance trust, mitigate risk, and to become more purpose driven. And I'm incredibly excited and static too far Cybrary, and it's been wonderful so far.
Joseph Carson:
Awesome. And a little bit, how did you get into the industry itself? Is cybersecurity your kind of your main background that you've started off?
Chloé Messdaghi:
That's a great question.
Joseph Carson:
Or is this like ...
Chloé Messdaghi:
It's like in many other people, I came in by complete accident back in 2017 before I was a management consultant, but I focused on tech startups and nonprofits. A lot of my work was basically what I do today, but at several different companies. And yeah, and then one day I got a call from a recruiter like, "Hey, there's a cybersecurity company that's looking for someone. Would you be interested?" And I'm like, "Hmm, never been, never thought about it that. Sure. Why not?" And within the first two weeks I realized, this is, there's never a moment where you're not learning something new.
Joseph Carson:
Yeah. That's one of the things, I was doing a conference recently and I mentioned that when you choose a career in cybersecurity, what you're doing is you're choosing a career in continuous education because you always have to learn. If you stop learning, within two years, you could be already out of date. So this is a career where continuous educational learning, knowledge and sharing that knowledge becomes very, very important. Especially to keep progressing in the industry, because even we had discussion not long ago with Kevin. We had a discussion about how to get new people into the industry, and even new people that had recent training can sometimes be already up to date than people that's been in the industry for 20 years because of that continuous learning need.
Chloé Messdaghi:
Exactly.
Joseph Carson:
So I think one of the important topics I want to talk with you today is, and it's a big major challenge. I've seen it from I'm based in AMEA and so based in Tallin, Estonia. So I might have a different perspective or I see a different angle on it, but definitely I want to talk about is a major challenge I've seen is employee retention. And also, one of the areas, the factors of why it's difficult to keep some employees is that as a result of burnout, that employees, this is an industry which is highly stressful. It's fast paced. It can be very, let's say, nasty on social media in regards, because there are trolls out there that will take advantage of people who are trying to do a good thing. But they will actually call people out.
Joseph Carson:
And also, I think it's really important to kind of look at this and is this something that's systematic, this building? Is it worse than what we're reporting? Are we reporting it enough to raise awareness? What's your view on this area?
Chloé Messdaghi:
This might sound weird, but I'm actually very disappointed. The reason for that is back in 2019, myself and others, we've been talking about burnout in on the security team. We've been shouting it from rooftops and no one paid attention to it, on the manager side or on the leadership side. They're just like, "Eh, whatever. They're going to still do the business. They're still going to work all hours. We can ask them, we can do whatever we want with them." And now, a pandemic hits and then they're like, "Wait, people are burned out. What do we do?"
Chloé Messdaghi:
And then it feels like every single move that they're making from our industry as a whole is all the wrong choices. And so what's ended up happening is that for those, I don't know. When you have burnout for a long prolonged time, you end up actually getting diagnosed with depression or anxiety. That is one thing to keep in mind. So if you don't have your burnout get treated, you're going to end up having a much harder time in recovery. And a lot of times people think, oh, I'll just take a vacation. I'll feel better. That's not how burnout works. Burnout means you have to make drastic life changes to be able to recover. So this could take a year or a couple years to recover on.
Chloé Messdaghi:
And so that is the one thing is that we're not doing enough in the industry to really change the situation. And we keep talking about, oh, we have a shortage of personnel. We don't really have a shortage of personnel. We have a shortage of skills, yes, but we also have a shortage of caring for people when they come and they get onboarded. We don't invest in our security team and so what ends up happening is that we have people that are going through a revolving door situation, where our statistics aren't changing that much about how many people are entering and who's entering. Because, it's just a revolving door because we're not fixing anything. We're just giving, we're basically putting out band-aids when in reality, it's not just a burnout situation now. People are leaving our industry because of burnout, but also, they're leaving the industry because of PTSD they're getting from their job.
Joseph Carson:
Yeah. For me, I mean, I've seen for when people, this is a very under resourced industry. We do, and under resourced does mean that people end up being overloaded. And when you're overloaded, what happens is you get into this kind of, let's say rut where you're never getting enough work. Basically, you're freeing up your time. You're always in the cycle of always being busy. You've always got firefighting. You've always got something major incident that's always happening. So sometimes, and it does mean that they end up, people do work a long week. They work long hours and it's just, they can't get out of that cycle.
Joseph Carson:
And I think that cycle just progresses for such a long time that ultimately, if they don't get the balance between having productivity and even personal time, this can lead to a very stressful environment. And to your point is that if that stress prolongs, my understanding is if the management don't deal with it early, this can lead to more, let's say, trauma scenarios where people start actually getting other types of things to deal with it. Whether it being, I've seen in the info sec industry, alcohol being a major impact where people turn to alcohol to try and deal with it. And then, that becomes where the company sees that as the problem, but not dealing with the origin source, which is the stress and the trauma. Even food, even lack of lifestyle balance as well can also lead to eating disorders, sleeping disorders, other types of things.
Joseph Carson:
So for this industry, it is very stressful and if you keep that for a long time, it can lead to trauma. And it's something that we do see it. We do see aspects of it on social media, people reaching out. But I do think that the pandemic, a lot of people were dealing with it because we had a very great community when we came together. We had so many events where people can come. And I think the events themselves, the in-person events sometimes allowed people to vent and to socialize and to try and deal with it that way. But when we get into the pandemic, that venting or that kind of way of dealing with it was no longer there. So I'm pretty sure that the pandemic also has accelerated some of these impacts. Do we have, is there some types of things that we can deal with it, or is it mainly on organizations need to recognize it or find a way to balance it? What's kind of the recommendations here just to address?
Chloé Messdaghi:
Yeah. So I'm giving a presentation RSA conference, and this presentation was built by myself and Ryan Louie who's a psychologist that has been in cybersecurity space as well. And we wanted to dive to try to figure out what's really happened behind scenes. So the reality is like you said, burnout occurs when we can't balance our personal life and our work life. So if we don't have that balance, then we're going to start developing burnout. But a lot of times people believe it's because the amount of work, and it's not. Actually, the top two reasons for why that is from our research that we gathered was poor leadership. Poor leadership was number one. The second was the lack of organization caring. So those are the two parts where you start having burnout.
Chloé Messdaghi:
And usually how it works is that with when you start a new job, it takes within six months for non managerial role. And if you're in a manager role, it takes one to two years because you have more sense of autonomy, but that poor leadership and lack of organization caring is the reasons why we're developing burnout. It's not about the overwork load. That's like number seven out the top 10. So if you think about that, then we're like, wait, then. I'm so confused here. So why is it like this? And it's really because we're not doing well enough when it comes to our leadership and having conversations about how to invest. What happens is that we were like, "Well, let's just throw tools at them, right?" But we never had a conversation with the security team and be like, "What do you need? How can I help you?" And this is the problem.
Chloé Messdaghi:
If we're not having those conversations, then no one feels like they have an autonomy at work. Then they're going to get upset. And when we start getting upset, then we are going to go into apathy, and when we go into apathy, that's when we start going into that burnout rabbit hole. But the thing is that the similarities between burnout and PTSD, and for those that don't know about PTSD, the warning signs it's avoiding of situations or people. It's having nightmares or just flashbacks, changes in mood and easily frustrated. But as you also know, burnout PTSD, you just heard those were the symptoms for PTSD, but burnout and PTSD mimic each other. In other words, exposure to trauma or extreme stressor. Respond with fear, hopelessness, and poor sleep disturbances and nightmares, depression or withdrawal, mood changes, generalized irritability, avoid activities that promote recall a traumatic event. Those are also PTSD.
Chloé Messdaghi:
And this is the thing we haven't talked about, and I think when Ryan and I, we came together and we were like, "We need to, we really need to drive this one in, because the reality is that we also have this other thing called post code stress disorder, PCSD, which is what people have been having and getting diagnosed slowly with." For those that had to deal with the pandemic and anything that caused them to have PTSD from the pandemic is called PCSD. And so it's one of those things that, where I just kind of sit there and I listen to people's stories about how they're feeling burned out. And it just sounds like no, that's not burned out anymore. This is a lot worse. And I'm glad that in our community, now every time we go to a conference, there's a topic about burnout. That's great. I'm happy about that. This is a more serious problem now. We're actually talking about PTSD now.
Joseph Carson:
So does it, I mean, do you think it comes from specific roles in our industry? Because I know in certain parts of our industry where you might have people dealing with cyber crime and they're looking at really, really horrible content. When they have to filter that content, they have to see it and they have to report it, especially in law enforcement. It's a specific area or government agencies, going through that content can be very traumatizing. And doing that for perceived long time. Communicating with cyber criminals, doing threat intelligence research also, and things like the dark web can also lead to seeing a lot of violent content. Is there specific roles in the industry that can lead to it or is it kind of more across the board?
Chloé Messdaghi:
It's all across the board.
Joseph Carson:
Yeah, I've experienced it in my past management days where past management just never seemed to end. You just, you get one patch out and you're just like, oh, now it's time to relax. And all of a sudden, patch just usually comes, you're just going, what? Again, again, another one?
Chloé Messdaghi:
Yeah.
Joseph Carson:
And it just progressed, until you got to the point where you dealt with it. I remember, to your point on leadership, I remember one of the things I learned many years ago, and I think this is probably, I think it's more making sure we get the social understanding and skills to be able to address and identify it as well. It was years ago when one of my managers identified, realized that I was working nonstop. I was just back to back and not having enough of my time, even to the point where I'd been working long nights and weekends.
Joseph Carson:
And I worked in a very stressful support sorority environment over those years. And it got the point where he came to me and he basically gives the normally what you could have a choice is saying, I could either get paid for that extra time or I could take extra days off for it. And it was his words to me, really made a very important change in my lifestyle. He was like, "My recommendation is not to take the pay, take the time because time is the most valuable thing in this world. You can't get it back. If you can get more money in the future, but you can't get your time back." And he highly recommended that taking the time was the most important thing at that time. And it made me realize that absolutely, that we need to. We need leadership to identify that and to see it and to be able to recognize it, and to make sure that the employees are getting sufficient recovery and rest time. Because I think lack of that leads to a lot of these other traumas that can be prolonged.
Chloé Messdaghi:
Yeah. We definitely see it like when unfortunately managers, when they micromanage. So a lot of these managers are like, "You need to be in the office. I need to see you be in the office." That's already setting up for a situation where you're going to have employees that are going to be incredibly awkward, uncomfortable to go in the office because they're not feeling like they're being listened to. And so they're being dictated what to do and there's no trust. And when we don't have trust, then we can't build a relationship with our manager.
Chloé Messdaghi:
So you can have really bad managers that can actually cause PTSD. I know people that had to go see a psychiatrist and a therapist because of a bad manager, because they would text them over the weekend. They would call them during in late hours to tell them to do something. And then it gets to a point where they start getting scared. They go into the office, they might start sweating. Their hands might get a little bit sweaty, going into a room with this person. Or any time they see that person, their body just kind of tenses up. Those are signs of someone who's going through trauma and is reliving trauma. And we especially see this and I hate to say this, but when it comes to people of that are marginalized in our community, they are going to be the number one targets for this situation.
Chloé Messdaghi:
There's countless of people that have experienced like discrimination and harassment and assault in the office. And then having to go and relive that trauma by knowing that person still exists in their world is not a way to heal. And so what happens is they might withdraw from their work. They don't do as much work because of this experienced trauma, and people fire them. And then they're like, "There's something wrong with me." But in reality, it takes years later for them to recognize, oh, this isn't on me. This was that person that did that to me. We get a lot of those kind of cases. When I interview folks, that's the one thing I found so common.
Joseph Carson:
Is it unique to the security industry? Or, I mean, is this just something we have across multiple industries? And it's more, not just isolated to security, but it's across consulting or service industry or, and so forth. So it's much more of a national challenge that needs to be addressed rather than just the Infosec by itself.
Chloé Messdaghi:
I think any industry that has a lack of representation of marginalized people, we're going to have this type of situation. But I would say the one thing in Infosec, which scares me the most is the fact that even CSOs right now are overwhelmed. And when you are a leader and you're dealing with this kind of stuff, it does trickle down. And then what ends up happening is you start building a team of people that are going to be so overwhelmed, burned out, and like you said earlier, maybe reaching for more alcohol, more caffeine. And that's the thing. A lot of people don't talk about this part, which is if you're drinking more caffeine, that's a sign right there. Caffeine is a drug. When you're drinking coffee and tea, it is a drug. You have to understand that.
Joseph Carson:
But that's been for me.
Chloé Messdaghi:
I know. So it'd be like, that for me, any time in the past where I'm like, oh, I need to have another cup of tea. I'm like, oh, I'm stressed. I need to relax. And so, I mean, I've been burnt out, I think twice in my life. And I would say the times where I didn't know that I was burned out was that I would just have drank tea, maybe three cups of tea a day suddenly. Or I would drink a coffee or something like that. And that was kind of those warning signs are those. They're really, they're very quiet. That's the thing, a lot of people would know. It's very quiet when you start having those warning signs such as I'm just, you know what? I'm going to have another cup of coffee. That is a sign right there.
Chloé Messdaghi:
The next sign is, it used to take you 10 minutes to respond to a quick email. Now it's taking you like an hour, maybe a whole day. Change of behavior, that is a silent thing. And to you, you may not find it right away. It might take months, or until someone points it out to you. And that's the thing is we need to find a way where we can recognize in ourself, but also as leaders to be able to recognize that in our employees.
Joseph Carson:
I mean, how important is it to get leaders in the industry, which really take this very seriously and do it well? I remember we had quite a while back, a good friend of mine, Dave Kennedy came on and we chatted about, we were talking mostly about penetration testing. But we did at the end of the podcast, talk about the mental health side of things as well. And he wrote, read one of the letters that he sent to his employees the week prior, all about mental health and by taking the time and about the balance. And I thought, from David, his leadership in this industry is great. And sometimes it takes people like him to really raise the awareness.
Joseph Carson:
And not long after is when he started the Hacking Health podcast, which I thought was amazing, because he ... I think it's really, for me, what is really important is that sometimes in the social side of things that I think it's important to people to share the things they're doing outside of this, in their personal lives. Because, I think it's really important to see that there's a life beyond just Infosecurity, that there's something else we do outside. So when people share things, that is whether Dave and his gym, or things like that. Or you get others who's sharing about vacations or other types of activities. I think that's great because it shows the human side of things that we have. But unfortunately, there is a lot of trolls out there that will take advantage of that and really be very aggressive from some of the language they use.
Joseph Carson:
And I think that's sometimes a bit of a balance that, I guess that's probably a broader issue on social media in general that content filtering and making sure that there isn't that nastiness and aggressive side of things. What can we do? Can we do something as a community that during events or providing? I think it was a while back during the pandemic, we did have the fancy Friday times where it was great. Just kind of a way to connect socially. Unfortunately, bad time for me, time zone wise. But I think it's, do we need to have more of those community types events to help each other and provide ways to, just like people have who are dealing with other types of trauma will have basically meetings to discuss it openly. Do we need more avenues as a community to do it in this info security industry?
Chloé Messdaghi:
That's a great question. I first want to tackle this individually. So the first thing I would say is social media. There's so much research on it that you shouldn't be on it as much, honestly. It becomes, it is just as addictive as any drug out there and we have to be very careful.
Joseph Carson:
Yeah.
Chloé Messdaghi:
We are very sensitive. Humans are sensitive. We'll say, "Oh, that doesn't hurt me," but it does. It will. Over time, it will hurt you, and so it's best to take breaks from social media. Don't be on as much. If you, the first thing I can say is turn off your notifications, just turn it off. You turn off your notifications on social media. Just do it. It is going to help you in so many ways, because you're going to check it anyway. So what's the point of having the notification? Same with email. You don't need to have it on for notifications. You're going to check it anyway. It's automatic.
Joseph Carson:
There's a great book. Yeah. There's great book from Katherine Price that is about how to break up with your mobile phone. And actually several years ago, certain when I go to conferences and there're some speakers that sometimes it's not directly, it's a related topic. I think it was the same. It was an IC score conference where they also had Chelsea talking about the stress of basically the flight that landed in Hudson. And at the same event also was Captain Price talking about how to break up with your mobile phone.
Joseph Carson:
And that was so impactful to me that actually when she was talking and I listened, I was like, I need to make those changes myself. And I actually went and I separated phones. I have not a phone, which basically I use just if I need an emergency to call somewhere or just get somewhere. And then I've got my work phone. I've separated it and I've also removed all social media, or a few from my mobile devices. So I need to go to a laptop in order to see, more kind of a thick line to see the social media side. So I've kind of really separated and have a very fine line about crossing over on that. And it has helped me. It's definitely helped me from that addiction of scrolling, just continuously looking into the oblivion that has no real impact in our lives, other than increasing stress and needs. So absolutely, for the audience, we'll definitely make sure to put a link to the book and the show because it will change your life.
Joseph Carson:
So definitely other things you think as well, because definitely social media, separating it or having limitations is important.
Chloé Messdaghi:
Yeah. I do it where I only allow myself to be on social media for about, so Twitter, LinkedIn and Instagram, I will give myself maybe at most one hour a day. And not even, and that's usually just me responding to people's DMS usually, or I'm tagging something. I don't post as much anymore. I remember a couple of years ago before the pandemic, I would be a regular user of social media. And then I realized, this is so much work. I would rather go read a book or do a puzzle or play with my pups, or go see a friend. It's insane, how much time we give. And the other thing is that you are a product.
Joseph Carson:
Yeah.
Chloé Messdaghi:
On social media, you are the product. The social media isn't the product, you're the product. And so they know how to make you want to get back on. That's what they do. That's their job on social media, so.
Joseph Carson:
The more people is looking at their screen, the more ads they can sell.
Chloé Messdaghi:
I know. They know way too much. But I would say, turn off notifications on your phone. You don't need them. Honestly, you don't need them. The other thing I would say on the individual thing is honestly, if you have any symptoms of feeling overly anxious, or you feel hopeless or helpless or anything like that, I highly recommend reaching out to a therapist.
Joseph Carson:
Is there any sites? I know that every now and again, especially organizations running like BSides and a lot of different events now. What they're doing is, you have a choice now rather, if you want to donate. And there's, I know there're several sites that's also dealing with mental health in security. Is there any recommendations that you have that people can go to in order to seek help?
Chloé Messdaghi:
I would say first talk to your doctor. Honestly, what you want to do is get a physical. You want to make sure your vitamins are all okay. And what I mean by that is if you have low iron, low vitamin B or low vitamin D, you're going to have symptoms of depression or anxiety. So you want to first get that checked out, make sure that it's not just a body situation and then talk to your doctor and be like, "I think I need to go and seek help." That's the first step you're supposed to do. And then they will refer you or your insurance will, and they'll log into your platform and they should have a different ways to know what's in your network.
Chloé Messdaghi:
And then just go with one of those, read the reviews of them. And just note, you may meet with one and it didn't go out. It didn't go well. That's okay. You can go. It's like sometimes you have to try in a few different ones to see which one fits the best for you, but when you do, hold onto them. But yeah.
Joseph Carson:
I'd also recommend, my recommendation as well is also, don't be afraid to speak to your organization. I'm pretty sure that not all managers may be approachable, but I'm pretty sure most organizations and most managers, they want to take care of their employees. So make sure that if you do have a manager that is approachable or organization, which has facilitates openness about this type of challenge, feel free to make sure you speak. Because even myself, I've managed hundreds of people in the past and I've always kept that open door. I've had employees who's had challenges that was not always work related. Some of them were pressure related and they're always keeping an open, making sure that they had the time that they need to be able to sort things out.
Joseph Carson:
So I think it's really important organizations and leaderships that we need to as an industry, make sure we have strong leaders that can be open door and be understandable about employee situations. That it's what you end up doing is the more you curve for them, they end up being very loyal, very great employees for a long time. And I think that's really important for organizations to be open and realize that.
Chloé Messdaghi:
Yeah. I wish, I really hope people start realizing that it's like, there's always a worry. Well, I don't want to invest in an employee because if I do, then they're going to go somewhere else. That's not usually the case. And the majority of the cases is that when you invest in them, they want to stay. People don't, people will stay. As long as you're paying them well and you're caring about them and they feel supported, they will stay. And that also, that is kind of your role as a manager. The thing is we have to understand, being a manager, it means you're going to be a coach. You're going to be a mentor. You want to see your employee go beyond you. That's being a manager.
Joseph Carson:
Absolutely.
Chloé Messdaghi:
If you're more like, "Oh, I don't want this person to ever go beyond me and I'll throw them under the bus any time that I get in trouble." You should not be in leadership. You shouldn't be a manager of people, period.
Joseph Carson:
Yeah. And going back to the same, I mean, I've been fortunate. I've had great leaders that I worked for over the years and I'm very fortunate to be, and several of them are still mentors to me even today. Even after being almost in this industry for 30 years, I still go back to some of my mentors and leaders from even back in the '90s, which is, I guess is weird. But they still advise me and still give me advice today. And the great thing is, the one they're referring to before is I had a situation also, that it was all about they made the statement to me as, "If you ever have whatever, an accident that meant that you couldn't come to work. Or you ever stepped in front of the bus and something horrible happened, would the business be able to survive?"
Joseph Carson:
And it made me realize that my job is to make sure that the business could survive. And it was always about making sure I could train to people around me to be able to do my job. And that meant that delegating and training and caring for the employees to make sure that they could take care of things, rather than me keeping it all to myself and not sharing to making sure that it was kind of balanced. And then also, actually after that discussion, it also meant that I was delegating a lot more work and freeing up a lot more of my time as well in order to get the balance back. So it goes in definitely a major benefit to kind of really look at the kind of life work balance at that point in time.
Joseph Carson:
So I think those are important lessons. Chloe, it's been awesome having you on. I'm really excited to really continue all the future episodes that we'll have to come. I think we're at something like episode 56 now, which is pretty amazing. So we've been doing this podcast for now for two years and for the audience, I think this is a really important topic. And I think definitely we need to make sure that there're more avenues for people to get help and make sure that we're open. And be able to make sure that we curve for the community out there because we are only secure as the people around us. And this is really important to make sure that the more people have that mindset and have that capability, and will ultimately make the world a safer place. Any final comments that you have for the audience?
Chloé Messdaghi:
Oh, just thank you all for existing. And Jim, looking forward to being your cohost at times. And if anyone has any questions about these kind of things, my jams are always open and I'm happy to answer anything or even jump on calls to help people.
Joseph Carson:
Absolutely fantastic. So again, for the audience, another important topic and to really kind of, if you do see people, reach out and help. Make sure that people have, just sharing and speaking is definitely the one step moving closer to getting help. So always make sure, keep your door open, make sure that people around you safe and make sure you also give helping hands when needed. So this is the 401 Access Denied podcast with your cohost, Joe and Chloe. And again, tune every two weeks for the podcasts and stay safe and look forward to seeing you on future episodes. All the best. Thank you.
