is from DC 604 in Vancouver,
British Columbia. Candidate
and actually he's also and DC
416 in Toronto, Ontario.
Canada. Apparently he gets
around. He's also behind me as
a giant talking head from
Zardis. Um, no, it's his first
slide. Sorry. No longer a
talking head. Um, uh, his talk
is going to be about the
frontline first aid. Triaging
your defer emergency response.
Digital forensics and
insert response as well as
other essential emergency
workers often faced high
stress levels and risk
burnout due to their
demanding rules. I can relate
to that. I was in that role
for a while. This talk is for
professionals, spouses,
managers and corporations and
we'll cover the following
topics. Self care, hacking
health, maintaining work
life balance, building a
support network and developing
mindfulness and relaxation
techniques using technology to
manage workload, working with
management to create a
positive work environment.
Having built and led
successful defer practices that
dealt with some of Canada's
largest data breaches. I wish to
impart that I have what I have
learned over the years so
others may protect and nurture
their most sacred resources,
people. Newman Lim is a manager
at Odlam, not sure which,
Brown, where he leads the
defense against criminals and
state sponsored doctors,
targeting the financial
industry. Prior to this role
Newman spent several years
working with large enterprises
and governments specializing in
digital forensics and insert
response investigating some of
Canada's largest data breaches
from 2018 to 2023. With more
than 15 years of InfoSec
experience, he has delivered
numerous cyber risk assessments
coordinated national insert
responses across multiple
industries. Newman has been
invited to share his research
and thought leadership in many
security conferences such as
Greyhat, DEFCON Blue Team
Village, HTCIA, B-Sides,
Toronto and CISO Summit and
CCTX and now DEFCON Groups VR.
So we'd like to welcome Newman
to the stage.
Hey, thank you everyone.
And it's good to be here. I am
across the street from the main
conference. I'm just going to
basically move on to my very
first slide here. It's really
just about myself. I think the
introduction was fantastic. I
couldn't have said it better
myself. Hopefully that will kind
of set us up for the rest of
this talk where we really try
to focus on tips and strategies
on how we as practitioners as
well as managers or corporate
leaders look at this particular
issue in a more serious way as
well as come out of this talk
with some good, you know, good
statistics as well as strategies
to kind of deal with the problem
because let's be honest, this is
a problem that we are all trying
to solve. And I don't believe
anyone has a very good idea of
how to solve it. So let's just
start with, okay, well, why
listen to this person chat about
this? I've been a digital
forensics consultant for probably
most of my career. In 2018, I
led CGI's digital forensics
and instant response team. I
built that team as well as the
digital forensics lab and in the
Toronto area. In 2019, I became
the director of digital forensics
and instant response at ISA. And
then after that, in 2023, I was
the senior manager of detective
response, also doing instant
response for Deloitte, one of the
big fours. During that time, I
dealt with some of the largest
data breaches, helped our clients
with not just the investigation, but
also the remediation of some of
these issues at hand. One of the
main things that I wanted to kind
of talk about today is legally
without prejudice, of course. Here
are just some headlines of some of
the casework that I may or may not
have been involved. As we know, this
is a major, major industry problem
and burnout within the cybersecurity
industry is extremely high. A lot
of our peers, as you can see in some
of these social posts from various
times, I think as far back as 2021,
I've been talking about some of these
issues that they've been facing, and
these are some notables in our
industry. Why is this such a major
problem? Well, first of all, the
constant threats that we face, these
don't go away. In fact, they are
getting worse. And in some cases, you
know, we're constantly dealing with
evolving threats. I mean, the nature
of the job really means that we are
always on high alert for new types of
attacks and vulnerabilities. And
therefore, you know, it's unbelievably
mentally exhausting. In some cases,
either we're working for government
agencies or hospitals, it's a high
stakes environment. You know, the
consequences of a security breach can
be increasingly severe, not just
impacting financial losses, but also,
you know, you could also incur
reputational damage or legal repercussions.
And in some cases, even the loss of life,
these high pressure environments
contribute to a significant amount of
stress. And therefore, the burnout
problem is quite high in those
industries. Oftentimes, in order for us
to stay ahead of the cyber threats,
you know, practitioners will work long
hours, including long nights and
weekends. I mean, let's be honest, the
bad guys don't, they themselves
don't rest. And they target people,
you know, in the middle of the night.
So for that, we need to be constantly
vigilant. And in rapid response, you
know, most of the times, it can be very
disruptive to work-life balance, because
hey, you could get hit at 3 a.m. in the
morning. Fourth one is, I think we're
no stranger to, we all know there's a
skills shortage. It's difficult enough
as it is to learn a lot of these
investigative techniques. There's a
significant gap in the way that
institutions such as universities or
colleges are teaching students today.
And they're not really catching up with
the amount of knowledge and skills that
are required for what we need to do in
the industry. And therefore, this
skill shortage just keeps getting bigger
and bigger. The complex and evolving
threat landscape, as we know, the
rapid pace of technology change really
means that cybersecurity professionals
have to constantly update their
skills. Oftentimes, most folks will, you
know, do it for your degree, take a
sans chorus and feel like that is enough
for them to leverage, to build their
career. And there's nothing wrong with
that. But that type of knowledge expires
fairly quickly, given how quickly things
change, such as new technologies, new
abilities in cloud technologies, for
example, as we start to move a lot of our
on-prem systems away from what we have
today to more modern technologies. And
so the threat of change creates a
stressful environment. And of course,
incident response stress, as you well
know, during cyber incidents, the
pressure to act quickly and efficiently
is immense. The stress of managing and
mitigating cyber attacks, especially in
the middle of one, often with a complete
lack of resources, and of course the high
stakes, especially if you're working for
a hospital, can be extremely draining,
not just physically, but also mentally as
well. And last but not least, there's a
huge lack of recognition and support for
our industry. Oftentimes, I hear from
practitioners, they keep saying things
like, hey, this is an unbelievably
thankless job, and it keeps reflecting
it in that way. Organizations don't seem
to recognize their staff enough that
have worked all of these long hours. So
based on that, what can we do? First
things first, I just want to call out
my disclaimer. I'm not a medical
professional. The information and
opinions that I'm providing here today
is based on my personal views and my
experience. If you are suffering from
some medical condition, please make sure
that you consult with a qualified
healthcare professional. The content
here is really for educational and
informational purposes, and should not
be a substitute for professional
medical advice and treatment. So let's
take a quick look at what is the
definition of burnout, and now the
World Health Organization has defined
burnout as a occupational phenomenon
or occupational, I wouldn't call it an
illness, it's more of a condition, and
it's actually being recognized as a
classification under diseases. So it is
what they would consider a medical
phenomenon. Burnout defined in IC
11 is as follows. Burnout is a
syndrome conceptualized as a result of
chronic workplace stress that have not
been successfully managed, and that's
the key word here that they're trying to
flush out here is that it has not been
successfully managed. So that said, how
can we as individuals, spouses,
co-workers, managers, manage this
successfully? So here the WHO has
characterized three different dimensions.
The feelings of energy depletion or
exhaustion, increased mental distance
from one's jobs, feelings to reduce
professional advocacy. Now these are at a
very high level some of those symptoms,
but as part of my presentation, I will
take you through a lot more different
symptoms on how to identify what could
potentially constitute as burnout.
So here in Canada, I just want everyone
to know that that organization, you will
have a responsibility to their
employees, especially their well-being
of their employees, and generally
these kind of fall into the following
categories. So organizations are
responsible for creating healthy work
environments. We have physical
safety requirements. We have to ensure
that the workplace is safe and free from
hazards that could cause physical harm.
That's it. There is also another category,
what we call mental health support.
Organizations must foster a work
environment that supports mental well-being
and reduce stigma around mental health.
Organizations in Canada also must provide
resources and support. So we do have
things like employee assistant programs
or EAPs. I believe this is the same in
the U.S. as well. They must offer
access to counseling services,
mental health resources, and support
programs. Here in Canada, we have
something very special. We call them
mental health days. We're allowed to take
a number of days off, specifically for
mental health needs, and that's been
phenomenal because it does not take away
from your sick days. And that's
because it does not take away from your sick days.
And our regular sick leave here in
Canada is, sorry, in BC in particular
is five days. We're given five days
of sick days, and these mental health days
are on top of that. Workplaces
must allow for reasonable
working hours in order for
staff members to manage their workload
and stress. So employers
are regulated to maintain
those. Do they follow them? I can tell
you not too many do, but they are
actually required to do so. Stress
management organizations are
supposed to be following or allowing
for the implementation of practices
and programs that will help employees
manage and reduce stress, such as
providing training for stress
management techniques. And
organizations must also promote
work-life balance, and these could
include things like allowing for
flexible work arrangements. But again,
not every organization follows this.
They must also allow for time off
or have time off policies. And I
think most corporations do follow
that particular guideline. Organizations
must also encourage open communications.
In this particular case, they must
support a corporate culture that
creates an environment, a safe
environment, where employees feel
comfortable discussing not just their
physical but also their mental health
concerns. And they must also
provide mechanisms to allow
employees to voice concerns as well
as suggest improvements to those
policies and programs. One that is
very important, and I can't stress
enough, is really the training and
awareness piece. Organizations are
responsible for providing training
for managers and employees as well
on how to recognize the signs of
physical and mental health issues. And
also how that they can get support
and help. So those EIP programs,
for example, they need to have
documentation as well as policies
and procedures to say, here's how you
can access all of these. There are
some legal compliance in terms of
what an organization is responsible
for. There are some federal and
provincial or state regulations
regarding workplace health and safety.
If you do not follow these, you can
be ordered by the government to
adhere or meet those standards.
There are also accommodations
given by law for employees with
mental health conditions, and these
are required by law. So say, for
example, if you have a staff member
that has ADHD, for example, you
must allow for accommodations within
your workplace. And last but not
least, employee engagement and
support. There must be supports
provided for employees for career
development, as well as recognition
and reward. Now, I can tell you a lot
of companies don't actually follow
that one, even though they are in the
guidelines from organizations
and organizations' responsibilities.
So of all of these that I've
mentioned, I would say that most
organizations probably adhere to
about 75% of them, and they fall
behind on about 25% of them. So we
really, as employees, need to keep
our organizations honest and make
sure that they are doing what they
have to do and following some of
these legal guidelines.
One thing I want to stress is there
is a financial hit on having
your employees suffer from
burnout. When I was building some
of my deeper practices in the big
fours, we have a very quick
calculation for me to basically
drum up support from senior
leadership to support staff members
in the practice. On the left
hand side, I've got a graph here
that basically shows the ideal
scenario for growth by determining
a small pod or small incident
response, a quick response team of
one senior with a couple of analysts
following the trainee model.
If this model works the way that it
should, the economics behind that
is a linear trajectory up. And for
every senior with three analysts,
they can generate quite a lot of
revenue with extremely low cost as
long as the seniors are providing
most of the support to the junior
analysts. And there is rotation
amongst the resources so that you
don't hit the burnout stage. On the
right hand side is a more realistic
model of what usually happens in a
deferred practice. So what happens
is that the seniors or analysts
start to burn out. They quit or
they leave the organization
incurring a significant opportunity
cost. And as such, organizations
that suffer from this cannot take on
any additional casework causing
loss of potential revenue. And if
your senior quits in the middle of a
case, there could be some potential
reputational damage. Now, this is a
very, very rough kind of a projection,
economic projection. Typically, when
I present to my leadership teams, I
would have a lot more modeling behind
it with actual numbers, cost, training,
as well as how much a senior
analyst or a consultant can actually
generate in terms of revenue per
case. So this is just for
illustration purposes. I want to show
that, you know, an ideal scenario, it
can be sustainable. It can be good
business model. And on the right hand
side, the ideal is to basically avoid
or try to flatten a lot of those curves
that we see up there. So here I want
to talk about the stress to
performance. Now we have to understand
that every individual has a different
amount of capacity and a different
ability to handle or take on stress.
In this particular case, you're really
starting to look at the optimal stress
levels for each and every one of your
team members. So I'll give you an
example. At the higher echelon or the
bigger, the higher curve, that could
be like a senior consultant. They may
have more experience. They may have a
better support structure. They may
have more capacity to handle the
stressful situations. A junior would
maybe be at the lower curve. They do
not have the capacity to handle as much
of the workload. They tend to fall into
I guess the stressful or the burnout
stage is a lot faster because their
curve is at a much lower intensity.
Now, in this particular model, what
we're really trying to do is shift
left as best as we can. We really do
not want to get into that red. Red would
be all the red flags that would
basically cause someone to not function
anymore. And that's something that we
are really trying to get out of. Now, if
you start to see yourself in that stage,
you really need to start looking at
getting help. Because once you start
taking on too much stress, sometimes it
will overload your system. So the key
here is to recognize where you are in
this curve and try to bring yourself
back left as best as you can. So how
can you do that? And there are some
methods that managers who are here
that are attending this can implement
in their organizations. So here are
some of the ways that you could do. So
what you could do is you could lead
through some of this stress. And the
key here is point number five. What
you're trying to do is you're trying to
shoot for that sustainable best effort.
Sorry about that. Yeah. And what you
want to do throughout all of this is
constantly check in with your staff
members. Be curious at what's going on
in their lives. Listen to them. During
that time, make sure you talk about
stress. Hey, how are people's stress
levels going? As part of this
presentation, I put together a checklist
which I took from a partner of mine.
And the checklist is included as a
PDF on the on stage, I believe, on the
right hand side of the stage. So that
this is something that you can download.
And it's really just a checklist for you
to kind of go through what kind of
stressors are in your life. So as
managers, I would highly recommend that
you put together some some similar
checklist so that you can talk to your
staff about how they're feeling. What is
their current stress level right now?
And having that conversation as open as
possible, real, really start to reduce
some of those stress levels and at least
help you identify. And then once you
understand that there is an issue or a
stress related issue that you can start
to look at managing it. As managers,
and in some cases as part of the legal
requirements or guidelines, is your
responsibility to manage your staff time
as well. So look at how many hours each
staff member is putting into their
projects. Look at rotating them out if
they are doing way too many hours per
day. And last but not least, really
advocate and support for those EAP
programs that will help reduce some of
the stress. And last but not least, really
try to focus on that sustainable best.
So as employees or as people, how do we
identify the stressors that will
lead us to burnout? Now the WHO has
given us three factors. I think that is
I think a very brief summary. I'm going
to go into a lot more areas here that
will help you identify what could
potentially be an indicator. And the
key here is really identifying those
indicators. If you can find or identify
these indicators ahead of time, it will
allow you to have some strategies or
tips that you can basically try to move
left and mitigate some of this before
it becomes a major issue. So the number
one would be an emotional indicator.
So things like chronic fatigue or feelings
of tiredness, lack of energy, you don't
want to get up in the morning and go to
work. Those types of emotional indicators
are very, very useful to identify that
you are under stress and that you may
potentially be facing a burnout situation.
Other physical indicators such as
sleep deprivation, headaches, muscle
pain, and in some cases major
illnesses. And I can tell you from my
own experience, I, in my second
burnout, I actually had a doctor telling me
that I need to stop working. My health
cannot take, you know, the 18 hours that
I was pulling. And, you know, a medical
professional, when a medical professional tells you
that, you know, your work is causing you
or creating illness, you need to stop.
So that's my experience from that one.
If you are developing
and, you know, health problems related
to your current work,
you need to seek medical help.
And if the doctor tells you the
health problems, you need to stop.
Other behavioral indicators,
behavioral indicators, things like
decreased performance. As you start to
work the long hours, there will be
times where your performance will start
to decrease. And it's just a function
of the ability for you to do things,
right? It's economies of scale.
The longer hours you work, the more tired you become,
the less, the poorer the quality of your work.
In some cases, the behavioral
indicator is withdrawal. Effectively, you're
so tired, you just don't want to do any more work.
Or you would start to push work that you would
normally do off to other colleagues.
So those are other indicators that you should be aware of.
Cognitive indicators, concentration.
I'll tell you that I've suffered from this quite a bit.
Someone will tell me something. Typically, I have
pretty good memory. I would memorize it and I'd be able
to bring it back out or regurgitate it. No problem.
If I'm overworked or stressed, I have
difficulty remembering things.
And that's, like I said,
another cognitive indicator. As you start to
tire, your brain just stops
becoming very efficient.
The next other indicator changes in attitude.
Oftentimes, I have high-performance staff
members, and this is the same with me as well.
We're typically very high-performance folks.
We're very enthusiastic about the work that we do.
We want to keep hospitals safe. We want to protect
government agencies. We're usually very enthusiastic
about it. But when we hit that, once we cross
the line and start going towards the right-hand side,
like our attitude starts to change,
we lose our enthusiasm. We're not there
100% of the time. Our interest in doing
the work that we love to do previously just isn't there anymore.
And again, that affects,
like I said, our productivity and our work rate.
And the last
parts of indicators are social indicators.
When you get tired,
people get grumpy.
I am definitely one that
happens, too.
And that sometimes causes conflicts with others.
Because one word,
one social cue,
one physical sign,
and it could create an argument.
That has happened before and it will lead to
conflict with others or
withdrawal from social activities.
Others would be
and the last one would be the changes in work habits.
As you start to overwork,
you're going to have a very difficult time
disassociating yourself from the work that you're doing.
And that is typical in most high-performance staff
members. They just can't let it go.
And as managers as well as
spouses, you need to really look at and see if
hey, are you missing
all of your meals today just so that you can finish
up the last log that you're analyzing?
Are you skipping out on going to bed
today because you have to process
another hard drive?
Sometimes, like I said, staff members,
individuals, they just want to push through and
power through things. And that is not ideal
because it will increase stress and it will lead to burnout.
So what can we do
to protect ourselves, to make ourselves
better and try to get away
from the right side of that
curve? Well, there are five strategies
that I'd like to share with you today.
First one is self-care.
Second one is hacking health.
And I can tell you that we have a lot
of industry folks here that are
100% promoting that.
Third one is maintain a good work-life balance.
And this requires your organizations
to be part of this. And in some cases,
it is their responsibility, so you have to work with them
and they have to work with you. Fourth one is building
a support network around yourself that will help
you gain the capacity and to
increase your sustainable best.
And last but not least, relaxation techniques
that help you deal with the current
situation. And I can tell you that
we use some of these techniques and some of them are as simple
as literally breathing deeply into a bag.
And it does help as silly as it sounds.
So, self-care techniques.
Well, I mean,
some of this seems very
straightforward, but one is
you need to understand and you need to identify
that you're suffering from stress first and foremost.
And you need to be aware of your own stress levels
to get to a problem.
Second part is there are some things that you could do
to prevent burnout, so you need to take more active steps.
We need to then
establish routine, because let's be honest,
as human beings, we love routine.
And routine really helps us
deal with things that come out of the ordinary.
So, the more routine we have, the less surprises we have.
The less surprises we have,
the easier it is for us to build capacity
to deal with other things that come out.
And so, the
135 rule or the 80-20 rule
really comes into play, where 80% of your day
is regulated routine, where to end
20% of it could be emergencies,
that would give you the capacity to deal with some issues,
additional issues, that is.
I would like to also tell people to kind of
practice mindfulness.
There is a whole slide on this one, but deep breathing I find
is really helpful, especially when
you're dealing with a stressful situation. So, just
take one second, take a deep breath
and then breathe out and
think about what you're going to do next.
Think about the strategies for the next little while.
And if you have
already a healthy lifestyle, that actually provides
additional capacity for you to take on extra work
or extra stressors in your life.
But if you do not already have a healthy lifestyle,
it will actually exacerbate the problem at hand.
There is a technique
to help us take regular breaks.
The Pomodoro technique
has actually been implemented in some pieces
of software, and I can tell you that some of the
forensic software have introduced some of this
technique into the software for officer care.
And what this technique does is basically this,
when you choose or select a task
that you work on, set a timer.
Say for example, set a timer for 25 minutes,
and this is the traditional technique.
When the timer goes off,
right, you can basically,
sorry, when the timer is on, you're basically focusing
on the task at hand. Once the timer goes off,
you take a five minute break.
Whether the 25 minutes is good for your
own self, that's up to you.
You can extend it, you can shorten it.
Some folks that I work with
like to extend the 25 minutes to two hours,
for example, because it takes, say, two hours
to process a hard drive. So during that time,
they're working. Once that alarm goes off,
they're off on a break. Software can do that
for you. Your phones can be programmed
to do that for you as well.
I really recommend people look at using technology
to regulate your breaks
and to build that routine in there,
as I mentioned earlier.
The next one is to obviously schedule your time off
in vacation so that you can recharge.
You have to disassociate yourself from work
responsibly. You've got to disconnect.
I am guilty of this. I have always
been guilty of this since until the very last
minute. So I can tell you that from
my own experience, it's something that I
really try to remind people to do because
I personally in the past have not done so.
And last but not least,
if you can maintain and nurture good relationships
with your friends and families and colleagues,
the reason for that is that you need that social support.
You need to have this network so that if
and when there's an anomaly in your behaviors,
they typically are the first to notice it
and they typically are the first to raise the red flag
around you. And if it comes from family members,
that alert, that notification
isn't as harsh as
if a medical professional tells you
that you've got a problem.
If you have the early detection, then to wait
to the very last minute when things are starting to fall apart
and you're too far to the right, that becomes
a serious issue.
Next, I want to talk about hacking health.
Now, in our industry,
there has been a lot of groups
and movement towards hacking health.
And so these are actually very fun
events if you've got the time.
And I feel like you do need to specify
and build the time to do this
and dedicate the time to do this.
And it can be as simple as basically choosing an exercise
that you like to do.
Things like walking, for example.
So instead of
playing an extreme sport,
it's a 15-minute walk around my office building
because I enjoy taking a walk
and it relaxes me and I'm not thinking about work
during the time that I'm taking this walk.
Other areas that you should also think about
is what is the intensity level?
So regular, moderated exercise
is typically more beneficial for stress management
than the occasional very, very intense workouts.
So, again, back to that routine,
build the regular exercise into
your health routine so that you can really reduce
the stress levels. And last but not least,
simple one is just listen to your body, right?
So if you overdo things,
you're actually creating more stress for yourself.
Say, for example, you did an intense workout
and you injure yourself and the next day
you respond to an IR.
You're not doing yourself a service.
Last but not least, squat up.
Again, think about building that support network.
So there are groups out there that promote this,
such as Blue Team Fit, Defer Fit,
even here at DEF CON.
The DEF CON run was done a couple of mornings ago.
And just today on the conference floor,
I bumped into a new group, or at least a new group to me,
which is the Hacking Your Health group.
And their website is hackingyourhealth.com.
So, again, there are many groups out there
that promote this.
And the best, I think the best notable
in our industry for this is Hacking Dave.
And he posts a lot about his workouts
and how he hacks health while running a cybersecurity company.
I highly recommend that you follow him
and you look at the things that he's been doing.
And last but not least, post your successes.
Hey, I've done a workout today.
You know, I ran two miles on the threat mill.
I've taken a 15-minute walk.
Post it.
Reveal in your success.
We need the achievements to lower our stress levels.
Work-life balance.
I feel like we talk about work-life balance a lot.
And this one is, again, you know, pretty straightforward.
We do need to look at marrying what organizations are responsible for
and keeping our organizations honest.
So, as an employee, absolutely, you got to start setting work limits
if possible within your environment.
Make sure there are clear boundaries.
One really good one is cell phones.
I personally forced my company to always pay for a work phone
and my personal phone is my personal phone.
What I would do is, for work, if I am on call,
if I'm not on call, it stays off.
And that way, if anybody needs to reach me,
I have processes in place to pay all my second-in-command.
You're not talking to me.
You're talking to the other individuals that is on call.
And learn to say no.
I feel like as many performance individuals,
learning to say no is difficult for us.
But you really have to protect your time and your energy
and you've got to decline things.
I've talked to my bosses in the past where I say,
do we really need to take on this case?
Most of our team is already engaged on an engagement.
If we add this to them, we have no capacity
to deal with other emergencies that may arise.
So, again, back to that 80% to 20% rule,
effectively, I'm telling my boss we are at 80%.
If you want us to take on anything else,
there's a chance that if something comes sideways at us,
we have no capability to deal with.
Plan your day.
Start to look at routines, right?
Use calendars, use task management applications.
There are tons of these things out there now
that effectively can schedule all eight hours of your day
very easily.
And if you start seeing things start to overflow from those,
you know you're stretched.
Always look at setting long-term and short-term goals,
both for your work and personal life.
I typically have weekly meetings with my staff members
to look at the short-term goals,
things that we can win very easily,
and as well as long-term projects and goals
to try to keep things organized and in a routine.
We're not getting things coming out of the woodwork
and scaring us or, you know, having emergency work
for no apparent reason.
Try to schedule it all far ahead as we can.
Communications, obviously.
You do need to communicate all of these things.
If you don't feel like you're capable of doing the work,
know that your organization knows
that they provide you the adequate training
to be able for you to do the job.
Supports such as the EAP programs
and the wellness initiatives.
I hope companies are providing those to their employees
because that's very key.
There's many times where I would utilize some of these programs
so that I can seek medical or psychological help.
And so those are very important programs.
And I 100% want to make sure that you check out
what you're entitled for within your organization's benefit plans.
The last two here are ready for my own personal experience.
Dealing with digital forensics and response perfection
is something that we do strive for.
However, it may be unrealistic,
or at least we may set unrealistic standards for yourself.
So really set achievable goals
and then try to avoid things that you cannot achieve.
Next, try to simplify your life.
If you have a singular task,
a singular goal, try to focus on those.
Too often, I find folks try to multitask
or juggle a number of different things at the same time.
And those tend to fall apart pretty quickly.
Now, not to say that you can't multitask.
I've seen some folks do it very well.
This is just coming from myself.
I'm not a good multitasker.
The next one is to really build a support network.
So you really need to identify key members
who are supporters of yourselves, allies of yourselves.
I find that family really helps in this particular case.
As you can see on the right here,
from a quote from John Sullivan,
his kids were his first indicator when, you know,
they notified him that, hey, you're grumpy,
and the first thing he did was unplug.
That said, like I said,
there is other folks that will support you.
Friends, colleagues,
they typically are the first to notice things off about you,
and they will tell you in a nice way.
Open communications.
So try to be as open and honest and transparent
with your peers and your friends and your family members.
If you don't tell them that you're feeling down,
it's a lot harder for them to get you help.
Participate in professional networks.
So join associations like DEFCON, DEFCON groups.
If you're not feeling well,
feel free to talk to somebody there.
The rest, I think, are pretty straightforward.
So take a look at regular check-ins,
look at your company's EAP programs,
seek professional help if you're feeling
like you're on the right-hand side of those curves.
If you need counseling or therapy,
I highly recommend that you seek those professionals
out and get a professional assessment.
Last but not least, talk to a career coach.
Maybe there is something in your personal life
or maybe your career that could require some adjusting
in order for you to manage and reduce your stress levels.
This is the last part of my presentation.
I find these work really well for me,
especially when I'm in the middle of a 12- to 18-hour day.
I'm on calls with government officials,
everything's on fire, or hospital CEOs.
Breathing exercises is huge for me.
Taking a brief breath and then breathing out slowly
and just thinking about what to do next
is one that I find very, very useful.
Another one is the progressive massage relaxation technique.
What it means is I'm tensing all the muscles,
typically in my shoulder and my neck.
I tense it really, really hard, and then I relax them.
And I do that for about 10 times.
And after I've done that,
it seems to bring my stress levels down.
Meditation, not thinking about work,
thinking about maybe my last vacation,
visualizing that vacation also helps me
not think about the stress that I have to deal with at work.
Yoga is a pretty straightforward one.
I've been dragged to yoga many times by HR folks.
I find it very helpful just to be at those classes
and not think about work.
Self-massage, I have a terra-gun.
I use it often.
If you're sitting in front of a computer staring at a screen,
I guarantee you your arms and your shoulders hurt a lot.
You might want to use that. It's awesome.
Aromatherapy, my wife has introduced me to this.
Lavender is awesome.
And if you've got one of those little machines
that puff out the steam as well as the lavender smells, amazing.
That basically concludes my presentation for today.
If there are any questions, I am available.
But before I go, I will leave you with some external resources.
The self-care checklist is attached.
And on the side of this stage,
feel free to download it and use it for yourself.
Now, why are we not using some resources that are already available to us?
Well, I don't know why our industry doesn't do that.
But you can take a look at what first responders,
such as paramedics, firefighters have already in place.
So the Substance Abuse and Mental Health Services Administration
actually has a guide to managing stress for those types of first responders.
We can learn lessons from their guide.
That said, the Canadian Red Cross and the Canadian Mental Health Association
have a number of indexes and quizzes that you can utilize
to gauge and identify your stresses.
Again, if you can identify your stress, you can then plan and manage it.
So that's all I have for you today.
If you have any questions, I am around to answer them.
Thank you for an excellent presentation.
For those who might want those slides, where they're posted is right here on this wall.
The wall to my right here on the side of the wall, there's three documents there.
You can click on and view and download them if you'd like.
Any questions for our speakers?
Quick question. In your research, have you come across any statistics
on drug and alcohol abuse as it relates to incident responders?
So here's an interesting one.
We actually haven't had a chance to collect statistics and evidence
for digital forensics and incident response personnel.
Now, if you look at the first responder groups, such as police, fire,
they actually do collect that.
Now, here's my challenge to you for the industry.
We really do need to have that sort of industry statistic and metrics
for us to be able to better deal with this situation that we have.
Because I can tell you that once we start getting those numbers, it may be quite alarming.
I'm curious if there's any initiative to help the general public.
As we become more and more dependent upon technology in our daily lives,
are we looking at the impact these, you know, cyber crimes and incidents
and outages have on the general public, especially our young folks?
No, good question.
I think the impacts haven't crossed into the general public just yet.
I think they are secondary impacts.
The main impact would be to the direct organization that have been hit by
or that have suffered the cyber crime.
So the most direct one would be obviously the financial impact.
Okay, for example, if the bad guys ransomware a financial institution.
Right. I'm thinking, you know, generalized anxiety about is the hospital system going to fail?
Is 911 going to fail again?
Are we looking at the impact of when 911 goes down?
How does that affect our community?
Are we offering resources? Are we addressing that?
Are we allowing it to be one of those?
I believe you talked about kind of like us suppressed stress.
Are we are we paying attention to that and monitoring it?
So it's interesting question you asked because in Canada, we actually did have a 911 outage.
It wasn't a cyber attack. It was actually an IT issue.
911 services was offline to Canadians across the country.
And yes, it does increase the stress levels.
In fact, it created some issues for people who were needing those services.
Do we have, like I said, research and statistics on it?
I don't know. I don't believe there is any that has been captured.
But the impact of that outage was very significant.
Thank you. I hope we consider things like that in the future and, you know, put forth resources into that type of research.
Because as we become more dependent upon it, it's, you know, it isn't impacting our lives when systems fail.
I 100% agree with you.
And, you know, having talks like this is really to raise that awareness and we need to all collectively start asking questions to our government agencies.
Hey, are we doing this and are we doing this right?
Thank you.
Our next speaker will be up in about 15 minutes.
A bunch of wonderful topics. Wow. I'm like bedazzled over here.
Yeah. And if there's any sections that you missed or would like to, you know, be able to pause and fast forward and rewind, this is available on YouTube.
So this entire event is streamed to YouTube and you can watch it there.
Thank you.
Thinking on that a little more talking about the economic impact of the stress and anxiety that, you know, we'll just say tech situations or tech outages in general can cause, you know, it really is and not talked about enough.
And when we look at things like attrition and losing employees and such and how often, you know, our tech issues are relating to that kind of mental fatigue, but it really is very interesting.
I appreciate you having a talk about it. It is something that we need to encourage people to think more on.
Yeah. And I think there needs to be more research on this. My ultimate goal here is to try to get, not just government agencies, I feel like government agencies can't really help us with this.
I feel like the industry itself has to come together and look at perhaps putting together a framework for us to work on.
And if the framework is successful, it may turn into a standard. Like, let's be honest, there's so many frameworks out there in cybersecurity.
We should have one that basically says let's look at stress reduction. Let's look at burnout prevention frameworks so that we can save our staff members because let's be honest, without our people, we can't make money.
Very true.
Oh, good.
Finally admitted that.
Hey, you're done.
Yeah, I wanted to ask like about the mindfulness and staying calm and everything. What happens to someone who's located in a country is at a war at a war. Sorry.
Like, just feeling that the major anxiety or something you can't really control how can you maintain balance in that situation. If you have any thoughts.
Oh, that's a tough question.
Yeah, I know. Sorry.
No, no, no, it's good. It's good. I actually have a friend. He's Ukrainian and.
Yeah, exactly. I'm talking about situations like that.
He's got similar and everything you don't know what's going to happen tomorrow. So how do you make long term plans when you don't know if you're going to lose your legs tomorrow or something? I don't know.
I 100% agree with you and I feel like if you have an employee that that is that has either family members or are impacted by by war, I would say that you should try to be closer to them be part of their support network.
If you start seeing things or their behavior change, like reach out to them and find out, I mean, you could find out that hey, they just found out some bad news, you know, from their country that maybe a family member got killed, and you should just be there for them.
Our heart definitely goes out to everyone struggling and more.
Sorry, someone else was speaking. I didn't want to interrupt. Go ahead.
No, I just wanted to say like, it's, it's one of the most like the simplest answers you can think of, but there's probably nothing more helpful than that.
Just lending an ear and I guess a shoulder.
Yeah.
And humans are complex, but I feel like there are some simple solutions such as being part of their support structure, just being there for them.
And if you're the employer, for example, look at providing them some assistance in terms of time off or a long term disability, that sort of thing so that they can go in and potentially deal with the issues at hand, such as seeking medical help or psychosocial help.
Okay, thank you.
From a research perspective, do we have any data on, you know, I don't know about y'all, but I work in tech, I work from home. We are dependent upon a number of tools.
Anytime there's a tool outage and it affects my employees ability to do their job. It's a high stress environment.
I would love to see those protocols you were talking about and research on developing skills and techniques to help us in management be able to, you know, offer the employees some relief during these periods of time.
Because of course we're, you know, we're, we're building bridges, we're doing everything we can to get these tools back online.
But it is highly stressful and we probably should have some, you know, procedures in place to help them deal with the stress of it as well.
Yeah, I find that, so for example, when we look at what happened with CrowdStrike, when teams, IT teams were working around the clock to restore some of these systems.
If you have the capacity of people, for example, you're able to rotate teams out, that's probably the most ideal.
But if you don't have that particular capacity, then look at either bringing additional or third party help in at a moment's notice.
Again, a lot of this requires preparation, right?
And that's one of the, one of the topics here as well is to kind of build that capacity ahead of time, be a bit more prepared by having some of these support structures in place before you have an emergency and try not to overload your team already.
So try to keep them at 80% as opposed to 100%.
I talk about these like as in like, you know, they seem like luxuries, but if we plan ahead and do things right, then we should be at that point.
But I understand that, you know, emergencies, things come out of us from the side.
Yeah, when technology like CrowdStrike happens, it's definitely a huge stressor.
My team, for example, worked around the clock to get things done.
And yeah, other than having additional staff members are bringing third party help.
Yeah, I'm not sure how management can deal with that in a more effective way.
Right. And my concerns are also not just for my IT tech team that's dealing with it head on, but employees in other sectors that are being affected, they're not being able to do their job.
They may not be directly responsible or directly be able to even assist.
But, you know, we need something to help combat their level of stress because they're unable to utilize the tool that they needed.
You know what I mean?
Yeah. Yeah.
It's a tough question.
I don't know. I don't quite have the full answer for you.
And like I said, this could be things that we continue our discussion on and try to find the answer for.
Well, I appreciate you bringing awareness to the subject and hopefully we will be able to, you know, move forward with progress in that area.
I'm hoping that maybe in a year or two you can do a follow-up talk and tell us about all the improvements that have been made in the industry.
We're a positive one. Thank you.
That's a good follow-up. Thank you.