Show Notes: https://justinfimlaid.com/the-cavalry-is-not-coming

Sponsor: https://www.nuharborsecurity.com

Contact Me: https://justinfimlaid.com/contact-me/

Twitter: @justinfimlaid

LinkedIn: https://www.linkedin.com/in/jfimlaid/

I hear it all the

time, security burn out is high. I wasn’t until this week that I realized that

folks got the reason for burn out completely wrong.  After listening to someone tell me that a

large tech company burns out their staff due to work volume and rotates the

staff every 2 years I realized we have it twisted.  I don’t know about you, but most security

folks I know love doing security and a 60 hour week hasn’t burnt anyone out

when they do what they love.  If a 60

hour week does burn you out, then I'd recommend changing your work profession

as a matter of mental health.  Go do

something you love to do, then no one would have to pay you to work because

you'd do for free because you love it.

As a former CISO I

can say first hand that the work never burnt me out.  The environment and people are what burned me

out.  What I mean by that is that having

accountability for security and no direct responsibility for security in a $6B

organization was incredibly stressful. Most security folks I know are in this

spot. They have accountability for enterprise security but the role and action

of security is distributed across the organization. 

Also - there should

be some segregation of duties between IT and Security.   Since security is often monitoring an

environment they often see mistakes make by peers in the company outside of

security.  Those mistakes can make  security challenging, but those same peers

often have little motivation to clean up those mistakes unless it directly

impacts their job.  So, security having

to feel like they are in the position of digital janitor and clean up can be

exhausting.  There's only so many times

you'll clean up the spilled milk before you just leave it spilled.

Security leadership

has become a political position, evangelizing for security, educating you work

colleagues on security all so those same company peers when faced with a

security decision will self-select the correct decision related to security

when no one is looking.

To amplify matters,

you don’t have all the budget you need or want to do your job. Nor likely do

you have all the actual authority to make that decision you want to.  The threat landscape is also shifting so

tomorrow is always a new type of cyber attack.

All this is to say

that it's a tough job.  Not because of

work load only, but the surrounding intangibles of working in organizations who

probably are excited to pass off security can be draining.

I've got news for you, the Cavalry is NOT Coming.  You are on your own.

For those of you

listening to this maybe not grasping the challenge, let me propose an

analogy.  We’ve all been out to dinner at

a restaurant.