Self Care for Security Professionals

greetings right now I'm honestly a bit in shock because I think Rachel's keynote got started a few minutes late and so to see this room filling up while I'm pretty sure she's still speaking is incredibly incredibly flattering to me thank you so much for being here my name is Caroline Wong and I couldn't be more thrilled to be here today this morning I want to tell you a little bit about myself and my hope is that my story might inspire you to share yours I started my information security career more than a decade ago leading security teams at eBay and Zynga since then I've led a global product management team at Symantec been a management consultant at

digital and I'm currently the chief security strategist for a pentest as a service company called cobalt IO based out of San Francisco I've been named by the executive for Women's Forum as a woman of influence in the one to watch category I've published a best-selling textbook with McGraw Hill on the topic of security metrics I've been featured by se Magazine as an influencer in their issue on women in IT security and cloud now has chosen me as one of their top ten women in cloud I'm on the advisory counsels for RSA Conference

called whist ik I'm publishing six LinkedIn learning courses on the OWASP top ten and I host a podcast called humans of InfoSec this is my professional story and it's my public one my personal story looks a little bit different in 2012 I married the wrong person and in 2013 I got divorced for years I've struggled with anxiety depression and alcoholism in 2014 my father was diagnosed with pancreatic cancer in 2015 my daughter was born and my father passed away one week later he might be thinking to yourself Caroline besides might not be the best place for you to be sharing this information maybe you should see a therapist I do and I have been for nine years so why am i sharing

this with you it's because our industry has a burnout problem we have a massive talent shortage and for as long as that's the case it is absolutely critical that the professionals in our industry take care of themselves because the world needs us in 20 in 2012 Google conducted a study to try and figure out how to build the perfect team they examined everything from how frequently people eat together to comment rates between the best managers they analyzed 180 teams throughout the company and they also reviewed half a century's worth of academic studies on how teams work surprisingly the data did not seem to show that any specific mix of personality types skills or back made any significant difference it turns

out that what does matter is something called psychological safety a sense of confidence that the team will not embarrass reject or punish someone for speaking up because I'm a security person I think about this like a software application that's never been tested for security issues the issues are there but they're hidden until someone intentionally tries to find them or they explode unexpectedly during an incident security teams are always going to have their issues regardless of whether people talk about them or not team members that trust each other are more likely to share information so that issues come to the surface and can be managed efficiently and proactively if I'm gonna take a half day off work to

celebrate my daughter's birthday it helps for me just to say so that way my team knows where I am and we can all plan accordingly it's much worse if I don't tell anyone and then that morning I just pretend to be sick and I don't show up in the office the latest global information security workforce study by is c-squared reports that the world could use almost 3 million more cybersecurity professionals and is this a study found that 70% of cyber security professionals feel impacted by the talent shortage resulting in an increased workload in a situation where teams spend more of their time fighting fires then focusing on training planning and strategy does that sound familiar it's also the

perfect setup for burnout burnout is described as a state of chronic stress that leads to physical and emotional exhaustion cynicism and detachment and feelings of ineffectiveness and lack of accomplishment does that sound familiar severe burnout means that you can no longer function effectively on a personal or professional level the tricky thing is that burnout doesn't happen overnight it's sort of creeps in gradually in this sneaky way that fools us into thinking that living in a state of constant stress is normal and acceptable living in a state of constant stress is not normal and it should not be acceptable what we're capable of bringing to the table as healthy happy functioning professionals is simply too valuable to

lose due to a lack of team trust or to burnout early in my career I used to put up with being treated poorly because I thought it was normal and I used to treat myself poorly too I don't do that anymore self-care starts with believing that you deserve it I want to talk to you about a concept called cognitive behavioral therapy the basic idea is that thoughts emotions and behaviors are all connected and that you have the power to change or at least influence one by changing the other to do it you identify a negative thought process and you try to change it into a positive one it can be much easier said than done because our negative thought

processes are often so deep-seated in our brains that we don't even realize they're there I'll give you a couple of examples my parents are immigrants and they've raised me to be able to take care of myself and to have as many choices in life as possible growing up doing well in school was a really big deal as a child and teenager I did well in school and that felt really good but when I started the electrical engineering and Computer Sciences program at UC Berkeley all of a sudden that part my identity changed it took me decades to develop the core belief that I'm smart and I work hard unfortunately over time I also began to develop a few

associated core beliefs that are quite negative and self-defeating number one my worth comes from my success in school and work number two if I am NOT constantly exceeding expectations then I am a failure and number three I need to work harder and unless I'm succeeding I don't deserve to be treated well over the past 10 years or so I've worked hard to try and replace these negative belief processes in my brain with positive ones I accept myself as I am right now I know and approve of myself I embrace balance I allow myself to play and to enjoy life I went through this quickly at the beginning 2015 was a really crazy year for me my father was fighting a terminal

illness and I was pregnant for the first time and it was a pregnancy that had complications I began to for a variety of different reasons I also I'm sort of like a natural warrior worrier not warrior although you know I'm warrior too but I'm a warrior and I think that this industry attracts workers so worrying can be can be destructive and I want to also share with you some cognitive behavioral therapy that I work on personally with regards to worrying about things so my negative thought process that's related to anxiety says that bad things happen and also that the worst-case scenario will happen to me I won't be prepared and I have no control over my life this is not a fun way to

live and I have lived like this for a very very long time I'm working on it and and it's getting better but it's this thing that takes a while so what can I change my negative thought processes about worrying and anxiety too I can tell myself that things happen and in fact good things happen just as often as bad things happen and since I'm the one who gets to choose what I think it's pretty convenient if I believe that good things are actually more likely than bad things to happen I've talked with my therapist about when I worry about something or when I have like this daydream nightmare or something horrific happening I can I can change it and I

can instead try and think about something that I'm grateful for there's this idea that the mind can only hold one thought at a time and if I can think about something I'm grateful for instead of something I'm worried about that can actually feel a lot better it's much easier said than done another thing and I grew up going to Catholic school so I would like walk around the church and there were these plaques that had the serenity prayer and while I consider myself to be a recovering Roman Catholic and I don't actually subscribe to that particular formal religion I do think there's a lot to be said for recognizing in life that there are things you can control and there are

things you can't control and there's sort of no point to worrying about the things you can't control but to the extent that you can recognize and actually do something about what you can control you can actually I believe you can change your life so my negative cognition here was you know bad things are gonna happen and I won't be prepared my positive thought process that I'm working on and that sometimes I believe right now I believe it is that if stuff happens and it will I actually trust my future self to be able to handle it I know that I can handle all sorts of stuff and I trust my future self to be able to handle it my

current self doesn't have to worry about something that's not happening right now okay so we're switching topics we're back to the information security talent gap for those of us that have and are developing skills and information security there was this beautiful silver lining to the talent gap and that's we have choices so in 2016 my daughter was a year old it was becoming apparent to me that my lifestyle as a traveling management consultant needed to change I began to search for a local job and I spoke with 15 different organizations about various information security roles 15 is a lot of opportunities that's a tremendously fortunate position to be in for me one of the coolest things about becoming a

mom is it my sense of what I want and what really matters to me has become clear so during my job search in 2016 the number one criteria that I looked for was working with people that I like and respect who like and respect me and it's fascinating to me that that is something that I have to like seek out that I can't just sort of take for granted but I have had experiences with toxic colleagues and in toxic work environments and I don't want that anymore it turns out that being surrounded by people that I trust actually makes my life a lot better every single day is better when I can go to work and look

forward to seeing my team my number two criteria this time around during my most recent job search was the ability to have a big impact and that's why for the first time in my career I decided to join a startup and it has been very awesome I'm here to ask and encourage you to take care of yourself and I want to talk to you about some ideas that I have about how to do that I think it's really important to try and get to know yourself we live in this world where there's so much stimuli stimuluses stimuli there's so much stimuli there's so much going on there are a million things asking us for our attention we

can become experts in things that are outside of ourselves it's a different type of effort to try and become an expert about yourself and I would argue that it's actually SuperDuper important so get to know yourself how do you do that pay attention to how you feel which again for some of us is easier said than done I literally remember sitting in my therapists office about a decade ago and she said to me Caroline how do you feel and I said I have no idea like I can tell you intellectually what I'm thinking and I can tell you I can tell you about the sensations in my body like I have a headache I'm hungover but I

can't tell you how I feel so I had to really I had to practice so if you're not good at figuring out how you feel that's okay you can try and over time it's actually something you can learn so I want to talk about managing your energy because here's sort of a practical way practical way to use paying attention to how you feel when you're doing something well let me just read this part actually okay there's a lot of techniques and strategies about how to manage one's time but what about your energy there's only 24 hours in a day but given your energy level you can either feel completely depleted and like you have nothing left to give or you can

feel inspired like your tank is full and you can accomplish anything so next time you're doing something anything like right now you can kind of check in with yourself and say like does this make me feel good or does this make me feel not so good and if it makes you feel good do some more of it and if it makes you feel not so good figure out a way to do less find out what gives you energy and what takes it away from you and choose your activities accordingly okay so this next section here are a few things that I do to take care of my mind meditation which if you haven't meditated before can also seem

intimidating luckily there are smartphone apps to help you at this home headspace beautify you just like put in some headphones and press a button and then you just like listen and it can be a really nice way to create some space in a very frantic day journaling another thing that it's kind of like easier said than done because you have to like any of these things carve out time to do it and you don't have to carve out like a ton of time one of the most useful times I ever journaled was a time when I was feeling deeply depressed and what I did was I was like I feel super depressed and I don't know why this is really

confusing and so what I did was I put a notebook next to my bed and in the morning the first thing I did when I woke up even before I grabbed my phone even before I went to use the restroom I would grab the notebook and I would just write stream-of-consciousness like a page there's a book the title that I can't think of right now that tells you used to write like three pages I wrote like a page and I did this for like a month and the point is actually not even to go back and read your journal but when you're in that mode of like waking up you're sort of going from like not conscious -

conscious and there's this way in which like your subconscious know stuff about you that you're conscious doesn't and so I was able to kind of capture some things and for me that particular exercise led me to realize that I sort of was not with the right person and so I decided to divorce my husband it was the best the best decision I've ever made I'm in therapy I'm medicated I have life insurance so as a mom something that helps me tremendously with addressing my anxiety is to have insurance that's really cool taking vacation or taking time off and doing art I think there's something really beautiful about doing something that's like not productive and I think

art and I think pets are really good so we've got ten minutes left it's almost time for Q&A I'm gonna go through these next couple a little more quickly take care of your body try and get some sleep try and eat some stuff that's good for you cooking can feel really nice there's nothing like baking cookies move your body and care so in my slide I had care and then in parenthesis I had feet comma allergies and I was like I'm just gonna talk to that part so what that means is I've got this condition where I have flat feet and so if I wear normal shoes and I just go throughout my day even if

or or if I'm barefoot in my house my feet like really hurt it's called plantar fasciitis it sucks so now and we're like proper shoes it makes my life so much better and I also have dust and dust and like pollen allergies so I use a neti pot and I and I use a nasal spray and it just makes it makes life better I'm parenting myself sidenote there's this group called ACA it's kind of like a a but it's something slightly different and the whole idea is to be like a really good parent to yourself and life can be better so take care of your spirit it's nice to surround yourself with people that respect and like you and that you like

your respect that feels really good it's nice to work on things that make you feel like you have impact it's nice to hang out with friends and family and pets it's nice to have groups of people around you that you feel like you can rely upon it's nice to think about things that you're grateful for and it's nice to have rituals whether that's you know making a cup of espresso in the morning okay key takeaways and then we're didn't gonna do Q&A I'm going to leave you today with three key takeaways be committed to your work and learn everything you can make sure you really understand whatever problem you're trying to solve and then apply your

talents and work hard number two be opportunistic if your job sucks find a better one seek and leverage mentors who can see your potential and advise you beyond your own experience and number three most importantly take care of yourself you will deliver your highest quality work when your heart mind and body are well thank you

and now it's time for Q&A and you're supposed to use this slide Oh thing and I don't know how I'm supposed to use slide oh I'm just gonna stand here and if there are questions I will respond to them oh I have a microphone as well so if the audience has any questions I can run over and hand you the mic so I believe we have our first question down here and then our second one will be up there so I'll be right over

Kelly hi I'm Kelly thank you for sharing this I wanted to know how honest and open are you with about with this stuff about your team with your team at work and in the workplace I'm super honest about it with my team and I think that it creates a nice environment I often talk about my mental illness and my personal growth with my team at work you know right now I think this is being recorded and maybe it'll go up on YouTube and then the whole world can kind of find out so there's no there's no point really to being secretive about it I've developed a level of comfort talking about it I wasn't always as

comfortable the first time I presented this talk I was like super awkward and vulnerable and shaky and I don't think there's any value to sharing stuff before you're ready to there's all sorts of ways to share it in in degrees right you can write stuff down put it in a journal just with yourself I write emails to my therapist that nobody else reads except for her it's amazing sometimes I coffee my best friend sometimes I coffee my sister you know there's all sorts of messed up stuff that has to do with me I didn't talk about today but this is a stuff that I've developed a level of comfort we talking about and my team knows me I

used to have this thing where it was like oh I've got this like professional self I even like I've had like a professional wardrobe and I'd like this personal self and they were two different people and now it's just it's just easy to just be one me hi my name is Susan Petey Akal I appreciate your talk today and thank you so much for I'm up here sorry hi oh yeah there's a spotlight no I just like to try and you know look at people so I actually am part of a group called mental health hackers and so thank you so much for bringing this talk to b-side San Francisco and shining some light on

it if anybody else wants more information aside from like what Carolyn talked about and would like to connect I'm one of the board members and I would love to spread that message there too we're trying to be at as many conferences as possible create wellness valinda villages so people don't feel so overwhelmed so people don't feel alone impostor syndrome all of those kind of things that people feel so mental health hackers were on the web and I have stickers if anybody wants them to so thank you I would love a sticker mental health hackers thank you so much what a wonderful presence hi I'm Ava I'm curious how much like what percentage if you put a number to it you think that

maintaining a professionally separate identity contributed to your stress and your burnout or what you're talking about yeah I think I think that for me actually the like professional Caroline and then the personal Caroline and that separation I think for me that was actually a symptom not a cause so for me I sort of had these goals and these values and you know at work it was like okay I I want people to perceive me in a certain way and so I'm going to highlight those parts of myself and then my personal life you know whatever and these days these days it's just one in the same and I and I think it's less that I chose it as a thing to work on

and more of again a symptom of my continued self growth it's it's just honestly for me a recognition that for me it's easier and I've taken baby steps you know the first time I met with a co-worker and I said hey you know such-and-such about me is going on and that person was receptive and supportive and caring and not taunting it was cool you know when I recognized that there was a way where I could actually connect with people and then what I have found out is that for any given struggle that I've experienced that I confide in someone that I trust I find out actually lots of other people struggle with this stuff too and that

helps me feel a lot less alone hi I'm Sarah hello as somebody else who also married someone and realized it was the wrong person did you find I know this is a super specific question did you find that at work people were supportive or did you sort of cover that up when it was going on because I found that one quite tricky in the workplace yeah that's a very interesting question I think for me you know part of my at the time work persona when I was for example engaged and married was sort of this like happy-go-lucky you know bride and then all of a sudden that like wasn't me anymore and I think for me at work you

know people would make assumptions because they were like oh you know you and your guy and I was like oh not really the guy anymore you know and then and and for me it's sort of like if it's somebody that I trust at work then I'll sort of like have a little side conversation with them and if it's somebody that I don't know very well then frankly it's none of their business and what we have to do at work is what we have to do at work whatever the task is at hand whatever the project is at hand you know my personal life does it like isn't anyone's business like I'm here encouraging people to share but also

very much to the extent that you are comfortable with you know you may be a private person in which case like it's totally cool to be like you know what I'm a really private person and I don't really feel it like I like talking about that right now that's like a totally like that's an awesome thing to do for yourself hello I'm Mitchell thank you for the talk is very helpful uh how would you go about disassociating feeling like your job is your personality rather than trying to separate the two yeah so this is a really interesting thing particularly in the United States where there's sort of like this like work hard make money buy

stuff culture I think the trick is to do other stuff and I think the trick is to you know sometimes that's easier said than done - right where do you find time to do other stuff like but you you can you can like during a meeting like draw a picture on your notebook that doesn't have to do with work you know you can draw a picture of a dog and you're like okay I'm I'm a person who draws dogs you know and that will literally take like five minutes you know you can you can on your commute and listen to whatever music you love and depending on where you're at and your comfort level with it

you can like scream at the top of your lungs you know you could take a five minute bath and then you're like a person who takes baths and so I think that I think the trick is like to recognize that in a day like a lot of what we do has to do with our work but there's stuff that doesn't have to do with our work - like I'm wearing hiking boots - that whole shoe thing that I was talking about and I was kind of stressed out about it like oh maybe I should wear like more professional looking shoes and then I was like you know what these shoes are really comfortable and I'm pretty sure

no one actually cares what shoes I'm wearing so I'm like I'm a person that wears hiking boots to a professional conference howdy Alan here have you struggled with impostor syndrome it was mentioned before up there I was just curious what your take on that was yeah so my first information security job was on the eBay information security team I will briefly tell you because I think I have like maybe a few more minutes before the next talk is gonna happen I was in college I'm studying Electrical Engineering computer science it is my junior year and I think okay I'm supposed to get an internship so I look for an internship I apply to like 40 or 50 different jobs I

get this internship at eBay and I graduate and I say to my hiring manager for the internship hey can you hire me because I would really like to work your team full-time and he says to me we would love to hire you but we have a hiring freeze an IT however there is this entry-level position in information security you should apply to it and I literally said I don't know anything about information security and he said that's okay you know they're looking for a new college grad to train you know the expectation is not that you've been doing this for a long time and so I start this job and my job is to be in

charge of the 50 page information security policy I'm supposed to be the subject matter expert and people in the business come to me and they say hey why do we have to follow these information security rules and I'm supposed to like you know tell them why so luckily for me I type really fast and so I'm able to have a meeting type really fast if I don't understand everything that's going on I write it down and then I go and talk to one of the team's managers one of mine team's managers and I say like hey this is what's going on can you teach me about it and then I go back and I say okay here's here's what you need

to know so that for me was a very difficult place to be in because I was sort of in this role where my job was to provide information about this the subject matter that I was I was just learning about all right I want to just go ahead and end the discussion right here but Carolyn will be here all day at V sides so if you have more questions about her talk self-care please come by and meet Carolyn she's wonderful we will be taking a quick five-minute break so we could switch over to our next talk by Kelly Robinson thank you very much for your time