How cyber attacks damage mental health (Classic episode)

every business will at some point be impacted by cyber attacks companies task security teams to prepare the first line of defense against cyber attacks and most have plans in place for the damage they leave behind be that data loss encryption by ransomware operators or even large scale service destructions but something that often goes unremarked upon in the wake of cyber attacks is the psychological human effects Left Behind when the dust settles staff can be left with feelings of fear or shame particularly those directly related to it security who's at risk of this harm and what can leaders do to minimize the impact that's what we're asking today on the it pro [Music] podcast hi I'm Jade mallan and I'm Rory basate today we're speaking to Parisa Basel head of user experience at data protection firm convolt to discuss the psychological harms that come with cyber attacks and what organizations could do to better support Frontline IT staff Parisa welcome to the show hi thank you for having me so to start off with Pisa uh as we said in the introduction we often talk about cyber attacks in terms of Damage Done to infrastructure money lost to recovery or even downtime but what are some of these potential psychological impacts yeah so there can be several I think um when we consider the fact that at the end of the day it's always humans that have to deal with it then um the damaging effects just kind of Mark back on that s like that Humanity right there's um longer term like kind of it's sort of a trauma response I think in a lot of ways um so in the moment earlier on there's a lot of high stress factors for the employees that have to respond to it um there's a lot of guilt Associated either with somebody who you know kind of admits the vulnerability or even those who were set up to defend the organization um they tend to express a lot of feelings of guilt um about the fact that it happened even though these days it does tend to be a little bit more inevitable given the sophistication of the of everything right now um and then even just kind of in the response time right I think you know on average people have talked about a being anywhere from like 20 to 30 days before the systems are fully up and running again and in that time frame you're looking at really long hours um those long hours tend to affect uh you know kind of like General Health eating habits sleeping habits and even the time that folks are able to spend with their families or just unwind and so there can be those sort of more um I would say like kind of intensely like almost traumatic effects on people especially in the shorter term and then of course there's the longer term things that come with it um you know once the dust settles I think that sometimes there's still folks who are kind of like left behind and um you know there can be just those prolonged effects of of guilt and stress and things like that um maybe a little bit more fear when it comes to operating in their dayto dayss um I know a lot of um I read um a paper that was discussing how a lot of folks are um I think around 40% look at possibly like changing jobs after situations like that just because they have such a high like association with the stress there um so I think it kind of covers a wide range of things in both the short and the long term what you're saying kind of reminds me of how people react after a house Breakin um whether or not they're at home that even though the burglar have gone they never quite feel the same in their own house that security has gone you know there's somebody else been in your space um your space has been violated and I guess if you've got you know people who want to do you harm even kind of you know in a digital way if you if you like sitting around in your systems and stuff it's got to be quite unnerving that as well that you can't there must be a feeling of not being able to be sure that they've definitely gone that they're not going to come back and I can see you kind of the analogy of you moving jobs with moving house if you just can't get over that feeling yeah I think that's a really good analogy um it's definitely a violation and I think kind of unlike the Breakin with the house um these are generally like extremely well orchestrated like well-run machines in terms of the people who are facilitating you know the ransomware the digital Breakin so to speak um but we t to carry I think that same um weight you know even though I think in many ways like a lot of it teams are just sort of outnumbered um when it comes to or just like out efforted right like when it comes to these these kinds of um these kinds of attacks certainly and there's the added weight um Beyond it being your home right it's almost like if somebody asked you to house sit or something like that like it's actually kind of in a way I think there's this extra weight to it this extra kind of guilt because you felt responsible for someone else's things and for so many other people's things too right like it's not just like one person it's a whole organization and people's identity tend to be tied up in their careers and their roles and things like that and so I think that the impact of that violation is really like kind of overwhelming across a lot of dimensions are we primarily talking here about the employees who maybe are the victims of cyber attacks such as I'm thinking maybe those who have been taken in by social engineering um or the security teams who have tried and to respond to the incident or or or everyone is this an organization wide effect that we're seeing here I think it's really an organization wide effect um there are really high numbers right now maybe around like two out of three employees who are feeling um like just General employees who sort of like are sensing that the world's a little bit more of a scarier place um just with kind of like the Advent of all this and and I think the conversation around it too especially with AI and deep fakes and everyone's heard the story about the man um who works at a bank who you know wired millions of dollars to fraudsters because they deep faked his managers on the zoom call right and so I think that there's a lot of of um paranoia and fear kind of across the board because what used to be these sort of like very siloed concerns are now kind of really propagating across an organization um and then I think of course like particularly there's such an impact on the IT team because they've got those responsibilities and I think it's very difficult for folks to really understand the extent you know to which the concern is for these kinds of people as as well as like the work that they have to put into to respond to it so I think it really you know goes across the board um and I think that with the IT team especially there tends to be these forgotten heroes in a way sort of aspect to it as well which is if there is a breach then they put in all these hours um you know they've already got the guilt about you know the breach having happen but then I think in many ways that organizations are so focused on normalizing again that there almost seems to be kind of like a thankless aspect to it and you know people have really worked and sweated and then that kind of know later impacts how they're feeling about their place in the organization as well on that point of the the thanklessness that can come with security um we recently ran a piece suggesting that fostering more of a supportive culture of psychological safety should be a key plank in any leader approach to security is this a strategic kind of must as well as ni to have when it comes to HR and and your workplace environment I think it's feeling increasingly like a strategic must again just kind of given the prevalence of how everything is um you know these days right like like just the attacks are so prevalent um the means to execute an attack are just exponential at this point and they kind of like expand on The Daily I think the common understanding in the industry right now I think people are saying that it's inevitable without fully internalizing what that means um and you know as a result what I I think like we kind of need to take a step back and really think about the whole psyche around it I mean when I talk to backup admins right it's just so interesting like when they log in um you know and they start their day up these are people who are operating from a place of like they're they look for what's wrong you know what I mean so like they're already in this mindset of like needing to they're kind of like assuming things might be bad or they're in this mindset of really like looking for things that have gone wrong which is an incredibly sort of like high stress place just to start from right um I think to sort of start your day looking for the bad stuff is kind of like never really uh going to be a nice feeling for anybody regardless of their their job um and then so there's there's a lot of support I think that's needed for those folks but just given the proliferation of everything I think that that's when it really becomes a necessity you know like maybe when ransomware attacks or or cyber security incidents were so much more rare um or when it be it was a little bit more black and white in terms of how you prevent against attacks um then maybe you know it's kind of understandable that things stayed a little bit more siloed or that there wasn't as much urg Mercy placed on the psychological safety for these different for different kind of folks um but I think that this is really a team effort at this point and as with anything like it kind of requires a certain sort of vulnerability to the conversation right like what does it really mean to accept the fact that you're saying inevitably every organization is going to be attacks like what does that really mean for your organization and for your employees and if you do you know kind of truly like believe or understand that to be the case in the industry then what does success look like through that lens you mentioned earlier paresa that um a successful attack if if we want to put it that way um can end up with people choosing to leave their jobs how important is having this kind of supportive atmosphere that we've just been speaking about in staff retention is it something that can mitigate the idea that people just they want to move on yeah definitely I think um I mean burnout these days is incredibly common in the um IT industry and I think it's especially risky when uh there's actually been an attack because that's when you're looking at like those 12 13 hour days right and just working around the clock and the poor eating habits the poor sleeping habits all that kind of stuff um and I think this is like a you know it's not only is it a huge cost the turnover to the organization but it's also a huge vulnerability right because you have all these folks who theoretically like would have learned something from the breach as well and you want them to kind of incorporate all of that knowledge and those learnings like back into the organization um and I think for them to be in a place where they're either feeling like it's thankless or that it's burned out or even that maybe the company didn't set them up for Success right not saying that it means the breach wouldn't have happened but maybe it would have been able to be resolved more quickly or they would have had like a little bit more of a game plan around it or there's broader employee education around the prevention or dealing with it right um so I think all of those kinds of considerations can definitely help offset the risk of folks like leaving or looking for other jobs um after the fact it's an interesting point you make there about potentially that knowledge walking away as well as the employee walking away those learnings from the attack um it makes kind of ties into a wider concern maybe around this being having just been attacked with this this psychological harm with this Maybe This demoralized Feeling among staff does that then put you at greater risk of a follow-up attack by the same threat actor by another threat actor are is there a a a pattern do you think of threat actors actively looking to exploit firms that are already reeling um or is that not as much of a concern you know I don't really know that I like I've seen any hard data around like double attacks right um but I think that you know you can imagine that given like burnout there's generally going to be like lower performance um not to say that it's anything in terms of like a failure poor performance on the employees part but more like if they've been working those really long days for a long time they haven't been taking care of themselves they have additional guilt both from a work perspective and a home perspective maybe um then what they're trying to do I think more than anything is just to normalize and not necessarily to you know kind of like reach Beyond like where they already were in the first place um so I think that that's sort of like the risk that would play out a little bit more in the future you know certainly from an iner perspective like they would have a lot more knowledge about the organization as well as like how that organization responds um and so I think that there's definitely going to be some additional vulnerabilities there um but I think that just from an organizational standpoint right um there's maybe like an opportunity cost to it where if you're just trying to get back to what's normal then it sort of in a way means that you're already incapable of being able to like move ahead I wonder especially thinking about sort of burnout post attack and also you this kind of stress or potential kind of PTSD type response if it's worth treating cyber Security Professionals the same way that we treat um First Responders the the emergency services that if they have to respond to a major incident once that's dealt with they are then given some time off you know some maybe talking therapies uh to to get over what they saw obviously you know dealing with the Cyber attack is not quite the same as dealing with a situation where people may have been physically hurt but when we're talking about these stress responses is there is that perhaps part of the answer as well in terms of getting not just company back on its feet but getting the professionals who were involved back on their feet as well yeah certainly um I read a stat the other day that was like around like 2 and seven I think like seek like mental health support after having to respond to an incident like this um you know while you're right in that there's no kind of like physicality to it I suppose in terms of like really seeing anything like physically traumatic um I do think that there is a real like psychological impact to it and that people need support in order to feel empowered again right like I think that's the biggest thing is that you've already taken a really big hit you know um someone's essentially come in and committed an act that makes you feel like you're not doing your job properly even though it's something that you know you're giving 40 hours a week to and that you you know are earnestly like taking pride in or at least like trying you know really hard in and so I think that you know the question of how we can kind of impower these employees moving forward as opposed to just resolving the incident itself and like kind of moving on like carrying on I think that's sort of the extra step that organizations need to need to think about taking you made an interesting point earlier around the culture of this expectation that you are going to get breached at some point you are going to get hit by a Cyber attack and you just have to deal with that in your role is it the case that leaders need to be taking this on board and taking this to heart more beyond the slogan of everyone gets hit at some point we just have to recover from that planning in advance and saying okay but in in in essence that is part of the role then is to be hit and to and to bounce back and we need to provide the resources to make sure that they can when the time comes and do you think they are taking that to heart enough right now I think it's easy to say without really understanding what it means to be honest so in general right like when we think about good leaders like good leaders are people who are able to kind of like bring out the best in everyone right and have to have people rally around a shared goal and so again like I guess I would encourage people to look at when they say you know cyber incidents are up 200% right or ransomware I think is at like 10 trillion a year now as opposed to three like and and so it's inevitable that we're going to get attacked or that one of our third party vendors will in disrupt our our supply chains or whatever but like like what does that like really mean for the folks that make up your organization and again I think it starts with this place of like really understanding these it admins where they already are starting off with just like looking for things that are going wrong right like to just sort of having this kind of like um very charged like immediate openings to their days right like what is in red that's like the number one question that I hear like that they ask themselves when they when they open something up like they're looking for what's red and as a leader if that is sort of the inevitability of the role right which is that like we're starting from a place of just kind of like looking at what's wrong then you have to kind of Wonder like well how can I reduce the fraught around that thing that's read right um kind of like the anxiety that's connected to it right because it's fair to assume like you know that we need to start with like looking at what's wrong or that we are going to be breached but that in and of itself implies a lot of anxiety and I think that that's really the question is like how can you move towards a solution and like minimize the anxiety for these folks so that you can continually get the best out of them a recent report um published by the Royal United Services Institute um specifically recorded some of the feelings that employees had um had said that they were they were feeling around a recent ransomware attack um including shame self-blame and that this had kind of overflowed out of their professional life into their personal life as well um is there anything outside of the specific role requirements that leaders can do to stem this shame following an attack and and to to broadcast kind of organization wide to ensure that um these these uh feelings that flow into the personal life um aren't happening I think the number was thing is just to kind of facilitate a conversation around it more than anything else you know um it's an incredibly well one I think historically it's always been a little bit of an isolated industry within an organization like an isolated team within an organization right like it folks are people who um I I think it's kind of like I guess the plumbing in a house right like when you go to buy a house you're not asking about Plumbing but then if you don't have it it's a big problem so I think that it folks have kind of been this like hidden necessity for like a very long time um but now given the breadth of the um attack Vector which means like people can come in through any employee they can come in through third parties like whatever it is um it's become much more of like an organizational conversation and often times like when these attacks happen I think most of the time right like I said the main goal is to kind of like normalize but not really necessarily think beyond that and I think that that in of itself like exacerbates this kind of isolation for that particular Department um and when you factor in like these you know these feelings of like shame and guilt and all that they're sort of like compounded by the fact that there's really like nowhere for them to go right and there's also no point of reference in terms of maybe the commonality of these attacks or just sort of like the fact that maybe this it team was doing everything right and that you know they're just these like massive basically corporation like organizations Behind these attacks and things like that so I think facilitating the conversation is kind of the biggest thing really about like how did the attack happen how did people respond to it and then maybe like what are we going to do like what are our learnings from this moving forward in terms of both like how it happened as well as how it was handled right but I think that there needs to be a conversation that allows like the team um to really process it and as we were talking about earlier incorporate those findings like back into um back into the company you know so paresa let's imagine that we're in a company that has been subject to a Cyber attack now we are certain that they have been evicted from our systems that everything you the emergency is over what are some First Steps like in that immediate aftermath that leaders can take to reassure their staff and reduce some of these psychological impacts I mean so um saying that everything's sort of gotten back to quote unquote normal um I guess I think the first thing would be kind of like the mental well-being and like the check-ins with the team you know um I would say like just when if there is a lot of guilt there people are probably going to feel like they need to prove themselves or work a little harder or whatever it is and I think just sort of the reassurance from leadership that maybe they should like take some time and process and like reflect on the incident is going to be very helpful um and then as I said I think that there needs to kind of be like a a collective conversation around it right like that's something that kind of happens in in a safe space So within the organization I think definitely whether it is from the sea Suite down to the admin or something like that right like just to kind of go through like what actually happened like how did we respond to it and what would we like to change moving forward um across the board so not just how the attack happened but also you know how what the conditions were in terms of like how the IT team had to resolve it um and I would look for you know moving forward I think one thing that'll probably start happening in the industry more is um I guess interorganizational conversations so I know with some of the admins that I talk to you know beyond just kind kind of being isolated in their organization like they really don't have a chance to have conversations with their peers um at different organizations because at the end of the day like everybody's kind of dealing with the same stuff and I think that that's it is sort of a highly um I guess like private or secret industry in a lot of ways like you don't necessarily want to show your hand that makes you feel more vulnerable um but I think that like we all really need to as a group think about how we can kind of start to have these conversations um between different it teams because bringing those heads bringing those ideas and those experiences together I think are going to just kind of create a lot of learning whereas right now there's a lot of work on each and every it team to figure out okay this is the nist framework what does that actually mean in terms of features and functions that I have to enable right um I'm supposed to be air gapped like how am I actually like what does that translate to like what does it mean for my organization to air gap right um so I think that that is really something that leadership can can look for or you know maybe within their own sort of like networks and industries think about bringing all of that stuff together um so yeah I would say there's kind of like the more immediate check-in just on a personal level like taking the time U maybe any connections to you know talk therapy or whatever it is that helps people kind of process and like go of a lot of the emotions associated with the incident um I think there should be internal conversations around it um and just kind of again through the lens of we all said that this was going to be inevitable and so given that you know what did we kind of like learn from it and then I think more broadly like longer term moving forward is like are there ways that I can set up my team beyond the confines of this organization that kind of allows them to connect with peers and in doing so empowers them in terms of like moving forward well unfortunately that's all we have time for today but Parisa thank you so much for joining us yeah thank you this was so much fun as always you can find links to all of the topics we've spoken about today in the show notes and even more on our website at it pro.com you can also follow us on LinkedIn as well as subscribe to our daily newsletter don't forget to subscribe to the it pro podcast wherever you find podcasts and if you're enjoying the show why not tell a friend or colleague about us we'll be back next week with more from the world of it but until then goodbye goodbye [Music]