Penetration Testing and Burnout
Table of contents
It's that feeling of your nerves being stretched like sinew over mounting expectations and due dates. When your attention keeps an exhausted but stubborn focus on an ever-shifting goal because there is always one more attack to check, one more use-case to implement, or one more task added to the pile that, before you realize it, has already broken out of manageable control. But you have to do it!
Coping mechanisms kick in as a redoubling of efforts is made. Perhaps caffeine becomes your lifeblood, nicotine your connection to capability, or another vice sustains your focus. Whatever it is, it provides short-term relief, but eventually that relief is so brief that it's almost non-existent. After all, the work must not only be finished, but be better than expected and quicker than anticipated.
That is, until you simply can't do it anymore. The mere thought of getting out of bed to push harder or to "just muscle through it" is enough to cause a physical and emotional response. You've...burned out (and probably look as well adjusted as Charlie Jones from Coraline). In this blog, I provide some tips, guidance, and suggestions for testers and companies to help manage and prevent burnout.
But before we dive into things, it should be mentioned that TrustedSec is by no means a mental health organization. So, it is highly advised for anyone in need of immediate help to seek professional medical support. As penetration testers, our clients seek out our professional support to address their concerns, and I argue that seeking mental health support is no different. Everyone who pursues support becomes an advocate for their own wellbeing and future. It's true that securing a therapist can be its own challenge, but for those in need of help, free support lines such as https://988lifeline.org/, https://www.crisistextline.org/, and others provide voice and text support options.
What is it? Why is it?
It's something we all may feel at one time or another. Offensive security testing can be a high-stress, high-reward career: we operate under multiple customer deadlines, deliver high-value results, and contribute to or constantly learn from the offensive and defensive community. Combined, these factors can lead to performance paralysis through a snowballing effect, resulting in more tasks landing on your plate in a short timeframe.
But what is burnout? Listed as QD-85 in the International Classification of Diseases (ICD-11 Version 11)1, the World Health Organization (WHO) classifies burnout as "a syndrome resulting from chronic workplace stress that has not been successfully managed but that is not considered a mental disorder", with the following characteristics:
- Feeling of energy depletion or exhaustion
- Increased mental distance from one's job, or feelings of negativism or cynicism related to one's job
- A sense of ineffectiveness and lack of accomplishment
While the ICD-11 definition does make sense, it's only useful for classification and doesn't really provide steps or advice on how to address burnout for us, our coworkers, or others in the security community. Burnout isn't new—it has been and will continue to be around for a long time. It’s also a bit of an unspoken issue, which can only make the problem worse. Burnout may:
- Negatively impact physical and mental health
- Reduce professional focus, effectiveness, and interest
- Foster a disconnected or cynical relationship with coworkers that can impact professional growth
- Lead to problems with performance, which may result in job loss
But what can be done to help prevent burnout in the first place? Many reputable publications have released articles discussing it, and these can be a good first step to become more familiar with identifying and planning for when it happens. For example, ”Job burnout: How to spot it and take action”2 is a concise view, while ”Burnout: Symptoms, Treatment, and Tips on How to Deal”3 is a more detailed breakdown of burnout and how it differs from depression, and ”Burnout”4 is a comprehensive overview of what employers and employees can do and provides guides and worksheets to assist with both.
Many articles have similar warning signs, such as:
- Change in sleeping habits, lack of energy, or irritability
- Headaches or other physical issues with no known reasonable cause
- Using food, drugs, or alcohol to cope
- Reluctance to start or continue work, lack of feeling productive or dissatisfied with performance
- Feeling like nothing done matters or is appreciated
- Withdrawing from responsibilities, increased procrastination, or skipping work entirely when able
- Caring about work takes too much effort and is a waste of energy, or "every day is a bad day"
It's also important to know what burnout is not. It goes beyond regular tiredness and should not be confused with typical disinterest in a project, task, or responsibility at work. Like how multiple lower severity findings on a test may cumulatively add up to a higher impact, relatively minor stressors can add up to burnout but also may not. The impact of stress and burnout affects everyone differently.
Doing the Fixing!
The possibility of becoming burned out can have an impact on our personal and professional wellbeing. So, what can be done if you or a coworker is experiencing burnout? Articles recommend multiple options.
If you're able, the first step should be to communicate with team members and management to let them know that things are not going well, and a change is needed. Burnout is typically due to being overworked or having unclear or shifting job expectations, so it's fair to say that it's as much a management problem as it is a personal problem. Communicating with leadership will help ensure that everyone involved understands the reason for changes and allows the team to still meet client expectations and agreements.
Next, advocate for taking a bit of personal time to focus on recovering and becoming healthy again. Advocacy for recovery time isn’t solely the onus of the employee either—it’s just as valuable for managers or leadership to recognize signs of burnout among coworkers. When burned out, productivity levels, communication abilities, and stress levels are all notably impacted, resulting in lower quality work compared to when you are healthy. Some options to consider helping the recovery process may be:
- Take a break to focus on getting more sleep, practice yoga or meditation, or just chill with a pet.
- Step away from work to pursue other stress-free hobbies or interests. It can be harder to heal if you do similar activities that cause stress.
- Get a change of scenery with something relaxing like enjoying a movie, visiting a library to read in silence, or doing some vidya games with friends.
- Head outside and experience sunlight firsthand or go to the gym and exercise for a bit. Yes, taking a relaxing walk counts as exercise as well!
There is also the question of how long healing from burnout takes, which is fair to set expectations. I'd argue that the amount of time needed varies from person to person, so it's difficult to provide a specific timeframe. Keeping open communication with management is important so they can provide coverage, which allows you to return replenished.
Nobody should feel bad for taking time to heal when it’s needed! People shouldn’t feel bad about taking time to recover from sickness or an injured body, and this is no different!
Improvise. Adapt. Overcome.
Steps for preventing burnout can be similar to the steps taken to recover. Incorporating these into your regular schedule will help fight against future burnout. Of course, the risk is always there—we do a difficult, high-stress job with an ever-changing landscape of attack vectors, tight deadlines with new ones set every week (administrative work like kick-off calls to prep for next week’s engagement), and demanding client expectations.
It's only fair to ourselves to apply the same seriousness to our own wellbeing as we do with testing.
Most pen testing incorporates a high-level methodology. Everyone's methodology shifts and adjusts the further into the weeds you go, but they all start with the same steps. I think we can apply that familiar process to helping prevent burnout as well.
- Planning and Reconnaissance: Define your goal! We want to build a practice for managing job-related stress so that we can prevent burnout. Even an easy goal can be difficult to accomplish due to how small tasks can build up and add to stress over time. Look at what's been going on lately: what current things cause you stress? Identifying what the issues are is always the first step!
- Analysis: Consider actions you can take to help. What sounds the most appealing? Do they align with certain goals? Do they look like they will provide relief or is it just an additional stressor? Write these down in a journal so your analysis can continue well past initial stages.
- Attack: Put your planned actions into motion! Go do the thing that will provide healing and relief from burnout. Not all planned activities will work, and that's okay.
- Maintain Access: Check in with yourself. How are the actions going? Are they working? Do they just make things worse? If they don't help, then pivot to a different method. Focus on what provides relief to keep stressors at a manageable level and not overflow into burnout. The goal isn't to ride in the yellow line just before burnout but to find a balance so it's all manageable. Spikes into the yellow line or beyond should be saved for specific high-priority situations at work or in life that are temporary, not the default operating state.
- Report: Check in and be honest with yourself or do the same with a friend, a spouse, or a therapist. Honest feedback, either internally or externally, can help you adjust your plan so you don't go off the rails or aren't stagnating by doing something just because it worked in the past.
- Repeat: As your professional and personal life moves forward, revisit this process by returning to step 1. This is a lifestyle/organizational change, not a temporary issue.
Go Forth. Be Awesome!
Burnout is an issue that can affect anyone, and helping our friends and coworkers recover from it is an important responsibility for everyone on the team. At the same time, we owe it to ourselves to monitor our own mental wellbeing, manage our expectations and stress, and take care of ourselves. At the end of the day, burnout should be a temporary condition that we can recover from. Advocating for positive mental health can help someone suffering to recover so that the entire team can once again be operating at full awesomeness. As the legends originally said…
References
- https://www.who.int/news/item/28-05-2019-burn-out-an-occupational-phenomenon-international-classification-of-diseases
- https://www.mayoclinic.org/healthy-lifestyle/adult-health/in-depth/burnout/art-20046642
- https://www.helpguide.org/mental-health/stress/burnout-prevention-and-recovery
- https://www.psychiatry.org/psychiatrists/practice/well-being-and-burnout