Another, much less bad piece than the previous one, on infosec burnout (albeit 2 years old): "Burnout And Staffing Shortages: Looming Cybersecurity Crises That Need More Attention" (https://www.forbes.com/councils/forbestechcouncil/2022/12/02/burnout-and-staffing-shortages-looming-cybersecurity-crises-that-need-more-attention/ .) Sadly, the prescribed solutions are then usually pie in the sky. IME good corporate infosec people have experience working as at least two of (developer, support, network engineering.) It's really, really hard to substitute that with "training" or a three-year degree course. A good start would be for coalitions of enteprise-scale orgs to start cross-training people in those fields with an interest in security (and an eye to avoiding the relatively lower non-mgmt pay ceilings.) Accept that many of them will start job-hopping (which is why it needs lots of orgs to participate.) Provide copious, good quality training, plus regular rotations out of the trenches to go learn new tools, skills, etc. This in particular will be very expensive, especially when ppl take free training for a few years before pissing off to another employer for a fat pay rise; accept thst as a cost of doing infosec business. (They can save big bucks by stopping buying ludicrously expensive "solutions" as a expensive cargo cult substitute for investing in their ppl.) Give them work experience with the teams they'll need to work with, or at least stick them at desks among them - not just tech functions, but especially back office support (HR, payroll, risk, finance, legal.) It's amazing what a few months with open ears can pick up, not only in terms of Intel, but some appreciation for what the civilians do all day, what their problems are, what they grumble about (and of course how infosec intersects with all that.)
And so on and so forth. I could write a book, but I doubt anyone would pay any attention. Perhaps spend a few years first on a precursor blog... Meh, what's the point? So much easier for orgs to carry on running the few sec people they have, hot, and the bemoaning it when they end up sitting on the hard shoulder in a cloud of dirty smoke with terminally seized engines. And that's why I will shortly be turning my bedside light out and enjoying sleeping away half the morning, rather than flogging myself to get up and go back to corporate infosec hell :)
#infosec #securityManagement #fail #enterprise #burnout
