The cost of burning out your people
Aug 13th, 2021 by Jesper Kråkhede
Following my short post from New York, something more serious.
The last eighteen months have been one crisis after another for security people. First the move to working from home, then a constant wave of ransomware, supply chain attacks and critical vulnerabilities that had to be patched yesterday. Many of the people I work with have not had a real vacation since 2019.
That has a cost, and management needs to see it. Tired people make mistakes. They miss things in the logs, they skip a step in a recovery, they make the wrong call at three in the morning. Tired people also leave. And replacing an experienced incident responder or security architect takes months, if you can find one at all.
So what can management do? Accept that crisis mode can´t be the normal mode. Plan for it: build teams big enough that people can actually be off when they are off. Use partners and retainers for the peaks instead of expecting your own staff to absorb everything. Make sure that people who worked through their vacation get it back. And ask your security team how they are doing, and listen to the answer.
Your security is only as good as the people running it, and those people need rest.
As for me, I´m fine. I like what I do. But the credit card bill from New York was unusually high this month.