Cyberattacks are on the rise as adversaries find new ways of creating chaos and increasing profits. Attacks evolve constantly and often involve real-world consequences. The growing criminal Software-as-a-Service enterprise puts ready-made tools in the hands of threat actors who can use them against the software supply chain and other critical systems. And then there’s the threat of nation-state attacks, with major incidents reported every month and no sign of them slowing.

Amidst these growing concerns, cybersecurity professionals continue to report staffing shortages worldwide. These shortfalls can have a negative impact on incident prevention and response alike. Short-staffed security teams must respond to cyber incidents whenever they happen, no matter the size of the team. Working with such limited resources increases strain and stress with each new incident, creating a vicious cycle of attrition.

Threat Actors Ignore Business Hours

Cyber criminals tend to launch attacks during off-peak hours in the hopes of scoring big while the staff is absent. As a result, incident responders often must work outside of regular business hours, sometimes during or just before major holidays. The first 72 hours of an incident are usually the most critical. It’s during this time when incident responders must find the primary attack vector, contain the intrusion and begin remediation.

Incident response does not stop until the situation is contained, which is hard on incident responders. Security professionals work long hours during an incident, oftentimes longer than 12 hours per day according to a recent study. 48% of responders report an average of two to four weeks of engagement, while 30% say incident engagement lasts even longer. It’s also common for responders to work on more than one incident at a time, further compounding the time and attention required.

Responsibility After the Incident

After an incident, it’s not uncommon for security professionals to feel at fault. They may feel an intense duty to protect and prevent the inevitable. CISOs in particular may feel obligated to bear the burden of responsibility.

Privacy attorney Alexandra Vesalga highlights the additional strain CISOs must navigate after recent litigation in the aftermath of an unreported cyberattack.

“CISOs are under tremendous daily pressure,” Vesalga said. “The cyber threat landscape is changing constantly, and many organizations expect their security teams to be omniscient superheroes, anticipating and preventing any and all threats.”

Cyber incident response missteps may personally affect CISOs. Vesalga continues, “Within these high-pressure cultures, CISOs often feel personal responsibility for cyber incidents. Pouring gas on the fire, there is a new trend toward personal liability for cyber incidents —  just last month, Uber’s former CISO was found guilty on criminal charges for his actions in response to a 2016 breach. He awaits sentencing and could face jail time.”

Negative Effects of Prolonged High-Stress Situations

Incident responders feel a sense of duty to continue working well beyond their physical limits. In some cases that might include working through one (or several) nights without sleeping. That lack of sleep can negatively impact decision-making, problem-solving and impulse control, all of which are crucial during an incident response.

Total sleep deprivation — 24 or more hours without sleep — takes an even greater toll on mood, decision-making and attention. A recent study of elite martial arts athletes revealed an increase in depression, confusion, fatigue and anxiety after 24 hours of wakefulness. Study participants’ physical performance was significantly impaired in a sleep-deprived state compared with their normal sleep performance.

Unsurprisingly, many professionals feel intense negative effects after a cyber incident. The effects of high stress over a long period of time can lead to higher levels of anxiety in everyday life, a symptom more than two-thirds of responders reported in a recent study. Incident responders also report significant sleep disturbances and back pain as a result of an incident.

Remediating Employee Stress Following a Cyber Incident

A recent study found trauma symptoms last for months after a cyber incident. Burnout is common and often leads to high turnover. Human resource management offices typically don’t have a specific protocol for cyber incident responders in place. Responders also reported a desire to change jobs or leave the cybersecurity profession altogether. Even without dedicated programs, incident responders seek mental health resources and report adequate access to these services.

Prevention is the best solution. Cybersecurity incident response is a serious role that can be difficult to step back from. BlackBerry’s Keiron Holyome urges organizations to craft their response expectations with a focus on ensuring teams know what to expect.

“If the past two years have proven anything, it’s that no organization in any industry is immune to cyber crime,” Holyome said. “Cybersecurity teams are critical to sustaining business continuity, they cannot afford to switch off and leave organizations at risk — especially because that risk isn’t limited to working days or business hours.”

Holyome goes on to discuss how long hours and stressful working conditions affect security teams. “Alert fatigue and the push to make important decisions with limited experience, knowledge or context can weigh heavily. When a cyberattack strikes, having a process to follow that reduces pressurized decision-making, and knowing that support is at the end of a phone call, can be a big step towards creating a healthier environment for those working in IT and security roles.”

Avoiding Burnout with Planning and Practice

The threat landscape is constantly changing and will require new approaches. While teams stay vigilant for the next incident, they need the support of their companies throughout the entire process.

Companies can start by addressing incident responder burnout, and other symptoms of a high-stress work environment. Allowing incident responders time away to rest and heal from the heightened stress of cyber incidents will help keep teams healthy and prepared for the next attack.

In addition, a well-planned response is only effective when staff has the opportunity to run through exercises to understand who is responsible for what. Practicing tabletop exercises helps staff mentally prepare for incident response. Working from the familiar removes the stress of the unknown, so staff can focus on response and remediation. This time can be used to reiterate the importance of and process for taking breaks from the work.

Senior leaders can’t ignore the importance of taking care of incident responders. Better working conditions will lessen turnover rates and keep talented professionals in the chronically understaffed field.

More from CISO

CEO, CIO or CFO: Who Should Your CISO Report To?

As we move deeper into a digitally dependent future, the growing concern of data breaches and other cyber threats has led to the rise of the Chief Information Security Officer (CISO). This position is essential in almost every company that relies on digital information. They are responsible for developing and implementing strategies to harden the organization's defenses against cyberattacks. However, while many organizations don't question the value of a CISO, there should be more debate over who this important role…

Everyone Wants to Build a Cyber Range: Should You?

In the last few years, IBM X-Force has seen an unprecedented increase in requests to build cyber ranges. By cyber ranges, we mean facilities or online spaces that enable team training and exercises of cyberattack responses. Companies understand the need to drill their plans based on real-world conditions and using real tools, attacks and procedures. What’s driving this increased demand? The increase in remote and hybrid work models emerging from the COVID-19 pandemic has elevated the priority to collaborate and…

Why Quantum Computing Capabilities Are Creating Security Vulnerabilities Today

Quantum computing capabilities are already impacting your organization. While data encryption and operational disruption have long troubled Chief Information Security Officers (CISOs), the threat posed by emerging quantum computing capabilities is far more profound and immediate. Indeed, quantum computing poses an existential risk to the classical encryption protocols that enable virtually all digital transactions. Over the next several years, widespread data encryption mechanisms, such as public-key cryptography (PKC), could become vulnerable. Any classically encrypted communication could be wiretapped and is…

6 Roles That Can Easily Transition to a Cybersecurity Team

With the shortage of qualified tech professionals in the cybersecurity industry and increasing demand for trained experts, it can take time to find the right candidate with the necessary skill set. However, while searching for specific technical skill sets, many professionals in other industries may be an excellent fit for transitioning into a cybersecurity team. In fact, considering their unique, specialized skill sets, some roles are a better match than what is traditionally expected of a cybersecurity professional. This article…