Cyberattacks are on the rise as adversaries find new ways of creating chaos and increasing profits. Attacks evolve constantly and often involve real-world consequences. The growing criminal Software-as-a-Service enterprise puts ready-made tools in the hands of threat actors who can use them against the software supply chain and other critical systems. And then there’s the threat of nation-state attacks, with major incidents reported every month and no sign of them slowing.

Amidst these growing concerns, cybersecurity professionals continue to report staffing shortages worldwide. These shortfalls can have a negative impact on incident prevention and response alike. Short-staffed security teams must respond to cyber incidents whenever they happen, no matter the size of the team. Working with such limited resources increases strain and stress with each new incident, creating a vicious cycle of attrition.

Threat actors ignore business hours

Cyber criminals tend to launch attacks during off-peak hours in the hopes of scoring big while the staff is absent. As a result, incident responders often must work outside of regular business hours, sometimes during or just before major holidays. The first 72 hours of an incident are usually the most critical. It’s during this time when incident responders must find the primary attack vector, contain the intrusion and begin remediation.

Incident response does not stop until the situation is contained, which is hard on incident responders. Security professionals work long hours during an incident, oftentimes longer than 12 hours per day according to a recent study. 48% of responders report an average of two to four weeks of engagement, while 30% say incident engagement lasts even longer. It’s also common for responders to work on more than one incident at a time, further compounding the time and attention required.

Responsibility after the incident

After an incident, it’s not uncommon for security professionals to feel at fault. They may feel an intense duty to protect and prevent the inevitable. CISOs in particular may feel obligated to bear the burden of responsibility.

Privacy attorney Alexandra Vesalga highlights the additional strain CISOs must navigate after recent litigation in the aftermath of an unreported cyberattack.

“CISOs are under tremendous daily pressure,” Vesalga said. “The cyber threat landscape is changing constantly, and many organizations expect their security teams to be omniscient superheroes, anticipating and preventing any and all threats.”

Cyber incident response missteps may personally affect CISOs. Vesalga continues, “Within these high-pressure cultures, CISOs often feel personal responsibility for cyber incidents. Pouring gas on the fire, there is a new trend toward personal liability for cyber incidents —  just last month, Uber’s former CISO was found guilty on criminal charges for his actions in response to a 2016 breach. He awaits sentencing and could face jail time.”

Negative effects of prolonged high-stress situations

Incident responders feel a sense of duty to continue working well beyond their physical limits. In some cases that might include working through one (or several) nights without sleeping. That lack of sleep can negatively impact decision-making, problem-solving and impulse control, all of which are crucial during an incident response.

Total sleep deprivation — 24 or more hours without sleep — takes an even greater toll on mood, decision-making and attention. A recent study of elite martial arts athletes revealed an increase in depression, confusion, fatigue and anxiety after 24 hours of wakefulness. Study participants’ physical performance was significantly impaired in a sleep-deprived state compared with their normal sleep performance.

Unsurprisingly, many professionals feel intense negative effects after a cyber incident. The effects of high stress over a long period of time can lead to higher levels of anxiety in everyday life, a symptom more than two-thirds of responders reported in a recent study. Incident responders also report significant sleep disturbances and back pain as a result of an incident.

Remediating employee stress following a cyber incident

A recent study found trauma symptoms last for months after a cyber incident. Burnout is common and often leads to high turnover. Human resource management offices typically don’t have a specific protocol for cyber incident responders in place. Responders also reported a desire to change jobs or leave the cybersecurity profession altogether. Even without dedicated programs, incident responders seek mental health resources and report adequate access to these services.

Prevention is the best solution. Cybersecurity incident response is a serious role that can be difficult to step back from. BlackBerry’s Keiron Holyome urges organizations to craft their response expectations with a focus on ensuring teams know what to expect.

“If the past two years have proven anything, it’s that no organization in any industry is immune to cyber crime,” Holyome said. “Cybersecurity teams are critical to sustaining business continuity, they cannot afford to switch off and leave organizations at risk — especially because that risk isn’t limited to working days or business hours.”

Holyome goes on to discuss how long hours and stressful working conditions affect security teams. “Alert fatigue and the push to make important decisions with limited experience, knowledge or context can weigh heavily. When a cyberattack strikes, having a process to follow that reduces pressurized decision-making, and knowing that support is at the end of a phone call, can be a big step towards creating a healthier environment for those working in IT and security roles.”

Avoiding burnout with planning and practice

The threat landscape is constantly changing and will require new approaches. While teams stay vigilant for the next incident, they need the support of their companies throughout the entire process.

Companies can start by addressing incident responder burnout, and other symptoms of a high-stress work environment. Allowing incident responders time away to rest and heal from the heightened stress of cyber incidents will help keep teams healthy and prepared for the next attack.

In addition, a well-planned response is only effective when staff has the opportunity to run through exercises to understand who is responsible for what. Practicing tabletop exercises helps staff mentally prepare for incident response. Working from the familiar removes the stress of the unknown, so staff can focus on response and remediation. This time can be used to reiterate the importance of and process for taking breaks from the work.

Senior leaders can’t ignore the importance of taking care of incident responders. Better working conditions will lessen turnover rates and keep talented professionals in the chronically understaffed field.

More from CISO

Bringing threat intelligence and adversary insights to the forefront: X-Force Research Hub

3 min read - Today defenders are dealing with both a threat landscape that’s constantly changing and attacks that have stood the test of time. Innovation and best practices co-exist in the criminal world, and one mustn’t distract us from the other. IBM X-Force is continuously observing new attack vectors and novel malware in the wild, as adversaries seek to evade detection innovations. But we also know that tried and true tactics — from phishing and exploiting known vulnerabilities to using compromised credentials and…

What’s new in the 2023 Cost of a Data Breach report

3 min read - Data breach costs continue to grow, according to new research, reaching a record-high global average of $4.45 million, representing a 15% increase over three years. Costs in the healthcare industry continued to top the charts, as the most expensive industry for the 13th year in a row. Yet as breach costs continue to climb, the research points to new opportunities for containing breach costs. The research, conducted independently by Ponemon Institute and analyzed and published by IBM Security, constitutes the…

Cyber leaders: Stop being your own worst career enemy. Here’s how.

24 min read - Listen to this podcast on Apple Podcasts, Spotify or wherever you find your favorite audio content. We’ve been beating the cyber talent shortage drum for a while now, and with good reason. The vacancy numbers are staggering, with some in the industry reporting as many as 3.5 million unfilled positions as of April 2023 and projecting the disparity between supply and demand will remain until 2025. Perhaps one of the best (and arguably only) ways we can realistically bridge this gap is to…

Poor communication during a data breach can cost you — Here’s how to avoid it

5 min read - No one needs to tell you that data breaches are costly. That data has been quantified and the numbers are staggering. In fact, the IBM Security Cost of a Data Breach estimates that the average cost of a data breach in 2022 was $4.35 million, with 83% of organizations experiencing one or more security incidents. But what’s talked about less often (and we think should be talked about more) is how communication — both good and bad — factors into…