back to article Stress, bad workplace cultures are still driving security folk to drink

In a personal and powerful presentation, a computer security veteran has warned that too many infosec bods are fighting a losing battle with the bottle. Jamie Tomasello, senior manager of security operations at Duo Security, has 17 years of experience in the industry, and has been sober for the past six. While the causes of …

  1. IceC0ld

    Self-medicating with booze is no answer

    it may not be the answer, but sadly, for most, it is the only option they can see.

    and it does work, at first, and by then you are locked into the daily grind / unwind :o(

    1. Conspectus83

      Re: Self-medicating with booze is no answer

      Worked with a guy, who was actually my manager, and would drink incredible amounts. It turned out he had mild depression but did not stop drinking and popping Sweeties.

      Absolute nightmare to be managed by and created so much resentment in the office since he was constantly off e.g. he never worked a full week for the two years I was in that team. When he did turn up he was totally out of touch with the work and ended up being a tornado i.e. everything went everywhere and was all wrong.

      Eventually he got booted out and, thankfully, got himself sorted. He now runs a successful small business outside IT.

      It took the big shock for him to get out of his daily grind. I know this sounds terrible but I am glad he got the boot since he caused so much stress, myself included, to other people with his illness.

      Not an easy one to work out for anybody.

    2. Locky

      Re: Self-medicating with booze is no answer

      How about coffee?

      1. LucreLout

        Re: Self-medicating with booze is no answer

        How about coffee?

        I just got mug number 7, so I'm all set thanks!

        I'm not actually sure coffee is considered all that bad for you these days. Every time I look the medical advice seems to have changed anyway. Whereas, copious quantities of sweet sweet booze are well understood to be bad for your health.

  2. veti Silver badge

    Sounds about right

    "Infosec", if that's a dedicated job, has to be the most thankless job in any organisation. It's like being an auditor, and a quality management engineer, and a test manager, all in one.

    Everyone will blame you when it goes wrong, but the twist is that everyone will still blame you even if you do everything right. You'll be the one telling salespeople what cards and transactions they can't accept. You'll be the one telling Marketing that that "one little feature" can't be added to the next release. You'll be the one sending arse-covering emails to management saying that of course you quite understand they want to bypass your 4-week test cycle, but you'll need them to put that instruction in writing and to acknowledge your warning on the subject. Pretty soon you'll be excluded from product meetings because of your sheer aura of negativity.

    And that's if everything goes right. When it goes wrong, you'll be stood directly in front of the fan, if you know what I mean.

    Disclaimer: I've been a quality engineer and a test manager, and I've experienced a small fraction of the above. But an infosec manager? - must have it twenty times worse. They can keep it.

    1. LucreLout

      Re: Sounds about right

      "Infosec", if that's a dedicated job, has to be the most thankless job in any organisation.

      Toilet cleaner. You literally cover their to-do list with shit on a daily basis. And yet, if the CEO disappears for a month the business runs fine, whereas if the bog cleaner goes AWOL, you'll be lucky to get through a day or two.....

      1. veti Silver badge

        Re: Sounds about right

        Doesn't come close. Toilet cleaners may not be much appreciated, but at least they're not actively vilified and abused on an hourly basis.

  3. DeathSquid

    Curiously American

    "Vacation allowance". What a curiously North American term. I think what was meant was holiday entitlement. In most countries, for good reason, it is a right that is earned not a largesse at the whim of the employer.

    1. Rich 11 Silver badge

      Re: Curiously American

      A right that is deserved, not earned. Extra annual days are earned, through long service, usually, but everyone deserves the opportunity to get away from work for a while and relax or just do life stuff.

      1. big_D

        Re: Curiously American

        In most countries where I have worked, the minimum holiday entitlement has been legally defines, usually at least 4 weeks.

        1. ecofeco Silver badge

          Re: Curiously American

          You don't have to rub it in. :)

    2. ecofeco Silver badge

      Re: Curiously American

      American businesses still have many elements of the plantation model.

      1. Anonymous Coward
        Anonymous Coward

        Re: Curiously American

        In my $BIGYANKCORP, "vacation" seems to be a synonym for "working from home".

        I'm sure when I turn the company phone back on in a week or so's time and connect to email again, half my calls and emails will have been from people expecting an immediate answer, even though they all know I'm off.

        1. big_D

          Re: Curiously American @AC

          My current employer doesn't expect you to answer the phone or mail outside of work hours.

          An employee wanted to access his email from home, between shifts and was told, when he isn't at work, he is supposed to be resting and recouperating and therefore his request was denied.

          1. phuzz Silver badge

            Re: Curiously American @AC

            Ditto here. a new hire asked for help getting his work email on his private phone. I refused, partly on the grounds that his email might have sensitive information, but mainly because he's only paid to work 38.5 hours a week.

            1. Anonymous Coward
              Anonymous Coward

              Re: Curiously American @AC

              Here in Belgium you get holiday bonus pay. Technically if you don't use all your holidays you lose it pro-rata, so they dock your pay for not taking leave.

              There may of course be a nod and a wink in special circumstances.

              1. big_D

                Re: Curiously American @AC

                I did have a job, where I booked my holiday 3 times, had it cancelled by the company 3 times, due to project demands, then a memo mid November that all holiday had to be taken by the end of the year.

                I turned round to my boss and said, "see you in January."

                He didn't find that funny and a "solution" was found - 2 weeks holiday in December, 3 Fridays in November / December free, 2 weeks carried over, to be taken by March and the rest paid out.

                1. LucreLout

                  Re: Curiously American @AC

                  I did have a job, where I booked my holiday 3 times, had it cancelled by the company 3 times, due to project demands, then a memo mid November that all holiday had to be taken by the end of the year.

                  Had a similar thing happen 10 years ago. My answer was to stop working Mondays from September.

                  Amazingly, the following year, after again cancelling most of my summer leave, they found a way to magically roll it over. Then when I quit the third time they canned my summer vacations, they found a way to pay me for it, rather than have me resign and go on "holiday" at the end of the day......

              2. JoelLkins

                Re: Curiously American @AC

                > they dock your pay for not taking leave.

                That's not the American (Indentured Servant) Way!

                https://youtu.be/cv33SsGHYHo

        2. Electric Panda

          Re: Curiously American

          Exactly the same at my $BIGBLIGHTYPLC.

          People claim "I'm on annual leave, no access to e-mail, contact Tom Dick and Harry". In reality, they're just working from home on reduced and strange hours. CC them into an e-mail and if it's important enough they'll reply as quickly as if they were actually at work.

        3. Anonymous Coward
          Devil

          Re: Curiously American

          "people expecting an immediate answer"

          In the future, $BIGYANKCORP will simply access the information its employees require directly from your brain

    3. Dr Dan Holdsworth

      Re: Curiously American

      Where I work, a major UK university, if you do not take all your holiday entitlement you can expect a meeting without coffee with HR. Partly this is bureaucracy, and partly this is a mental health thing: work stresses people, and getting away from work de-stresses them.

      Hence, the edict from on high is that You Shall Take All Your Holiday Leave, or else.

      1. notausername

        Re: Curiously American

        Dr Dan Holdsworth - not sure which uni you work for, but I also work for a major UK uni, and I haven't taken my full entitlement in... 10 years? Maybe more. Usually I'll end up with anywhere from 5 to 15 days left, and the only thing I ever hear is warnings a out only being abke to carry over 5.

        I think your uni must give more shits about its staff, which probably isn't hard: all mine seems to care about is building new buildings we don't want, and that aren't fit for purpose.

  4. Unicornpiss
    Pint

    IT is not a healthy profession

    Surely there are some IT jobs that are rewarding and not continually stressful. But a lot of us suffer the stress of a thankless job daily and anything that takes the edge off life, even for a while, is pretty hard to resist. Also, when people are unappreciated, it's a lot easier for self-destructive behavior to take hold. If no one seems to care, it can sometimes be hard to care about yourself.

    Some of the things that bother us:

    -Constant stress/long hours/on call/not enough rest or peace.

    -All blame and little recognition or rewards/chance for advancement.

    -Unskilled/self-serving management that only have their jobs from failing upwards, yet couldn't walk a mile in the shoes of those they lead without tripping and falling on their face.

    -Companies starting more projects without coming close to finishing the ones currently running. (see above comment)

    IT is one of the foundations of any company in these times, yet management is nearly always trying to build their house without caring that the foundation is overburdened to the point of crumbling. Because many of us work behind the scenes to put out fires and fix problems that management never even realizes exist before they become catastrophes, our contributions are often not even known. And most of us have a love of technology, problem solving, and helping others, and not of office politics. So we don't play "the game" as well as perhaps we need to. And those of us that do seem to be the lesser-skilled and seem to end up as sycophantic "yes men" (and women) that no one likes, dividing everyone and destroying integrity and unity. Again, people fail up. A lot of us also worry about layoffs or worsening work environments when the poor decisions of people higher up the food chain come to their rotten fruition.

    I work for a large company, and in the last 3 years, 3 good people where I work have died literally on the job from strokes and other sudden illnesses, and a few more have had cancers or other conditions that while you can't specifically pin them on work, IMHO stress and the unhealthy behaviors resulting from it are contributing factors in their disease.

    Now I've depressed even myself and will finish my pint so I can try to get some sleep and do it all over again tomorrow.

    1. RobinCM

      Re: IT is not a healthy profession

      I worked in an increasingly toxic IT department for a long time, hoping it would get better. When it got worse, and after a few months off work with stress (which did help) I started looking for a new job. After about a year of looking - I didn't want to jump out of one terrible organisation and into another - I found the right job, still doing IT, but for a smaller and much nicer place, with an easier commute, better pay, and far more career prospects.

      If you're not enjoying it, leave! I should have left my old job ten years before I actually did. Don't try and change a toxic organisation, and definitely don't stay there and work yourself into an early grave supporting managers who don't deserve it.

      There's loads of IT and security jobs out there, just find the one that's right for you. Recruitment agencies can actually help with this. (If nothing else, getting the occasional phone call from them when they find your CV helps boost your self-belief and self-worth).

      Put your CV on a few of the big recruitment sites, and see what happens!

      1. macjules
        Flame

        Re: IT is not a healthy profession

        Worked for most of my life in government service, and pretty much obeyed the traditional Peter Principle of 'rising to the maximum level of your inefficiency'. I now work as head of technology for a totally soulless and immoral media company, with so much backbiting, internal politics and departmental infighting that it makes MadMen's Sterling Cooper look like the Employer of The Year. I have finally got to the stage of deciding that the remuneration does not equate out the destructiveness of working for a bad employer.

        Luckily my taste in alcohol is tempered by my choice of poison (Margaux) so self-medicating on that would be a very expensive option. Still, time to move on.

      2. Anonymous Coward
        Anonymous Coward

        Re: IT is not a healthy profession

        Unfortunately so many IT jobs are toxic.

        I did have a great one once, unfortunately it was hundreds of miles from home (so silly o clock journey Monday from home, stay in B&B near workplace all week, long journey home Friday evening).

        As family could not relocate from home for various reasons I had to refuse offer to become permie (was a contract originally) as though job & environment excellent, strain on family life was not viable for the long term

        Would love a non toxic job in a nearby location, but not holding my breath*

        * Not near London or any tech hubs so far less choice of IT jobs in "my area"

      3. ecofeco Silver badge

        Re: IT is not a healthy profession

        "Put your CV on a few of the big recruitment sites, and see what happens!"

        They are not as plentiful as you think. I've been out of work for 2 months now.

        Oh I get calls from the recruiters and they are all impressed with my CV, but still no takers.

    2. Vanir

      Re: IT is not a healthy profession

      One reason there is such a shortage of IT skills?

      I should really have written:

      One reason there is such a shortage of people with IT skills willing to work in IT?

      IT skills may be commodities, people are not.

    3. Doctor Syntax Silver badge

      Re: IT is not a healthy profession

      @Unicornpiss

      While I endorse what you say I have to point out that from my experience IT management is not unique in following that list.

    4. Christian Harten

      Re: IT is not a healthy profession

      Great comment. I would add that often times there is a lack of challenging problems or rather you can't really work on challenging things because all you do is firefighting. Stress without being challenged and without a sense of progression is really unhealthy.

  5. Anonymous Coward
    Anonymous Coward

    "Many offices have beer on tap, wine in the fridge, and hard liquor on the shelves as a perk for employees."

    Wut ? Who does that ? It's one thing to have a few pints with the colleagues after work at a suitable venue, but actually in the office seems a bit much. In my 20 years of IT experience I have only seen this once (a fully stocked on-site pub that could easily handle 60 or 70 people), but that one had very limited opening hours and did not allow people in who were on call.

    1. Pete 2 Silver badge

      > Wut ? Who does that ?

      The only places I have seen this was in large advertising firms based in the Tottenham Court Road area during the late80s-early 90's (and then, only after 6 p.m.)

      None of the american IT firms I have worked for would even allow booze on the premises.

    2. Fullbeem

      I work in brewery IT. Its a pita being surrounded by hectalitres of the stuff.

    3. Christian Harten

      I've seen it in a few startups and "young" companies in Germany. It usually has the effect that people stay at the office and often continue working instead of heading home or to the pub.

    4. LucreLout

      "Many offices have beer on tap, wine in the fridge, and hard liquor on the shelves as a perk for employees."

      Wut ? Who does that ? It's one thing to have a few pints with the colleagues after work at a suitable venue, but actually in the office seems a bit much.

      Soooo many rent-a-desk places have free beer these days, which means many many start-ups, particularly in and around London, have free beer, at least in the afternoon.

      1. Anonymous Coward
        Anonymous Coward

        which means many many start-ups, particularly in and around London, have free beer, at least in the afternoon.

        And which also serves to explain the lack of substantive outputs from London's startups, and the evaporation of VC investments.

  6. SVV
    Pint

    Meanwhile in the other story on this conference

    Google are telling us that partying helps us.

    Make your minds up, otherwise we'll have to err on the side of choosing the ....

  7. Anonymous Coward
    Anonymous Coward

    I work in security and I am now drawing up serious plans to get out and do something else. A sabbatical adult gap year is a very real possibility at this point.

    Nothing about security, the work or the industry grabs me anymore and it's time for serious change. I am burned out and underperforming which brings its own host of problems.

    Don't want to say too much more than that for now, for hopefully obvious reasons.

  8. Potemkine! Silver badge

    No job deserves self destruction

    Addiction is most of the time a way found by someone to endure his/her condition. It's like an self-medication used to relieve the pain, something you take to be able to wake up each morning and face the World.

    Trying to eradicate product consumption only is like trying to get rid of the symptoms while not curing the disease.

    Addiction is the result of a mental condition: treating this mental disorder is perhaps the only way to get rid of it definitively. This article shows it well.

    I strongly believe anyone suffering from an addiction should talk with a counselor and starts a psychotherapy, to understand why he/she needs to take something to be able to live. It will be the first step for a real cure.

    1. ecofeco Silver badge

      Re: No job deserves self destruction

      Most jobs suck and most people have no real choices.

  9. Pete 2 Silver badge

    And then, what?

    > Stress, bad workplace cultures are still driving security folk to drink

    But who drives them home again, afterwards

  10. Joe Drunk
    Pint

    Not just IT

    I've colleagues in the medical and legal fields and they too complain about the constant stress, long unpredictable hours and need to self-medicate.

    I started in IT as a PFY fresh out of uni, almost 20 years later now am a greybeard. My observation is that the stress level increases with the size of the organization. I worked in a few small to medium 5000+ employee companies earlier in life and although there was stress it was manageable as were the workloads/expectations. Pub gatherings were mostly restricted to Friday evenings unless a birthday or other special event occurred. I would say the key factors were regular work hours with rare nights/weekends and absolutely NO on-call. The downside? Salary was on the low end of the scale.

    I've surfed more Fortune 50 companies than I can count on both hands for more than a decade. They've all had the extreme stress levels requiring frequent self-medication due to employing the Culture of Fear ™ management methodology. I too have seen colleagues succumb to heart attacks, strokes, kidney/gall stones etc. It could have happened to me too but I learned to adapt and yes, play the game. You can all criticize me for my lack of work ethic but this is what corporate culture cultivates. You will be discarded as a withered, empty husk of a human being and subsequently replaced if you don't adapt.

    In the end it is just a job, not worth dying over.

    1. ecofeco Silver badge

      Re: Not just IT

      Well said. NO job is worth dying over. Nor to make some other asshole rich.

  11. one crazy media

    I work in the InfoSec area also and had lots of stress few years ago. I cam to the conclusion that, there is nothing I can do if the CISO and the 'C' suite gang overrides all of the security controls in place. I tell them, reply to my email with approval.

    I pass the risk to them and now I sleep like baby. Folks, it is not worth your health and well being.

    An enterprise without an annual 3rd party audit is useless. The audit committee of the board directors must insist on 3rd party audits and control the audit by having the 3rd party audit firm report directly to them. No I do not work for a 3rd party audit firm. I learned from a CISO, who did annual black hat test on his InfoSec program. He use to ask as, how do I know we are `best we can be?

  12. andy 103

    Swings and roundabouts

    I've worked as a developer in 2 companies prior to where I was now. The first had a "health culture" where drinking in moderation was seen as ok, and drinking in excess was bad. It was a very badly organised place and the end result was that everyone went out and got hammered on a Friday and most drank during the week to keep their spirits up (no pun intended!).

    The second place was very relaxed - the sort of place where they told you you must leave at exactly 5pm because they wanted you fresh and stress free the next day. Everyone here drank loads as well. This was because they had more free time, particularly at the end of the day, and the relaxed atmosphere prompted social activities which at that place happened to centre around drinking.

    We also had a client - at the first place - who was in charge of an alcohol addiction project. He was also a heavy drinker, due to the stress of what he was expected to deliver. I remember going out one Friday and we saw him red faced and wasted and thought we were living in some kind of parallel universe. If the people who are working on schemes to help people come off alcohol are themselves pissheads, you know you're screwed.

    In the UK, at least, there is a very strong drinking culture - much as we hate to admit it. People join workplaces and end up drinking to "fit in" even if they are not regular drinkers. Seen it happen at various places. I'm yet to work somewhere where the majority of people don't go over the sensible amount of units per week, or aren't drinking due to stresses of life and work. I'm not saying it's right, but that's how it goes.

    1. Christian Harten

      Re: Swings and roundabouts

      Maybe you misunderstood the meaning of "alcohol addiction project" ;)

  13. JohnFen

    Whaa?

    "Many offices have beer on tap, wine in the fridge, and hard liquor on the shelves as a perk for employees"

    Holy shit, they do? I've seen a whole lot of ridiculous and counterproductive "perks" in the workplace over the decades, but I've never seen that one. I've clearly been working at the wrong places.

    1. Jay Lenovo
      Trollface

      Re: Whaa?

      Alcohol doesn't take up much space. Where as a designated Wellness/Nap/Crying Room takes up valuable office real estate.

      Work hard, party hard, or so it goes.

      What?...you only get a candy bowl.

      Time to raise your game and suffer appropriately.

      1. JohnFen

        Re: Whaa?

        "Work hard, party hard, or so it goes."

        Yes, but not at the same time.

  14. Bibbit

    Really?

    "Many offices have beer on tap, wine in the fridge, and hard liquor on the shelves as a perk for employees"

    Where do I sign?

    Seriously though, is this just an IT tech-bro thing? Sounds ridiculous in this day and age, for productivity and employee welfare reasons.

    I work in a hospital and all we have is industrial jerry-cans of ethanol. Sweet, sweet ethanol.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like