Mental Health & Neurodiversity – Lisa Ventura, Cyber Security Unity

[00:00:01] Lisa Ventura: Another bit of advice I can give to be honest, is that sometimes even if you raise it and things aren't followed through properly or it is brushed under the carpet, you do feel that you have no choice but to find something else leave.

And it's far better to leave a toxic environment than it is stay in it and have it affect your mental health, drastically. Like it did with me.

[00:00:21] Cyril Noel-Tagoe: Hello everyone and welcome to Cybersecurity Sessions, our regular podcast exploring all things cybersecurity. I'm your host, Cyril Noel-Tagoe, principle security researcher at Netacea, the world's first fully agentless bot management product. Today we're going to be investigating mental health, bullying and neurodiversity in cybersecurity.

Stress and burnout are real challenges for this industry. We've increased our workloads, long hours in front of screens, a constant barrage of alerts and an expectation to be always available. In fact, research from Deep Instincts found that 45% of cybersecurity professionals have considered quitting the industry due to stress.

So how can we try and tackle this problem? Well, I'm pleased to be joined on today's episode by Security Awareness Consultant and mental health coach Lisa Ventura. Welcome to the show, Lisa. Thank you so much for joining us.

[00:01:11] Lisa Ventura: Thank you, Cyril. It's great to be here.

[00:01:13] Cyril Noel-Tagoe: Would you like to introduce yourself to our listeners please?

[00:01:16] Lisa Ventura: Sure. So my name is Lisa Ventura. I'm the founder of Cybersecurity Unity, and we're a global organization that aims to unite the cybersecurity industry, to combat the growing cyber threat. But amongst various projects that we undertake, we do a lot of work within mental health, support services, and Awareness raising of the problem of stress and workplace, bullying as well.

[00:01:41] Cyril Noel-Tagoe: I'll be interested to hear how you came about into the kind of the mental health role in particular.

[00:01:47] Lisa Ventura: So I'd always had a strong interest in a lot of different areas of mental health and so on. Over the years, I've had my own struggles with it. I was diagnosed with complex PTSD, depression and anxiety, and that was from enduring a lot of bullying from within my lifetime, not just within the cyber security industry.

Because it was an area that I was so passionate about, I really wanted to help others that I could see were struggling with their mental health in the cybersecurity industry. CISOs in particular have a challenge because they need to be of online 24/7 if there is a cybersecurity attack or a data breach, everything is always usually aimed at them and they're under significant pressure to deliver 24/7 be on hand to stop attacks and if one does happen, have it all thrown at them as well.

So that was why I decided to go down that route. And look at becoming a mental health coach and I'm also a fully qualified mental health First Aid as well.

[00:02:54] Cyril Noel-Tagoe: Great. And I hear that you're a mindset coach as well. How does that differ from a mental health coach?

[00:03:00] Lisa Ventura: Well, that's around trying to support individuals within cyber, with their mindset when things might be going a bit, you know, tough or they might have had a data breach or they might be under significant pressure. So that's, you know, all about keeping your mental health in check, but also providing that, motivation that, you know, support, the fact that, you know, somebody's there just to be able to lend a hand or to listen and to keep cyber professionals focused on their goals and what they want to achieve.

[00:03:29] Cyril Noel-Tagoe: And I mean the cybersecurity industry, right? You said it yourself and kind of the, the stress that CISOs are under. Do you think, compared to other industries, stress is a major problem for cybersecurity? Or do you think it's across the board?

[00:03:41] Lisa Ventura: I think it's across the board and of course it isn't just CISOs, cyber professionals across the board can be affected by it. Cyber in particular does have a stress and burnout problem and as a result, it also has a retention problem with many leaving the industry because of the immense stress and pressure that they're under in their roles.

And it's definitely something that needs to have a lot more awareness raised about it.

[00:04:07] Cyril Noel-Tagoe: And I guess that becomes a vicious cycle, right? Cause you've got this, the skills gap, right? But then you've also got people leaving the industry due to stress, which means that people are still there, have higher workloads, and then the stress goes up. So, as individuals, how can we look out for ourselves and our colleagues from a mental health perspective?

[00:04:25] Lisa Ventura: For me, the biggest thing is check in with your colleagues and people that you work with. Just ask if they're okay. You know, if there's anything that they need support with or just need a listening ear for, you know, things that they might be going through, et cetera.

The old addage of it's good to talk, really does ring true, and for employers as well. Having those, wellbeing programs, access to talking services, counseling, support services, et cetera can be so important to supporting, not just cybersecurity professionals, but all employees within the workplace.

[00:05:02] Cyril Noel-Tagoe: And have you got any advice for... so when you say like, talk to people, so. If you ask someone, is it okay? Most British people will reply, yeah, I'm fine. How do you get past that barrier?

[00:05:13] Lisa Ventura: I usually ask questions are a little bit more open ended and, just sort of try and inquire, you know, how's the workload going or maybe not even a question, but try to just, come up with some statements and then hopefully some of those statements might ring a bit true.

Ah, yes, that's what I'm going through. And that might just open up that dialogue, just that little bit more efficiently.

[00:05:33] Cyril Noel-Tagoe: Right, Right. Yeah. That's really, really good way of thinking about it. Just kind of making a relatable thing that they'll kind then contribute to. If we look at recent times of the first few years we've had obviously the pandemic, which has caused stresses of its own in terms of stuff like furlough and stuff like that, but another big driving cause from that has been the shift to remote work. Would you say that this has impacted how we're thinking about mental health in the workplace?

[00:05:57] Lisa Ventura: I believe it has, and I've seen a lot of people feeling a lot more isolated because of the move to work from home. I'm also a big advocate of finding the right way that works for the individuals. So, some individuals absolutely thrive on being in the office five days a week.

Some need to be remote based full-time. Others might prefer that hybrid mix, if you like, of being in the office, say a couple of days, and the rest from home. So for me, it's all about empowering individuals to make those choices and that they can be supported by their employers, to make those choices for what works for them.

And absolutely there has been a greater impact, when we had to be at home 24 7, and not in the office because of the pandemic. That was a very difficult situation. A lot of people struggle to adjust to that. And I also found as well with the move to platforms such as Teams, Zoom, online instant messaging channels as well, that bullying and abuse kind of increased on those channels. And it's almost like, people feel that they have a license to be able to just, you know, sort of say what they want because they're at the end of a keyboard and that there's no sort of ramifications around that.

And I found that that was a particular problem or that things could be, yeah, misconstrued on an online instant messaging program as opposed to being with somebody face to face or on the phone. So, certainly yes, a big challenge,when the pandemic hit.

[00:07:31] Cyril Noel-Tagoe: That's really interesting around the bullying aspect. Because in my previous role, one of the things I used to do is go into schools and talk about online safety and you'll talk about cyber bullying there, but you don't really think of it so much in the kind of professional sphere, or at least people in general don't think of it so much there.

So would you say cyber bullying is a big issue these days, especially post pandemic?

[00:07:54] Lisa Ventura: Absolutely. I think it's certainly a problem. I've seen a huge amount, particularly on social media as well. A lot of I call Twitter pile-ons. Things getting out of control. Everybody's sort of jumping in, et cetera. And it can be really soul destroying, especially when it's done in a very sort of public way, like that.

And it's a huge problem and it's one that I campaign really, really heavily on. And there are great organizations out there as well that they're doing a lot of work in this area. So of course we have Respect and Security, which encourages organizations to take a pledge and follow a code of conduct against bullying and abuse in their organizations.

But a lot, lot more needs to be done and Respect and Security just do some amazing work and I'd love to see that amplified so much more and more organizations get on board with it.

[00:08:48] Cyril Noel-Tagoe: you mentioned messages on platforms such teams, and kind of one is that yes, they might be being misconstrued because you haven't got that context. But sometimes they are actually malicious. How as an organization can you deal with something like that where it might not intentionally be malicious, but in other cases it might be?

[00:09:09] Lisa Ventura: I think that there's a lot that organizations can do. If somebody does report an incident, you know, like that. Obviously investigate, talk to individuals concerned, and have some really strong policies in place against workplace bullying and abuse. If you do receive a complaint of this, try not to brush it under the carpet, but try to act on it and and get some proper safeguards and things in place so that everybody feels safe in the workplace with what they do.

[00:09:41] Cyril Noel-Tagoe: And are there any other ways that bullying manifests itself in the workplace that we haven't covered?

[00:09:48] Lisa Ventura: I can give you an example of something that happened to me a few years ago, in fact, and it was , I've been working remotely for some time, so this was before the pandemic hit. And I was on a weekly Teams call with a few others and and so on. And it happened to be a Monday morning and everybody was saying about, you know.

How was your weekend? How's your weekend? Well, I just had a particularly bad weekend for family reasons. And so I wasn't really feeling that whole, Hey, how was your weekend vibe that was going on. So I actually stated that, you know, I didn't have a great weekend, to be honest, because I had to deal with an incident with my auntie who has dementia, but hey, it's the, you know, it's a new week and you know, a new start and so on.

And then I got a phone call, not long after that from my line manager saying I should never have mentioned the fact that my auntie has dementia because it might have been quite triggering for somebody else that has that. And it was the way she said it and came across that as well. I was so shocked.

I was just like, okay. Few hours later, we had another call, a few individuals of the team came in and my line manager was a good 10 minutes or so late. When she finally turned up to the call, she was, Oh, I'm so sorry I'm late for the call, but I've just had the best news. My so who's 16 has just got his first job and I'm a really proud mother and so on.

What she didn't realize, because I'd never disclosed it, is that I'd lost my only son to stillbirth years before that. So that could have been potentially, everything can be triggering for somebody, and I was just, I had to turn my camera off because I was just, I can't, I just can't even process this that I've just been pulled up for that in the morning, and then I have that in the afternoon and I resigned the same day. And I didn't look back because even raising it, I just didn't think there was anything to come back from, from that. And there were other incidents as well. I'd been, you know, pulled up for posting too much in the team's chat because I was apparently distracting everybody from their work, yet others that were posting a lot more than me had not been asked to refrain from posting so much. So I was a definite target and I just wasn't having it. And that's the, another bit of advice I can give to be honest, is that sometimes even if you raise it and things aren't followed through properly or the individuals concerned aren't fully dealt with, or it is brushed under the carpet, you do feel that you have no choice but to find something else and leave.

And it's far better to leave a toxic environment than it is to stay in it and have it affect your mental health drastically like like it did with me.

[00:12:49] Cyril Noel-Tagoe: Right. You're working to live, right? You're not kind of living to work. So if environment's not right for you, then move to and when that is. Yeah. I'm very sorry to hear all that. If we just stick on kind of bullying for just a moment and kind of the impact that has on stress and burnout, right?

Because you've got this already very stressful environment, cybersecurity, and then you've got this bullying as well. Do you think in cybersecurity especially there's kind of more of a bullying problem than other industries, or is it just this the same bullying problem and this is just exacerbating the already high stress problem we have in security?

[00:13:27] Lisa Ventura: I can't really speak for a lot of other industries, but I do see that it's absolutely prevalent in cybersecurity, both on social media and in the workplace and so on. And it really, really is, just absolutely soul destroying, and I've been at a few different organizations where I've had this happen to me.

I've also seen the awful abuse and Twitter pile-ons as, as they're known, which I've not been subjected to myself online. But I've seen other people that have, and I've always tried to, you know, reach out to those individuals to make sure there's okay, a lot of people will leave social media and so on as a result.

And that's another thing that I find is having those social media breaks as well can really, sort of help. And while I would urge anyone to say is if you are hovering on that keyboard, say something, just stop for just 30 seconds or so and just think, how would I feel if what I'm about to say I received.

Just really just, just stop for that moment and just try to put yourself in the shoes of the other person that you are about to send that message to because again, sometimes might be coming from a place you might be having a bad day or you might have had a particularly bad, you know, experience or something and that spilled out into what you are trying to post.

Just stop for a minute and have a think because, we all do need to be kind to each other.

[00:14:53] Cyril Noel-Tagoe: Yeah, definitely. And I think social media people find this voice that they almost see there's this, there's no one on the other side of the screen and any thought that comes into their head that they're just kind of spitting that out. But there's not really a consideration of others.

I know in our work a lot of the time when we're looking at some of these forums where we're tracking threat actors and especially when they are talking about other security researchers, they can be very, intense and kind of how they talk about us, but at least for me personally, I know that's limited to that and I can avoid that.

But with other people it's kind of constant wherever you go online and it's almost following you around. So,

[00:15:29] Lisa Ventura: Absolutely.

[00:15:47] Cyril Noel-Tagoe: Let's talk about one of the more positive sides of social media. So, I guess with mental health and awareness is, rising on social media, right? You kind of see more posts ,a lot of companies post out, a lot of people more willing to share their stories and educate the rest of the world. How would you find kind of the positive side of social media?

[00:16:07] Lisa Ventura: Cyril, I have to say that, for me, that in the last two years, particularly since the pandemic, it's been an absolute lifeline. I've actually developed a lot of really good, positive, friendships from social media, people that I've not met in person yet. but I've been speaking to, you know, for quite some time.

And that side of it for me is really, really positive. And just knowing that there's always somebody to be able to reach out, to talk to if I need it, is also being a godsend as well. So, you know, social media isn't all bad. I've built up a real community. I have some amazing friends. And it's been that lifeline, you know, for me, particularly over the last couple of years or so. So it really isn't all bad.

[00:16:57] Cyril Noel-Tagoe: And what about its power to obviously talk about stuff like mental health and just the power of people to kind of share their story and draw other people in. Are there any Particularly good groups that you found or forums where people sharing this stuff can help people who are going through?

[00:17:13] Lisa Ventura: Absolutely. So I'm a member of Its Time to Thrive, which is where I did my mental health First Aid training with. And I've known a lot of the organizers and so on and the people involved in that. And there were also some really nice groups, communities, on Twitter and Twitter spaces as well that I get involved in.

And also actually on LinkedIn there were a couple of really good mental health support groups as well. So there are resources and groups and so on out there for you to be able to join and link up with and speak with other people and just share those experiences so you know that you are not alone and that other people are going through it too.

And that was really powerful for me especially with my complex PTSD diagnosis, that I had, talking to others that have also gone through it as well or experienced it, could be really helpful.

[00:18:08] Cyril Noel-Tagoe: Yeah. Yeah. And one of the things that I'm at least seeing a lot more about on social media is around neurodiversity as well. I like, in the last few years, there's been an increased focus on that, which is really great. But, for those who aren't sure of what neurodiversity actually means, could you kind of explain that please?

[00:18:28] Lisa Ventura: Yeah. So, neurodiversity is conditional things that are just sort of different from what is considered neurotypical. So, for example, that's things like autism or ADHD, dyslexia, dyspraxia, CD disorder, any of those things. And I myself was diagnosed as autistic in 2018. So I have a lot of experience, with the condition and trying to manage it and so on.

The phrase that I use a lot is that I'm different. I'm not difficult. Whereas a lot of people that are autistic may be perceived as being a bit difficult because we might need, you know, workplace adjustments or changes or things like that. No, I'm, I'm different. I'm not difficult. And some of those changes will enable me to work and empower me to deliver my best work and be as productive as possible.

[00:19:20] Cyril Noel-Tagoe: And in particular with regards to the cybersecurity industry. Do you feel that more neurodiverse people are being drawn to the industry? Or do you think they could be more done to draw neurodiverse people to the industry?

[00:19:33] Lisa Ventura: I think there could be a lot more done because studies have shown that those are the neurodiverse are very suited to careers within the cybersecurity industry. Particularly those that have that laser beam focus on things like coding and pen testing and so on. That can be a really, really good career choice for those that are neuro diverse.

And I think that a lot more needs to be done to raise awareness of this. There is some great work being done at the moment for example, where I live, there is a community, Neurodiverse S O C company that actually trains individuals who are neurodiverse into careers in cyber.

And again, I think a lot more awareness is being raised of this and that can only be a really good thing for the industry to help fill the cyber skills gap as well.

[00:20:23] Cyril Noel-Tagoe: Yeah, and I think, so again, in my previous role, I was doing some, I was speaking with some people from the police and kind of they've got their four pillars for dealing with cyber crime. And one of them is actually trying to prevent people from actually going into cyber crime and try and repurpose those skills. And they found with especially the younger offenders, a lot of them may be neurodiverse and they weren't finding stimulation what they were doing, and they were moving towards cyber crime because that was the avenue that was available for them. But instead, kind of having a program to draw them into the industry reduces the amount of people doing the crime and helps the defenders.

So are there any programs you know about, at that young level?

[00:21:04] Lisa Ventura: Not that I've come across personally at the moment, but I know there's a lot of good work going on out there. And IASME, close to where I live at the moment, they do a lot of work to support individuals in neurodiverse into careers in cyber. So they're a good organization to link up with.

Again, it's Time to Thrive where I did my Mental Health First Aid training with, they do a lot of programs for those that are neurodiverse. So there are some great things that are out there.

[00:21:34] Cyril Noel-Tagoe: For yourself, what were the kind of the challenges that you faced in kind of building your own career as someone who's neurodiverse?

[00:21:41] Lisa Ventura: I would say the biggest thing for me, through my diagnosis, I learned that I did not thrive or cope well in an office environment. So I was brought up that you go to school, you go to college, you go to uni, whatever it is you do. When you finish that, you then go out to work and that's just what you do five days a week, you get up, you go to that.

And that's the way that life is. And so that's how I started off. I was in the office for many years, but I really, really struggled with it. And by the time I would get to Friday, I would be absolutely exhausted to the point that the weekends would just be taken up with not enjoying myself or catching up with friends.

It would be completely exhausted and I need to just sleep or rest. It was literally like that. And I really, really struggled with that. And then by the time I'd got my energy levels back up, it's Monday and I'm back into that environment again. When I was diagnosed and I made the move to work from home, which was before the pandemic, that's when I realized just how detrimental an office environment was for me, and that was very much because of the sensory overload aspect. So the noise, the lights, the general chatter being interrupted. If I was in the middle of something, even if I tried to put headphones on, even noise canceling didn't do a lot to drown out some of the sounds or the lights or things like that, which I really struggled with.

Once I started to work from home, my productivity just went so much more, through the roof. And that's when my, funnily enough, that's when my career really did start to take off. And I could still have that downtime, but then still have that time at the weekends to do things that I really enjoyed rather than having to recover for the previous week.

And then we start all over again, two days later.

[00:23:30] Cyril Noel-Tagoe: And then that recovery as well then helps you not build up stress, again, helps with the burnout. Yeah. So kind, we've talked about the importance of getting more neurodiverse people into cybersecurity, but from a cybersecurity team's point of view , are there any key changes that they could be making to help attract and support new device employees that, obviously not trying to generalize cause everyone's situation will be different.

Right.

But.

[00:23:55] Lisa Ventura: Yeah. I think the biggest one for me is, like I said earlier, giving them that empowerment to do their best work, whether that's from home, whether that's in a hybrid environment, or whether that's in the office. So as you said, every person that's neurodiverse will be different in what their needs are.

And having that empowerment that they've insisting on. You have to be in the office this many days or so. I appreciate there might be some, you know, jobs or instances where that's not possible. But really empowering people to be able to do their best work in whatever way works for them, would be number one for me.

And if neurodiverse people do have to go into an office, perhaps look at providing some quiet environments or a safe space or a quiet space or somewhere that they can, you know, go to decompress for a little while if they need to, if they're needed on a lot of Teams calls or Zoom calls, for example, empowering them to be able to have some regular breaks in between those calls. For me, that's one of the challenges of... Or rather with the pandemic, when all the calls suddenly converted into being online, I suddenly found myself on, you know, online call after call, after call with no break in between.

And that's when that exhaustion started to creep in again. But I was able to recognize it and then start putting in some breaks and really making sure that, okay, I know I've got a couple of online calls in the morning, then I need just a short half an hour break to get away, get some fresh air, just, you know, rebuild, come back and do some more.

So, putting those regular breaks in can be really important as well.

[00:25:29] Cyril Noel-Tagoe: Yeah, and anything around the recruitment process, because actually getting the job might be difficult as well, right? Are there any accommodations there that works particularly well for you or might work for others?

[00:25:41] Lisa Ventura: Yeah, certainly by reviewing things like your job descriptions and job ads and using a lot of different inclusive language, et cetera, can be really beneficial. and also again, empowering the interviewees to be able to undertake an interview, structure that works for them.

Some people might be really, really stressed out at the thought of having to do some tests or things in the timed environment. I, for example, always, struggled with exams because that thing of having two hours of getting answers down in that space of time was something that I really, really struggle with.

I did them, I passed them, but it was not an easy process or easy thing for me to do. So again, just reviewing the interview process, maybe not as well, having so many interviews, and so on as well, and making the stages a bit better. So there's not to multiple hoops or calls or interviews to have to go through.

[00:26:39] Cyril Noel-Tagoe: Yeah. Yeah. That's all really good advice to organizations and I think just having that kind of view, just look at each stage of the process from actual advert through that interview process. And then actually once even the onboarding. Right. How do you make them feel part of the team and then, great.

Well, I think we we're just about there on time. So thank you so much, Lisa, for joining us. some really great advice. Covered some really important, sometimes difficult to talk about topics. I really appreciate your candor and I know you shared some quite personal stuff as well.

So, I really appreciate you sharing that with our listeners. Is there anything you, kind of, things you're doing that you wanna share with our listeners before we let you go?

[00:27:24] Lisa Ventura: Cyber Security Unity is going to be doing a lot of work in this area and a lot of different projects around stress and burnout in the workplace, and also to encourage more neurodiverse people into cybersecurity. So have a lookout on our website. It's www.csu.org.uk. And if you'd like to, get in touch with me, my email is lisa@csu.org.uk and I'm on Twitter and LinkedIn.

So please feel free to get in touch.

[00:27:53] Cyril Noel-Tagoe: Great. Thank you again, Lisa, and thank you to all our listeners for tuning into this episode of Cybersecurity Sessions. If you enjoyed this podcast, please be sure to subscribe and like, or leave a review on your podcast platform of choice. We'd love to get your feedback. You can also get in touch with us via our Twitter that's at cybersec pod or by email to podcast Netacea.com.

Thanks again for listening and see you again next month.