Christa: Welcome back to the Forensic Focus Podcast. I’m Christa Miller and we’re back this week with co-hosts Simon Biles and Alex Desmond.
Simon: Hey, guys.
Alex: Hey.
Christa: Good to see you again. So I think we’re going to talk this week a little bit about the “great resignation.” Career issues have been a topic of interest on the podcast and I think this is one of those areas that it’s got some nuance because I feel like digital forensics and incident response really accelerated during the pandemic. The conditions might not be the same for DFIR professionals as they were for other people that ended up resigning after being called back to work, but at the same time, I think burnout may have been a part of the decision. It’s certainly been an issue before the pandemic, still an issue now. So I think that’s where we’re going this week.
Alex: Yeah, I think we were having a quick chat before we started recording that we were talking about the definition of the Great Resignation and there were some really interesting points coming from the different countries that we all come from.
So like the US, the UK and Australia, but again, our profession in DFIR, I think the Great Resignation was driven from a different perspective than probably the main drivers of what I feel people who had to go in and do a job. So if they worked in a cafe or in a government job, or they were teachers, I think they had different concerns and different pressures than we felt in our industry.
And in our industry, I think it was probably mainly burnout because there was just an increase in work and you could work seven til midnight and go to bed and then work seven til midnight, seven days a week. So yeah.
Christa: How much of that, I’m just curious, I mean, you work in the industry is, how much of that was an acceleration in actual incidents versus how much was short-staffing? Was there kind of both things going on or was it more one than the other?
Alex: I think purely from my perspective, working in the industry within the APAC region, it was the acceleration of incidents. So ransomware kind of skyrocketed right around the start of the pandemic. And you saw a lot of campaigns targeting people with phishing emails relating to COVID. So it was contextual in that time, but I know for our company at least, that I worked at, we hired like crazy.
So it definitely wasn’t a short staff thing, it was just the work outstripped, which I think was evident anyway, because in Australia, at least, the government has put out their white paper and said, “We’ve got a shortage in cyber and we are committing this much money to fill those job vacancies that we have.” which I think, it might be similar for you guys across your countries with skilled workforce in cyber at kind of a senior level and above. Would you guys kind of say the same thing? Yes? No?
Simon: Yeah, I mean, there’s definitely a skills shortage in the UK. I mean, that’s fairly well known. I mean, I think it is a global phenomenon. And actually, what I’m seeing is certainly in the cyber security space rather than necessarily digital forensics, but overall there are lots of courses out there offering to, you know, train you up as a cyber expert, telling you how much you can earn as a cyber expert and all of this stuff.
But I think it’s overselling for a start because obviously they’re very junior people coming into very junior roles. What I think they’re missing is the background. I don’t think that people have the experience levels of work, of cyber, for IT in general.
I mean, I’m a little bit biased in this opinion. And, you know, I came from a Unix sysadmin background and therefore I feel that a fundamental understanding of the way computers work is kind of a prerequisite to going and doing a risk assessment. And these people are being taught to do risk assessments without being taught how a computer works.
And I think there’s a discrepancy there. There seem to be a lot of people who are nominally trained coming into the industry, but I probably wouldn’t hire any of them. And I think that’s a bit of a discrepancy because the numbers look like a positive trend, you know, increasing to fill the gap, but actually the reality is that you’re not getting experienced professionals in, you’re not getting people in at the levels you need them.
And I don’t think there are the mentors available to bring that many people up to the levels. I mean, everybody’s got to start somewhere. I don’t want to lock the gates and keep it only to people who are, but I think because cyber is quite un-understood in the industry and in general, I think that there are quite a lot of people who are claiming to be experts when they’re not really. And I think that’s going to have a knock on effect in the long run with things not being as well done as they should be.
Alex: I think training courses and probably that workforce flow is a whole other topic on its own, cause like, I love getting into certifications and which bodies are doing what they claim and everything. But what about you, Christa? What did you see in the US with I guess the start of the pandemic?
Christa: I think it was really the same. I mean, you were talking about the rise in ransomware and now that you mention it, I mean, it’s been two years I think since that was as much of an issue, but yeah, that definitely was part of the new cycle here, as well.
You know, it’s really hard to say because I think there’s so much of digital forensics and incident response that can be done remotely. I think the bigger challenge was for law enforcement professionals that were, you know, suddenly working from home on evidence that, you know, not in a controlled environment. But I don’t know how the remote work pressures really affected the industry here. It’s really not something that came up in any of my conversations, which is kind of striking to me.
So I don’t know if that means that it’s been more or less status quo here that, you know, the same issues that people were dealing with throughout the pandemic were exactly the same as the ones that they were dealing with beforehand. But that is certainly something I’d love to hear more from our listeners about that, honestly, you know, drop a comment on the video, I guess, or, you know, in our post on forensicfocus.com.
Simon: I mean, we’ve had…
Alex: So… sorry, Si, you go.
Simon: Yeah, I’m going to say what we’ve certainly on the law enforcement side, and, you know, this has come to head in something we were talking about sort of slightly earlier with the fact that, you know, our barristers have gone on strike in the UK. The fact that we have a huge backlog of cases that aren’t going through the courts because the courts weren’t working properly and, you know, so there’s lots and lots of pressure on that side.
Along with, I mean, one of the reasons they’re on strike is because their pay is derisory in terms of legal aid, which is what we have in this country for you can’t pay for yourself, you get legal aid and legal aid fees are not good. I say this because I get legal aid fees and I know they’re not good.
So we do this for reasons other than that financial recompense, but essentially they’re talking about the fact that it is possible that a junior barrister in a year is making £12,000 pounds, which is below the minimum wage in this country. That’s probably about $17,000 American dollars. I don’t what Australian dollars are doing at the moment.
But, you know, for somebody who’s been through, you know, several years of law school plus, you know, sitting the bar in this country to become a barrister plus all of this, it’s not a living wage and it’s ridiculous.
But that backlog has meant that actually you know, there are a huge number of cases that have evidence that is yet to be properly examined and at some point there will be a ramping up, which will increase the pressure. But at the moment, you know, for those of us that were self-employed, we had a very quiet period.
You know, if you’re not getting cases handed in to be processed and you’re not getting them through, you’re not getting the money out of it, cause the money doesn’t come until it’s all said and done. So it was starting to become a bit uncomfortable.
And it wouldn’t surprise me if people had just jumped ship for something that had a better financial stability, if not a total career change in regard of, you know, I don’t want to do this anymore.
Alex: So, I guess people that you guys know that kind of jumped ship when like, in this kind of period, whether it was kind of like this financial situation, other pressures from COVID, if it could be safety concerns, cause their work wants them to go back into work, or they were just getting burnt out, just from your own feeling from that peer group that you know, were people shifting to completely different careers or do you think that they were just shifting to a less intense job?
So I know from my own peer group, people were shifting out of roles that were on-call, dealing with incidents constantly, to more internal roles that still had the same level of responsibility, but I guess they could manage their work life balance a little bit better cause they had more control over their own fate within that job.
Simon: I think like you I’ve seen a majority of people who I knew working in the IT industry move to less stressful or more fulfilling roles. I know people who moved and went, “You know, what I’ve had enough of working in banking and finance because it doesn’t align with my belief system as much as I would like it to,” and they’ve gone to work for charities and things like that.
So there’s been a sort of an ethical move there as well as a stress one. I’ve worked in charities, it can be way more stressful. If you’ve ever been, it’s not necessarily a lightweight environment by any stretch of the imagination, but at least you know what you’re doing is having a positive effect for somebody as opposed to putting another dollar in somebody’s pocket of a shareholder somewhere. So, you know, there is this.
Funnily enough, within people I know outside of the IT industry, actually more have gone to do something completely different. And I don’t know why that is, whether it’s just that, I don’t mean to be negative about my friends, but, you know, our skill set is very hard fought for and hard won.
And, you know, it seems logical to continue with that. Whereas people who perhaps work in (going need to be really careful about how he says this) work in management roles in other industries can move to management roles in other industries more easily.
Alex: Yeah. The skills are more transferable.
Christa: Well that brings me back to like, Si, you had mentioned earlier something about mentors and having a lack of mentors. And the question that I jumped to was indeed around managers; how well equipped are managers to mentor professionals in digital forensics and incident response?
And if they are indeed switching from management to completely some other industry, you know, they don’t necessarily have the skill sets to be able to kind of guide and shape somebody else’s, like a more junior team member’s role. So how is that kind of a factor, maybe?
Simon: I mean, I think my experience has been quite frequent in working for managers who have not had a strong IT security background. I’m going to say I’m very lucky in as much as I have some friends and colleagues and indeed mentors outside of the places I have worked who I’ve been able to go and talk to to get that.
Now I wonder if perhaps it’s less about, being a good manager is a hard thing to do, finding a good manager is very important. And, you know, I say this, my wife is a project manager, I wouldn’t want to do her role. I can’t, I don’t like people. No, that’s not how I meant that. I don’t really want to manage people. I don’t really want to worry about who’s going to be where, when, doing what, and whether that all lines up. That doesn’t float my boat.
So if you get a good manager who can do all of that stuff for you, who can help with the prioritization of tasks and all of that, the fact that you need to go and talk to someone else to say, “Okay, I’ve got this problem. I don’t quite understand how to solve it, you know, have you come across this before?” that knowledge could be somewhere else.
And actually, you know, without selling Forensic Focus too hard in a directly related podcast, it’s actually a really good environment for that because, you know, there are enough good people out there that you can go and I have friends who I’ve met through that and who are incredibly competent and I can go and ask questions of, and I’ve had questions back in return from people through that.
I also think that universities have some role to do that for their students. I have students who I’ve taught for years who will still call me up because they’ve known me through university to advise on things. And I think in the right sort of university structures that gives us that strength of mentorship and collegial assistance.
But the industry actually, I mean, certainly digital forensics where it is a pretty collegial industry. I mean, even on the defense/prosecution side, you know, it’s a problem people wish to, you know, progress and work on it. It’s not as adversarial as you might think outside of the court. So yeah, I’ve completely forgotten what the actual question was and rattled off stuff, but, you know, there we are.
Christa: No, I was curious if those kinds of strong community bonds actually are helping to keep people in the profession, kind of reduce or mitigate some of the risks of burnout. You know, if you have somebody to talk to, you know, if that’s a camaraderie that you would miss if you left and did something else that doesn’t necessarily have those strong bonds. Thoughts?
Alex: I would 100% agree with that. I think that especially within Australia, the community is very small And so it’s a double-edged sword. So if you ruin your own reputation, it’s very hard to then get a job, because everyone seems to know everyone. Whether that’s through vendor connections, you’ve previously worked with someone else, or like checking references is very easy. It’s not like you need to get them from the individual.
But at the same time, it’s probably keeping a lot of people in because they may really love the team that they’re working in. And I guess this is kind of where I hit the wall in my last job is, I was kind of getting burnt out and I was like, “I want something different.”
What was keeping me there for so long was actually the team that I worked with cause I loved working with them. I had some really good mentors who, some were managers, but some were also just really strong technical people on the team that I was learning a lot from.
But then I went and worked for another company that I had friends in and I had that camaraderie again and I was working with really technical people and it was easy for me to check references for where I was moving to. And I was like, “Well, what are these guys like technically and as people?” So with that small community that kind of kept me in the industry.
Otherwise I’m always of the opinion that if I don’t like it, I’ll just go do something else. Like, a career change completely doesn’t scare me that much. There are plenty of other things that I wanna try that I could go and do. So it’s definitely one thing that’s kept me in so far.
Simon: Yeah. Like you, I mean, I’ve stayed on in places probably past the point where I should have walked out because of the people in my team and, you know, some of the spirit of not wanting to let them down and not wanting to leave them in the lurch.
So, you know, I think there is, I mean, a good team is going to look after each other in that way. Whether that’s always healthy for a given individual is possibly open to debate. But I think this is a large psychological question that we’re not ever so qualified to answer, so…
Christa: I don’t know. I mean, maybe it’s a sort of thing that would actually behoove managers to understand a little bit better about team psychology.
Simon: Yeah.
Alex: Yeah, it’s a tough one. Like, I’ve seen some really good managers and I’ve seen some really bad managers and I think it comes down to some points that I always had that I learned from the military was, managers should always be transparent with their team and even if they don’t directly interact with the team culture, they need to understand the team culture at different levels.
Which I think a lot of managers, they kind of get to a level and they sit in that organization strategic space and they stop understanding the tactical level of what people are doing day to day, how they interact with each other. And I guess like, that’s why organizations have layers of managers and if you have one kind of bad link in that, or one link that just doesn’t understand the nuance, then that chain breaks down, which can cause some issues.
And it could be a non-immediately apparent issue or not even an issue, but it’s not immediately apparent and it causes friction over time. And then it’s not until you get six months down the track and you’re like, “Oh, the culture’s changed so much and I’m not happy here anymore.”
Christa: Frog boiling in the pot.
Alex: Yeah. And you go back and you look and you’re like, “Oh, this decision back here was a turning point for the team. It started to feel different. And then back then it wasn’t a bad thing, but now it kind of is.” So I totally agree with Si. Like. I think finding a good manager at each level is a very hard task for any organization to do. And people can’t just be, “Oh, you’ve been in this role for so long.” They need training to be good managers, as well.
Simon: Yes, yeah, absolutely. The idea that, you know, people are promoted into managerial roles without any help or additional training isn’t fair to people under them and it’s not fair to them, either. You know, the expectation that all of a sudden you’ve gone from being managed to managing another person is not a logical jump, you know?
Apart from everything else, you know, people themselves are so vastly different. You know, the way you and I would like to be managed may be hugely different. You know, some people like lots of clear instruction and that would drive me around the benders, I’d feel I was being micromanaged and, you know, figuring out each person’s sort of managerial requirements and style is a real challenge, which is why a good manager is a real asset to an organization, so…
Christa: I feel like that kind of also feeds into the sort of the current, I don’t if “zeitgeist” is the right word, but around diversity, equity and inclusion efforts at companies. You know, I’m thinking of differences in managerial styles, for example, neurodivergent people learn and process and communicate very differently.
And then, you know, just the experiences that some staff can have being the only, you know, whatever the identity is on the team can be challenging in ways that I think a lot of people in general and not just managers are not equipped to deal with.
And I don’t know, I mean, you know, if you get promoted into an incident response role and you kind of are expected to hit the ground running and get the results and so on, you don’t necessarily have the time or the room to think about those absolutely critical sort of connective tissues, I guess, of teamwork.
Simon: Yeah. And I think, you know, on the inclusivity diversity point, I mean, it’s, you know, obviously it’s incredibly important, but sort of going back in the opposite direction, what we’re seeing is that we’ve got a lot of people coming into the industry, or trying to come into the industry and being trained to a certain level.
But actually, the majority of the top end of this industry one way or another are white, male, you know, middle class, degree-educated possibly, actually, well, I will say is in my experience, there’s actually a reasonably large number of neurodiverse people here of one type or another, just because — I speak as a reasonably neurodiverse person — this industry attracts us and therefore, you know, that is at least one thing that we perhaps appreciate, but may not necessarily be the best at actually managing other people because our own experience and impression may be very different to somebody else’s experience and impression and we may not necessarily have the skills to be able to accommodate that.
So that’s a yeah perhaps a slight thing, but right now we certainly need more representation within the industry, I feel, without a shadow of a doubt. If you go to a conference, you know, a majority of the people there are men, greater ethnic diversity than they used to be, honestly. I’m very pleased to see that, but, you know, it’s still majority white men and we need to work on that. Looking at students coming through, we’re still looking at a fair proportion of men versus ladies in the intakes.
Christa: I wondered about that, because I feel like I’ve seen a fair number of posts on social media about it’s not a skills gap at the university, at the educational level that we’re seeing, it’s more people that are not white and male are getting into the profession and leaving within a few years because the they’re still seeing, for instance, microaggressions or they’re still experiencing maybe pay issues or they get disillusioned, I think is what I’m trying to say over time.
And so like, it feeds back to the Great Resignation that, you know, it’s maybe not just the remote work and maybe not just the burnout but also these other social factors really that you know, maybe have gone understudied.
Simon: The problem, I’m going to say that the terrifyingly upsetting thing about that is by not staying in the industry it perpetuates the people who are moving up the ladder to be those who aren’t harassed by whatever microaggressions or, you know, inherent bias in an organization and those things.
And how do you change it? Again, you know, we’re into management theory rather than anything else. But I do agree. And I think certainly on the digital forensics side, I counsel all students who are coming into it, that it is at times a very distressing field to work in if you are doing law enforcement stuff.
And, oh, you know, I’m sure that that many people, I feel that there is no difference between the way that a woman would handle it and the man would handle it. But I think that there is certainly a perception that women are more affected by such things than men are, although God knows why, because, you know, it’s horrible for all of us.
And therefore, I think they are put off by purely that sort of psychological bias. I don’t know, I don’t know. It’s a difficult one, but I certainly do counsel all students to consider whether they feel that they can do it or not under all circumstances, if they want to pursue it.
Alex: It’s an interesting point you made, Christa, about that. We’re seeing quite a diverse percentage coming through the schools but then leaving within the first couple of years. And it’s something that I never thought of that, like, I’ve never had to deal with that personally.
Like, I’ve never had to be under the pump in an incident response situation, then also dealing with microaggressions and being unsatisfied and harassed in a work setting in that way, which just seems horrible. And I think like, at a manager level, if the manager’s perpetuating it, that’s a huge issue cause you’re trusting that person to look after the workforce and they’re not doing that. I think in terms of changing it is also just for people to be aware, which is it’s been out for ages, but not be a bystander.
So even if you’re at that same level, like, don’t accept that behavior if you are seeing that amongst your peers or from the manager. Like, it’s a hard thing to do because you may be in a situation where the aggression will turn towards you if it is from a manager or something else.
But it’s kind of just the right thing to do. Like, if everyone steps up and does it, then those people who are perpetuating those microaggressions will get phased out of the workforce, which is what we want. Because you don’t want someone like that to make senior partner or become the manager of the whole practice because then hiring influences will be driven by them, which just further causes the rift that we have in that percentage of people in our workforce that we need that diversity.
Christa: I feel like it’s challenging though, because especially if you’re not regularly exposed to a microaggression, you don’t always recognize it when it’s happening. I mean, and I’m thinking of examples of, you know, for instance, I’m ADHD, my way of processing things is very different. I’ve had people treat me like I’m stupid and it’s not always really glaringly obvious.
Sometimes it’s the question, you know, “Are you sure about something?” or, you know, “I would do it this way.” And it sounds like perfectly reasonable constructive criticism off the top, but, you know, if you’re experiencing a constant kind of drip of that, of, you know, suggestions or slight criticisms, and it’s either always from one person or it’s always around the same thing, then what sounds reasonable just as a one off starts to really wear on your sense of self.
And also you may not have any witnesses to that, and, you know, so that also makes it challenging. You know, to the point where, you know, you go to your manager and you say, “Hey, I’m having trouble with somebody.” and, you know, frequently the response that you get is, “Grow a thicker skin, you’re being too sensitive.”
And yeah, at that point it’s like, I’m just going to go look elsewhere because, you know, I don’t think I’m too sensitive and I would like to work in an environment where I feel a little more accepted.
So yeah, I don’t know how to solve those issues. I feel like that’s something that it’s maybe not taught necessarily to that granular level of, you know, what does a microaggression look like in managerial training? So maybe what it takes is more people just talking about it, you know, talking about what it sounds like and how it makes them feel and, you know, the frequency that it happens at for people to really be able to take notice and understand that it’s an issue and not have the reaction that you’re being too sensitive.
Alex: Yeah, and 100%, like, I would not know how to handle that situation or kind of suggest a method to solve it. But I think one of the examples I had was, I was working with this lady who was concerned about pay equality and the company that I was working with didn’t publish salaries for everyone or bands or what everyone was getting, which was super strange for me coming from the military, because you could look up my pay salary when I was in the military on a PDF on Google.
And so like, I was always happy to share my pay, and the cohort that we had at that junior level were all very happy to just be open about what they were getting, and that kind of, it turned out she was getting paid the same and it wasn’t an issue. But it put her mind at ease and it was a pressure that she was experiencing.
So I think in a lot of situations, you kind of have to have that cohort that you trust. Like, you need to trust the people that you work with. And definitely if you feel something that just feels a little bit off, you can at least discuss it with no consequence with your peers.
But there’s probably, especially for new people coming into the workforce, they might not have that cohort. And I guess that’s why things like what Si does, where he is mentoring students, that you have that mentor outside of the business that you can actually bounce those ideas off and then create that network that can support you, even if you’re moving into a new role, yeah, it’s definitely not an easy situation and something that I don’t think I’ve ever experienced, so it’s hard to comprehend it myself. And it’s just sad to hear people’s kind of experiences.
Simon: Yeah. Again, you know, not something I have experienced myself. I’m going to say, it’s listening to my wife talking about it and some of the things that she has come up against in a predominantly male-based industry which really makes me feel and notice in fact the way that it has happened in the past and I watch out for it far more now.
And yeah, like you say, certainly all that is required is that you take someone aside and say, “Look, that’s not on.” Or, you know, don’t even take them aside depending on what the level is, you know, say it out loud in the middle of a meeting that that’s not an acceptable comment and take it from there.
But yeah, there’s an expression my wife uses, which is, you know, “The fed don’t get the hungry.” And, you know, it is the people who we need to be more mindful of who are in the minority, generally speaking, who are the ones who are suffering and the majority are gonna be, “Yeah, it’s fine,” or, “Grow a thicker skin,” or, you know whatever the response is in that regard.
So I think, you know, yeah, just say something. I think that’s the message at the end of the day, isn’t it, wherever you’re at, just say something. You know, if they’re going to make a big fuss about it and be difficult about it, it’s probably not somewhere you really want to be working. So, you know, time to move on to somewhere where it is more acceptable.
Christa: I feel that brings us back to the original, the Great Resignation.
Simon: It does, doesn’t it?
Alex: Gone full circle again.
Christa: We’re going to close it there. Thank you again for joining us on the Forensic Focus Podcast. You’ll be able to find this recording and transcript along with more articles, information and forums at www.forensicfocus.com. Stay safe and well.
