I think I just figured out why so many people burn out in defensive cybersecurity after a decade or two.

It's because Defense is a glacier that moves at its own speed, with occasional bursts due to major incidents and/or regulation.

But nothing within the glacier is dictating its speed.

That's our problem. We are the pebbles and sticks and moss that gets captured by the giant wall of ice as it creeps. And we scream at it from within.

Glaciers don't listen. They do precisely what they are going to do.

Think about the innovations that moved security forward the most in the last 15 years. I'm not sure what they are but let me throw a couple candidates out there.

A few things jump out at me about this list, which I know isn't perfect.

First, everything here was inevitable. Second, everything here could only happen when it happened, and not a moment before. When a new technology gets invented, like SSL, that was the moment for it. And if that person/group hadn't done it, someone else would have.

It's the same with a thousand other ideas. They don't exist for all of human history, and then all of a sudden multiple people have the idea at the same time. A few examples:

And then you have something like PCI, which, again, could only happen at a certain level of industry and government maturity. Plus the prevalence of attacks that make such a thing necessary.

So these things were basically going to happen.

Slow. Steady. Glacial. But inevitable.

Glacial problems

Then you have unyielding problems---like human gullibility.

How many security people have screamed at users because they clicked on something they obviously shouldn't have? Well, humans are set up a certain way, and they really like free stuff, and relationships with royalty, and they tend to get lonely.

That's millions of years of evolution in the red corner. And in the blue corner? Your security awareness campaign.

So what do we do? We bash our faces against a wall of gullible for multiple decades.

FIDO2 and Passwordless

But then here comes "passwordless", which is truly great and is likely to be the first thing to make a serious dent in phishing in forever.

Why didn't we just do FIDO2/Webauthn sooner! Gee, how silly of us! Answer: we couldn't have. It is happening now because that's the time it can happen.

Real progress bakes into the furniture

Then you have the real progress, which is integration into the operating systems we use everyday.

That's where real progress is made.

So again I ask you---why didn't we just incorporate all these security features in these OS's back in 2005? Or 2010?

Same answer. Because we couldn't. Turns out, it's very hard to move giant machines like Microsoft and Apple to add things. Millions of moving parts. Things happen when they happen, just like electrification of the country.

The takeaway

What made me realize is that cybersecurity is this planetary-sized box of a trillion tiny gears. Or it's a glacier. Or it's an ocean. The metaphor doesn't matter. Use the one you like most.

What's important is that it's:

And that's the problem with a lot of the burnout in cyber. Specifically on the defensive side.

We're sold that we can make the difference. We'll just tell the boss about this thing, and they'll let the business know, and we'll get it fixed.

But we do that, and nothing fucking changes.

We build elaborate plans, perfectly articulate them. Expertly socialize them.

And nothing. Fucking. Happens.

This is why.

Progress in security is a massive machine. It's moving very slowly. And even when it occasionally bursts ahead with progress, that progress is random and not generally tied to any one person or even any one company or industry.

So I just quit?

And that leaves us with what to do.

I don't think this revalation is sad. If anything it's empowering. It wasn't you. It's just the machine. When we absorb this message we can reclaim our sanity. We can reclaim our peace.

Progress will be made, but it won't be on a clock set by us or anyone else. It'll happen in its own time. It actually reminds me of General Absurdism, which is my way of dealing with the big questions in the universe.

On one hand, I behave as if I can change things. Me. Just me. With my very own will. And I try hard in that mindset. But I also---and simultaneously---know that I can't. This does two things for me.

More practically, if you are seeking a field in which your idea can more instantly and directly translate into a change in the world, I recommend business.

If you create something net-new that solves a problem people have, and people actually use it, well now you've made a real difference, and you might make some money in the process.

And to be clear, you can still get wins in defensive cybersecurity. You can innovate new detections, new products, new techniques, etc. And they can make some difference.

Just don't fall into the trap that depresses so many people, where they zoom out and look at the overall machine, and see that their impact didn't really change what was going to happen anyway.

Summary