Uploaded October 2019 | Updated September 2026, 5 days ago
In February 2018, an article appeared concerning 'cybersecurity PTSD' and its impact on the security workforce, spurring a reaction to the terminology and the conditions referenced. More anecdotally, we as security practitioners have all heard co-workers lament of a stressful experience resulting in some sort of workplace 'PTSD.' While it is therapeutic to joke about serious issues at times, as a Post-Traumatic Stress Disorder sufferer and survivor there are limits – but also scope to identify moments for our industry to grow in facing such issues.
Whether through sexual trauma, military service, or other traumatic experiences, the number of diagnosed cases of PTSD is increasing – and along with it the chances that you will encounter someone living with this condition in the workplace. As the security industry grows and matures, the proper response is not to ignore, avoid, or shun this topic, but to embrace PTSD and coworkers and colleagues experiencing it to better understand the condition and formulate a better, more understanding workplace.
In this talk, I will speak to my own story of PTSD – from military service in Afghanistan to a very unique medical trauma – and how it has shaped not just my life, but my work in cybersecurity. Principally, cybersecurity has offered a haven for myself cognitively and emotionally - and I feel that I am not alone in finding peace and solace in our field. In providing this overview, I will touch on various points that we as a community can embrace to better understand and support those in our midst who may also suffer from such a condition.
Overall, the goal is to keep matters reasonably 'light' so we as a community can discuss such subjects, while at the same time diving head on into how the security culture both supports and provides difficulties to PTSD survivors. Ultimately, developing a more empathetic, emotionally aware security community will only benefit us as a profession – and PTSD is an excellent starting point for such a conversation.
In February 2018, an article appeared concerning 'cybersecurity PTSD' and its impact on the security workforce, spurring a reaction to the terminology and the conditions referenced. More anecdotally, we as security practitioners have all heard co-workers lament of a stressful experience resulting in some sort of workplace 'PTSD.' While it is therapeutic to joke about serious issues at times, as a Post-Traumatic Stress Disorder sufferer and survivor there are limits – but also scope to identify moments for our industry to grow in facing such issues.
Whether through sexual trauma, military service, or other traumatic experiences, the number of diagnosed cases of PTSD is increasing – and along with it the chances that you will encounter someone living with this condition in the workplace. As the security industry grows and matures, the proper response is not to ignore, avoid, or shun this topic, but to embrace PTSD and coworkers and colleagues experiencing it to better understand the condition and formulate a better, more understanding workplace.
In this talk, I will speak to my own story of PTSD – from military service in Afghanistan to a very unique medical trauma – and how it has shaped not just my life, but my work in cybersecurity. Principally, cybersecurity has offered a haven for myself cognitively and emotionally - and I feel that I am not alone in finding peace and solace in our field. In providing this overview, I will touch on various points that we as a community can embrace to better understand and support those in our midst who may also suffer from such a condition.
Overall, the goal is to keep matters reasonably 'light' so we as a community can discuss such subjects, while at the same time diving head on into how the security culture both supports and provides difficulties to PTSD survivors. Ultimately, developing a more empathetic, emotionally aware security community will only benefit us as a profession – and PTSD is an excellent starting point for such a conversation.








![Black Hat USA 2018 - Stop that Release, Theres a Vulnerability!
Software companies can have hundreds of software products in-market at any one time, all requiring support and security fixes with tight release timelines or no releases planned at all. At the same time, the velocity of open source vulnerabilities that rapidly become public or vulnerabilities found within internally written code can challenge the best intentions of any SDLC.
How do you prioritize publicly known vulnerabilities against internally found vulnerabilities? When do you hold a release to update that library for a critical vulnerability fix when its already slipped? How do you track unresolved vulnerabilities that are considered security debt? You ARE reviewing the security posture of your software releases, right?
As a software developer, product owner, or business leader being able to prioritize software security fixes against revenue-generating features and customer expectations is a critical function of any development team. Dealing with the reality of increased security fix pressure and expectations of immediate security fixes on tight timelines are becoming the norm.
This presentation looks at the real world process of the BlackBerry Product Security team. In partnership with product owners, developers, and senior leaders, theyve spent many years developing and refining a software defect tracking system and a risk-based release evaluation process that provides an effective software security gate. Working with readily available tools and longer-term solutions including automation, we will provide solutions attendees can take away and implement immediately.
• Tips on how to document, prioritize, tag, and track security vulnerabilities, their fixes, and how to prioritize them into release targets
• Features of common tools [JIRA, Bugzilla, and Excel] you may not know of and examples of simple automation you can use to verify ticket resolution.
• A guide to building a release review process, when to escalate to gate a release, who to inform, and how to communicate. Black Hat USA 2018 - Stop that Release, Theres a Vulnerability!](https://i.ytimg.com/vi/BxAdOKeGD7s/mqdefault.jpg)

