Speaker 1: Welcome to the Cyber Risk Management Podcast. Our mission is to help executives thrive as cyber risk managers. Your hosts are Kip Boyle, Virtual Chief Information Security Officer at Cyber Risk Opportunities and Jake Bernstein, partner at the law firm of K&L Gates. Visit them at cr-map.com and KLGates.com.

Jake Bernstein: Kip, what are we going to talk about today on episode 163 of the Cyber Risk Management Podcast?

Kip Boyle: We're going to talk about something that I believe is under discussed, and that's self-care. It's a crucial topic. I don't know why we don't talk about it more. There seems to be some kind of a stigma, but we're going to have a guest here. He's here now. He's going to help us with this topic. His name's Chris Roberts. Anybody who's spent any time on LinkedIn trying to find out what the InfoSec people are saying have probably seen a post from Chris. He's most recently the Chief Information Security Officer for Boom Supersonic, which I mean, let's face it, that's sexy as all get out.

Jake Bernstein: It's a great name. That's a good name.

Kip Boyle: It's a sexy mission too. He's also the co-host of a podcast. It's called WTF Did I Just Read? This is marked as a clean podcast. I'm not going to decode WTF for anybody. I'm sure you can figure it out for yourselves.

Jake Bernstein: I think our listeners can figure that out.

Kip Boyle: They're very savvy. Yeah, so let's get going.

Jake Bernstein: Chris, welcome to our podcast and thank you very much for being our guest. Now you've been called, and I quote, "Gandalf to the security industry. He's seasoned, mature, cranky, knowledgeable, ungodly skilled and powerful on an ongoing mission to save us from ourselves in spite of ourselves." But you're more than a colorful, long bearded speaker of truths. Now, Kip, you started this off by saying we're going to talk about self-care.

Kip Boyle: We are.

Jake Bernstein: Like taking care of one's self. Is that what we're talking about today?

Kip Boyle: We are.

Jake Bernstein: Like mental health, physical health.

Kip Boyle: All aspects, right.

Jake Bernstein: Happiness. Okay.

Kip Boyle: Yeah.

Jake Bernstein: Let me start by asking, actually you Kip, because I view scripts these days as gentle suggestions at most.

Kip Boyle: Yeah. I think everybody concerned knows that.

Jake Bernstein: I think they do. It will come as no surprise to anybody that the legal profession has had a mental health problem for a very long time. We have higher rates of substance abuse than other professions. Apparently, there have been numerous suicides at law schools over the last decade. We're not good at this as lawyers. I want to know from the information security practitioner side, I doubt you're as bad as lawyers, but that's a long way from being any good at it at all. What do you think? What is the current state of this industry? I actually have never even asked this question of you before, so I'm curious what you're going to say and obviously Chris, you as well.

Kip Boyle: Yeah, well I'll just quickly say it's an issue. In my experience, I've talked with lots of people who struggle for different things. In my experience, it's been a very stress related, very anxiety related, related to long working hours, tedium. And there's a subset of security people who are traumatized by the content that they are routinely exposed to. I'm talking about really obscene materials that some people have to look at, either social media content management or digital forensics, that sort of business. There's some people that really get slapped in the face hard with really awful stuff, so I know this is an issue. I myself have been burnt out before, but I really, we invited Chris here to talk about it.

Chris, I would love for you to tell us, I know self-care is a really important issue for you, which is why you're here. Please tell us what are you seeing and what's going on?

Chris Roberts: I would argue unfortunately that our industry is as bad, if not potentially worse than some of the legal profession, especially from the mental health and unfortunately the suicide standpoint. Part of it comes down to a lot of us call former .mil and former .gov, so that whole, one of the biggest issues we've seen in the military is all the people that are in and former, the number of suicides. There's anywhere, it depends on the numbers you believe, between 17 and 22 people a day take their own lives.

Jake Bernstein: That is worse than the legal profession. The question, I think how much of it is also the growing pressure on cybersecurity professionals and practitioners in general? As you said, in maybe 50 years, we've gone from there not being a cybersecurity practitioner profession to it being one of the higher stress jobs that one can have and it's only getting worse. I mean, Kip, we've done two episodes now about killware and how ransomware in healthcare can literally kill people or bring down hospitals that will indirectly kill people, so it is literally a matter of life and death for some cybersecurity practitioners.

Even when you're not in a profession, even when you're not in an industry where it truly is life and death, it oftentimes is existential for the business, which is not just your job, but everyone whose job is all the people you know and work with, it's their jobs as well that are potentially at risk. It's no joke to say that this is a high pressure job that's gotten higher and higher pressure. And I don't think that people talk at all about self-care, mental health in the cybersecurity profession, and that's unfortunate.

Chris Roberts: There's some conversations, ironically it's-

Jake Bernstein: I guess we're having one now.

Chris Roberts: We are. No, but there's some groups. You've got the Mental Health Hackers group, which has been around for a number of years, which is absolutely fantastic. You've got Mind Over Cyber now, which started up last year and first of this year and is doing some really good things. Then I was on a podcast with Doug and a couple of others and we're actually doing in Chicago, one of the ISFA meetings in September we're getting 50, 60, 70, 80 people together and having very frank conversations. So it is starting to happen, but to your point, it's the pressure whether you are directly affecting or indirectly affecting humans, technology, systems and those around you has increased exponentially, as have the consequences of potential failure.

Kip Boyle: Let's transition. I think because of all the stigma and the fact that as a result we don't really talk about it, I think people tend to see self-care as a question of strength versus weakness. They kind of characterize it in that way. Like, I don't want anybody to know I'm struggling because then I would show vulnerability and then I might get attacked or somebody might try to take advantage of me. So I think there's a lot of reasons why we don't talk about it. Chris, what would you say is, what's the business case for better self-care? What are the benefits? Why should somebody who sees it as a stigma, as a thing that shouldn't be dealt with, why should they change their mind? Why should they do something?

Chris Roberts: I mean, I think if we recognize the fact that it's not just you, it's all of those around you. You being everybody, the royal we. If I'm in a leadership position and I realize on going through something, you can bet your bottom dollar that everybody on my team is. If I don't have the wherewithal to take care of myself, if I'm basically my performance suffers, my time off suffers, my ability to be effective in my role suffers, my communication and collaboration with others suffers. You start to see all of these issues, the irritability, the lack of sleep. I mean, you're dealing with somebody who doesn't sleep very much. All of these things play into becoming less and less effective at the role that you've basically been hired for. Now that obviously that trickles down to everybody inside the organization.

If you don't take a step back and go, "Hey, I have an issue, therefore my others, my peers and people around me have an issue." If you don't make it something that's open to have a conversation about, everybody unfortunately suffers together. Whereas if you take that step back then, and I mean I used to do it with the teams I've worked with, I still do it with teams I collaborate with now I'm like, "Hey, if there's anything, just take the day. I don't care. I don't want to see a time sheet. I don't want to see a PTO request. Get the heck out of here." You wake up in the morning and you just can't get out of bed. Number one, checks and balances. Make sure that somebody knows that. Number two, just keep somebody in the loop and have somebody on speed dial. Number three, I don't want to see you at work. Take the day, stay under the cover. Get out in the fresh air. We'll talk about a whole bunch of options like that.

I think it's one of those things where purely from a business perspective, the lost productivity is huge. From a human perspective, the lost capital with family, with friends, and with those around you, if you don't turn to them and go, "Hey, it is just I'm having, it's one of those days today and I can't and I don't want to deal with it."

Kip Boyle: I think when your supervisor sets that tone that you just described, it's so much easier to realize that it's okay for you to take care of yourself better. The stigma kind of evaporates a bit. I guess one of our calls to action to our audience is if you are listening to this and you're a supervisor, you need to make people, you need to make it clear to them that it's okay for them to take care of themselves as long as they're in conversation with you about it. What about people who like their bosses are not on the self-care train? They don't ever talk about it. If anything, they sort of hint that you're not all that if you need a mental health day, what do those people do?

Chris Roberts: I unfortunately have seen that in too many cases, and at that point you almost have to box and say, "Okay, from my work hours between here and here, I'm going to deal with this." Then you set yourself up those safety nets outside of work. If you know going into work is going to cause you anxiety, well, first and foremost, why the heck are you there? Get the heck out of that environment. Let's just start with the easy one, or at least start to plan to get out of that environment. Not everybody has the ability just to walk away from a job, and I would recommend nobody does.

I would recommend a thing, taking that step back and going, "Okay, if I'm waking up and I don't want to go into work, why?" Write it down. Sit there and go, "Is it me? Is it the work? Is it the environment? Is it the commute? Is it the people? Is it the role? What is it?" Get those pluses and minuses. Get them down on paper so you can actually visualize them. Then if you've got to go in just basically you've got to get yourself to a point where it's like, okay, is a coffee going to make me happy? Is a longer drive basically through the woods rather than the crowded street? Can I do something with my hours, earlier or a later hours on my schedule? Can I take a lunch break and actually get the heck out, go hit the gym, go for a walk, throw rocks at the locals? Whatever it takes to take that stress down.

Then at night I block my hours, and this is one of those techniques I've used for inaudible years, because I get too much going on. I block my time. When I leave work, I have a block of time for me. Whether it's to go mountain biking, to get the heck out, to read. I have a block of time for food. I have a block of time to do things after night. I block my days out for even for my meal. I block my meal time out so that I know I'm going to take that time.

Kip Boyle: Okay, and so the benefit for you as an individual, even if your supervisor isn't supportive about self-care, is that you have the ability to, it is within your control to do things to take care of yourself, even if you have to do it kind of below the radar from what your supervisor is saying. Jake, that's what it looks like in the InfoSec world. Does any of that pencil in the legal world?

Jake Bernstein: I mean it really does. I mean, time blocking is definitely a technique. If you're listening and you're like, "Well, that all sounds good, but I don't want to call it self-care. That's fine. We could also call it time management. If you want to call it time management, you can call it time management. If you want to call it your productivity hack, go ahead, call it your productivity hack.

Because really what we're saying here is, look, we're realists. We know that while it might be nice to dream of a world where human happiness and joy are the ends that we actually try to get, we know that you have to make money, that we tend to live in a mostly capitalist society and that there's a lot of societal pressure to perform, and maybe there's a lot of internal pressure to perform. What we're saying here with self-care is that it is a productivity hack. Because if you're not taking care of yourself, you're not going to perform, you're not going to be as productive, you're not going to be as efficient.

That very anxiety that is created by your job, the anxiety from failing something or not performing as well, is actually going to, you're going to only increase the odds of that happening by failing to take care of yourself. Even if you don't want to think about this in the self-care type of regime or framework, this is a very important part of just being a successful human being overall. I think there's a lot of different ways that this gets talked about and I think what might be helpful is to have some specific ideas. Chris, what are some? You've mentioned a few, but let's go through a list here of ways that are maybe, I mean the time blocking, I think people could argue about whether that's self-care or whether that's time management and productivity.

Chris Roberts: Totally.

Jake Bernstein: What are some ideas that are kind of more pure self-care that you have seen work?

Chris Roberts: Yeah, I got a bunch that I practice myself. Let's start with one of the longer term ones. For me, I look forward to certain things. Like I look forward to GoCon, which is the conference in Grand Rapids, Michigan that's coming up later on this year. I'm already planning for it. I'm going back out to the Middle East later on this year. I'm planning for that. I have that goal. I've got some challenges on work. I don't know how it's all going to get paid for. I don't care, but I have that goal and I'm going to make it happen. It's that setting a stake out. You can do the long-term ones, which is like, I'm going to take a weekend to myself. I'm going to take a weekend with a significant other. Plan it, set it X number of weeks out and then you've got something to look forward to.

Take that mindset though, but also do it on a daily basis. For me, it's my biking. When we're done with this podcast here, I'm basically going to pack everything up. I'm going to go put my biking gear on and I'm getting the heck out and I'm going to do 20, 30 miles and just get out and explore. I can't focus on anything else because if I do, I crash, as we all know.

The other one is, if you've got a bath or a good shower, plan, plan to have a bath or a good shower on a regular basis. Just literally laying in an Epsom salt bath with the music on is one of the best things to keep you thinking about. Or just say, "Hey, look, it's Saturday morning, I'm not going to get up." If you've got kids, keep them amused. Even if you've got to give them electronic for a couple of hours or a board game for a few hours, go, "Hey, I'm going to lie in bed for that extra 30 minute, extra 45 minutes." I'm going to read a freaking book. I'm going to go back to being a kid. I'm going to make tent in the bed and maybe have a kid in with me and we'd read under the cover.

The other one that I love, and I do it on a fairly regular basis. I was out a couple of nights ago. I went out to, there's an amazing Lebanese bakery not too far from here. I pulled up and it was 9, 10 o'clock at night and the bakery's open til midnight, which is absolutely fantastic. Pulled up like 9, 10 o'clock at night. There was a group of older guys outside smoking hookahs, having baklava and coffee. I went inside, I sat down, I got my iPad out, I wanted to get a few things done. The guy came up and I just hung out with myself. But when I went up to pay, I paid for the guys outside. Now I knew I've seen one or two of them before, but I didn't really know them and I'm just like, I want to pay it forward. I want them to walk in and go, "Hey, we're ready to pay." And not have a bill.

Because that to me is even if I can't make myself happy, even if I can't do something for me, I can do something for somebody else. You pay for another person's coffee in line at Starbucks, you unexpectedly pay for somebody's couple, a handful of groceries, or in this case their baklava, hookahs and coffees. I like doing that because I can't always look after myself in that way, but I can try to do it for others, which eventually it's a warm feeling.

The time boxing is another big one. I'm fairly Draconian. I will not take a meeting before 10 o'clock in the morning. There are very few exceptions to that. I will not take a meeting, because I want to wake up when I wake up and I want to get my world straight. I want to get everything together and then I want to tackle the world. I also, on Saturdays will for the most part, leave my phone behind because that's my day to stay the heck away from electronic to not deal with this world unless something's on fire.

I also, I'm very well of who I am. I have my world fairly well set up. I know where my glasses are. I know where my cup is. I know where my tea making stuff is. Even if you've got kids, even if you have a family or a situation, at least make a space that is consistent so you know where to find the pens. There's that old book, Who Moved My Cheese? It literally is that. In my own mind, if I don't have things set up where they are, I can't function, so I'm very careful to make sure that I have some kind of stability over certain parts of my environment.

I also try to say thank you. Pleases and thank-yous are absolutely free on this planet. Even if you're in a grumpy, whatever the heck it is mode, or you're not feeling or whatever, I at least try to pause and say thank you. That probably comes to the last one, which is, it's four words. Holds up three fingers. It's four words, which is pause, breathe, think, react. Those have saved me, especially as I've gotten older. Years and years ago I didn't. I would flamethrower bridges and relationships and everything else, but for me nowadays, I try to do my best to pause, think, breathe, and then react on something. It's amazing how much that has actually helped a lot.

Kip Boyle: Chris, with all those suggestions that you've just shared with us right now, a couple of things really shown out to me. The first is that I think you've got a really tremendous sense of boundaries for yourself. You know what your boundaries are. You're not afraid to enforce your boundaries, and you probably do it in a very kind way where you're not barking at people, you're just telling them, "No, I'm sorry, but I cannot take a call before 10:00 AM."

What else do you have? What else could we do? Because probably, I imagine that's how you do it. Then the other thing I want to say is that you sound very self-disciplined. Because nobody's telling you to do this, right? There's no external force pressing on you to do any of the things that you just talked about.

Chris Roberts: Correct. Yeah.

Jake Bernstein: I would like to, even though I'm not always feeling it, I am on this call the youngest. What I'd like to ask, particularly you, Chris, because I think you just admitted to it a minute ago, is there's privilege that comes with age, experience, money, your status. What advice would you give to the younger cybersecurity professionals who may not know themselves enough to know how to keep their space the way they want, who don't necessarily have excess money to be able to quit or even pay for someone else's coffee, and those who really don't have the choice to not take calls before 10:00 AM? All of which are very excellent advice, but I just know that there's a listener out there who's in his or her twenties or thirties who says, "I can't do any of that, so what am I supposed to do?" What advice do you have for that person?

Chris Roberts: I think that's fair. Cards on the table, I'm not sitting here, if I go down in flames today work wise, I have a few months saved up, but nothing too crazy.

Jake Bernstein: We haven't even talked about that, which I actually do want to talk about the parachute money, and I actually want to talk about that specifically with respect to senior CISOs, particularly in light of some of the legal issues that have come up for CISOs. Honestly, I was going to get to that, but let's separate that.

Chris Roberts: Yeah, separate it. But even having, there's actually an interesting study that was done in the UK credit recently. Actually, so some of my parachute money I keep in cold hard cash in a drawer along with a couple of gun. But it's in a drawer and it's in an envelope, and that to me is my mental checkout money. Even if you can't have 3, 6, 12 months worth of just bug out money, at least put something in there. Even if it's only 50 bucks or 100 bucks or 20 bucks or a couple hundred bucks or whatever you can afford, put five bucks in there a week, put five bucks in there a month, put something in there. The worst case scenario, you can pay a bill. Best case scenario, you can pay your mortgage or your rent for a month and you can just say to heck with it and hunker down. To me, even just having that physically there is that mental thing.

Let's go back to the young ones. The other thing for the young ones is documentation. I write. Despite the fact I have all of my tech in front of me, I still have a journal. I don't write in it as a journal that much, but I write my notes in it. I keep it with me at night because I'll wake up at some stupid hour of the morning and I want to jot things down. I have ideas. I doodle in it. I walked it in a meeting. I'm listening to the meeting, but I'm doing my own doodles and my own pen things.

Things that people can do when they're younger is take that 30 minutes. If you have to be on calls at 7, 8, 9 in the morning, at 5 o'clock at night or at 6 o'clock at night when you down tools, that's when you get to take care of yourself. A shower typically is free or the water's paid for under your monthly bill. Go stand in the shower for 10 minutes. Go spend an extra $2 and instead buying the cheap and cheerful smelly stuff, go treat your stuff to something nice and smelly.

Jake Bernstein: And recognize that we've all been through that. When you are the older, apparently, when you have the appearance of privilege, even if you don't necessarily have all of it, we've gone through that. I think the message of this episode, and really this theme is particularly for the young people, it's normal to have tough times. Don't think that it's going to be that way forever. Don't ignore it. We're not saying ignore it, but name it, talk about it with friends. Really, if you can even just maintain the awareness of the need for self-care, you're frankly going to be a lot better off, even if you can't execute it perfectly when you just start a new job.

Chris Roberts: I think the other thing to add to this and something we're talking about, which is what I like, and Jake, back to your, "Hey, I'm 20 something, I'm trapped in a job. I don't know what the heck is going on." Guess what? You're not alone.

Jake Bernstein: Exactly.

Chris Roberts: You don't need to find people who are going to pity party you. You need people who are going to empathize. You need people who are going to sit there and go, "Hey, crappy day. Let's go get takeout Chinese and sit in the sofa and watch crappy movies. Let's go, let's get Revenge of the Tomatoes or whatever. Let's go do something. Let's just go out for a bloody walk." Walks typically are free. It's stuff like that, or you don't want to go anywhere. Let's just sit down and play a game. Let's get a board game out. Let's just sit and do hangman, crosswords, or something like that.

You know what? Somebody who knows you well enough to go or even just sit there quietly. Like Heim and I, we'll just sit there at the end of a night. It's one of the things we will do is at the end of the day for 30 minutes, we'll sit there. Typically, we'll have tea and it'll be like a good herbal cure, a good nice tea, and we'll just sit for 30 minute and not do anything. Just literally hang out and decompress with each other, and then we all go off and do our separate thing. That doesn't cost anything, and it means finding somebody that you can do that with.

Jake Bernstein: Yeah, and it's interesting that you've mentioned that. I think people used to do that a lot more often than they do these days. Ever since, I don't know, call it the eighties, it's been go nonstop, the hustle culture. I think they're starting to see more pushback on that. I think this is a great conversation to have because I think there's so much to be learned for younger people, people in the middle, kind of where I am.

Then I do want to come back to the senior decision makers, the CISOs, the vice presidents, anyone who's got to deal with that. It's this idea of FU money, which I think is a great name. A year or two ago, I would've always said, "Yeah, this is a good idea for your mental health." Now though, I feel like it's taken on a new meaning in this era of CISOs being prosecuted or sued by the SEC. I think one of the issues that every executive, but I think in some ways particularly the CIO has to deal with, is what are you going to do when you're asked to do something that you don't think is right? How are you going to respond to a situation where you may be forced to choose between your continued employment and your integrity or committing a crime, as the case may be? It can get real serious, real bad.

Quite honestly, I'm not an employment lawyer, so I wish that I knew more about it because I've had CISOs come and ask me, "What should I do?" The answer is, I'm not sure, but I do know that it is a thing, and if you have this personal financial parachute, then that will make it a lot easier for you to make the decision that you're going to be able to live with, and that frankly could keep you out of serious legal trouble. Chris, this is a whole new level of stress and need for self-care, but what are your thoughts on this particular issue in this new kind of realm that we live in?

Chris Roberts: I mean, you hit the nail on the head, which is for me, it's that ethics, morals conversation. Personally, I walked away from two companies. One couple years ago and one very recently where the integrity of what I had built was being compromised by some business and financial and fiduciary conversations that I was not comfortable with. You attempt to fix, you point out the consequences of not fixing, and then you take a step back and go, "I have appreciated my time here and good luck and go forward."

Now, the last one I did that with two months worth of FU money, and I was fortunate enough to walk into another role that is now coming, it was a six-month role that is now coming to a close, and I've had that breathing room to start building other things, but I did not walk out with 6 months worth or 12 months worth or anything. I walked out with probably a month's worth of payment, a month's worth of savings and Cobra for a period of time and was like, "I'm just going to do it my way." Some of it, you just got to have that trust and belief. Some of it is, I'm very fortunate, I have a fairly good network. Again, if somebody's younger, it goes back to now is the time to start building up those connections.

Jake Bernstein: It is. There is one fortunate thing here is that typically the more senior you are, the more senior the more your responsibilities to the point where you're more likely to be in a position of needing to use the FU money, you've at least had more opportunity to save it.

Chris Roberts: Yes.

Jake Bernstein: There's these issues that we're talking about now with respect to CISOs and more senior decision makers. Fortunately, I do think the younger folks, the newer professionals can avoid that for now.
The one thing I want to say that is, it's not legal advice because we don't give legal advice on this podcast, but it certainly is close, which is keep things in writing. As lawyers, we call it write CYA memos, CYA emails. That stands for cover your own ass. I think if there's any universal advice to give to mid-level to senior cybersecurity professionals right now, it is that. It is learn to write, learn to create a record. That's what we as lawyers would call it. You want to build the record because if you are a second guessed, if you are asked to do something that you're not comfortable with, the last thing you want to have to rely is just your word versus someone else's word. So put it in writing, send the emails, and if you're really feeling paranoid, print it out and put it in an envelope. You can put it in the envelope next to the cash and the guns.

Chris Roberts: Yes.

Jake Bernstein: I'm dead serious about the importance of putting things in writing and covering your butt.

Chris Roberts: Yeah, I can wholeheartedly agree with that one. I am very fortunate that that is a lesson I learned a long time ago, and I've kept it ever since.

Kip Boyle: Again, there's nobody telling us to do this, right? We have to have the internal fortitude, self-discipline.

Jake Bernstein: It's an initiative. It's self-discipline, it's initiative. It's also the wisdom. I mean, Chris, you just said it. You learned the lesson. I'm betting, like almost everyone who learns this lesson, you learned it the hard way, not the easy way.

Chris Roberts: Yes, absolutely. It was an expensive one, a very expensive one that still kind of haunts to this day, unfortunately. Though I just looked at something, and this comes into exactly why we're doing this. Let me just quote something. "There is no greater agony than bearing an untold story inside of you." From Maya Angelou from a long time ago. For me, this is what we're doing here, and I would encourage as many people as humanly possible to get up on stage and say, "Hey, here's what I went through from a mental standpoint, from the pitfalls, from the tripping, the bruises and everything else." Because we're all going through it, and for me, this is one of those things where this is not a standing on the sideline. This is standing up and going, "Hey..." In a small group, or as comfortable a group or something like this where you stand up and go, "Hey, we're all going through some of this. Here's what I've done. Here's what's helped me. Here's what will help others." Make your own story, make your own path.

Kip Boyle: I did that as part of a executive leadership program that I was sponsored to attend and extremely powerful. Oh my gosh, so powerful to speak your story out loud. Who are you? How did you get to be the person that you are? Why do you lead people the way that you do? Why are your values what they are? To be able to answer those questions out loud is very powerful. It's very freeing. It's very liberating. You can actually embrace who you are, the good stuff, as well as the stuff you're not all that happy about. Then you can use it as a basis for improvement if you feel like that's what you need to do.

This whole idea of knowing yourself is ancient. Absolutely ancient, goes back to the Greeks and further, and it's still relevant. It's so relevant that the Oracle in the Matrix movie told Neo, "See that sign over the door?" Know yourself. Even the Matrix movies tell you that this is important. You don't have to just listen to Kip and Chris and Jake tell you this is important.

You need to know yourself, and then I think coupled with that is this idea of neutralizing your inner critic. There are a lot of people who have a voice in their head that tells them they're idiots, they don't know what they're doing. Maybe this is imposter syndrome, possibly is wrapped up in this, but your inner monologue is going to affect greatly the way you see yourself and how compassionate you can be towards yourself. I mean, do you treat yourself the way you would treat a best friend? Why not?

Jake Bernstein: I feel like I'm obligated to say the word mindfulness, because we haven't said it yet, but get a mindfulness practice. Go figure out what that means.

Kip Boyle: You don't have to tell anybody.

Jake Bernstein: Yeah.

Kip Boyle: If it's a stigma, don't tell anybody, but do it.

Jake Bernstein: Yeah, don't tell anyone. Just go do it. All of these things, I feel like there's always room for skepticism, but if people have been thinking about this stuff for thousands of years, there's probably a good reason for it.

Kip Boyle: It's a thing.

Jake Bernstein: It's a thing.

Kip Boyle: I've absolutely stood up and told people, "This is how I grew up, and this is why I think I am who I am today, and these are the things that I've committed to improving or changing." That kind of vulnerability is scary. It's very scary when you do it for the first time.

Jake Bernstein: Kip, think about this, if you've done that-

Kip Boyle: People will appreciate you for it too.

Jake Bernstein: They will, and if you're able to do that, maybe you're also able to say the hard truths about the technical issues that a company might be going through. Maybe you're more willing to stand up and say, "Look, we have to correct this architectural vulnerability." Even though it's going to cost way too much money, and no one's going to want to listen to you in order to do it. I mean, I know it sounds sometimes that when folks like us start going off on topics like this that we've forgotten about the job and the technical stuff, but really it's all in service, all in service of it all. It's hard to separate all of that from-

Kip Boyle: I think what you're saying is there's a business case that you will be a much more competent and effective professional.

Jake Bernstein: I am saying that you will improve your cyber risk management if you are also doing self-care. How's that for a summary?

Kip Boyle: There you go. I love it.

Chris Roberts: Love it. Yeah.

Kip Boyle: Okay, so our commitment on this show is 30 to 40 minutes of consumable content. We've absolutely hit that. I know we could continue, but we probably need to wrap it up, so I'm just going to say, Chris, thank you so much for being here and for talking about the thing that we don't talk about. I hope people listening are encouraged, and if you'd like to reach out to any of us to talk more about this, we'd love to do that with you. Chris, if somebody would like to reach out to you to talk about whatever, self-care, something different, how would they do that?

Chris Roberts: Easiest way to get ahold of me is the wonderful world of LinkedIn. I'm fairly easy to find on LinkedIn, probably the best way or wandering around a conference, but LinkedIn's easier.

Kip Boyle: Okay. LinkedIn it is. Thank you. Would you want me to put your LinkedIn profile in our show notes?

Chris Roberts: Yeah, go for it.

Kip Boyle: I'll do that.

Chris Roberts: Awesome. Thank you, sir.

Kip Boyle: I'll do that. Okay. This wraps up this episode of the Cyber Risk Management Podcast. Today we talked about self-care, which is a crucial, yet seldom discussed topic. We did it with our wonderful guest, Chris Roberts. We'll see you next time.

Speaker 1: Thanks for joining us today on the Cyber Risk Management Podcast. If you need to overcome a cybersecurity hurdle that's keeping you from growing your business profitably, then please visit us at cr-map.com. Thanks for tuning in. See you next time.