Information Security, Neurodiversity, and the Midwestern Junk Drawer

SecFlux

Before my ADHD diagnosis, I thought I was just meant to ride the struggle bus forever. The stuff that should’ve come easily seemed so difficult and out of reach. Once I found some answers, everything became a bit less cluttered and more clear. The word “neurodiversity” changed everything for me.

The Junk Drawer

A diagram of a junk drawer written like a blueprint that outlines different items within the drawer.

In almost every Midwestern home in America, there is but one constant: The illusive “Junk Drawer.” This drawer almost acts like an /var/tmp/ directory – A mash-up mixtape of everything that doesn’t seem to have a place and every item is there both temporarily and permanently, simultaneously.

We often have the best intentions of cleaning out the junk drawer, but somehow we never get around to it. At some point, we accept that rummaging will be in our future and if we’re looking for that “thinga-mabobber” or that “whatcha-macallit” we know it will be patiently waiting within the confines of that drawer.

“But, what does this have to do with Information Security? Let alone neurodiversity?”

In some ways, my documents folder is similar. I have a loosely-based structure I force myself to abide by. Though, at some juncture, I fall behind and everything ends up in a top level folder, just waiting to find its place in the world. It’s there, I have it, but I find it challenging to keep up the momentum.

Frankly, there is a level of parody in how I organize things physically, digitally, and mentally. Countless things in both my personal and professional life feel like semi-organized abstractions. Much of what I did, and still do today, feels like a series of unorganized knick-knacks scattered within the confines of a single drawer.

Deploying “Human Troubleshooting”

An illustration of a brain with rubber hose arms and legs looking quite zen and content while levitating.

All too often, as technicians, engineers, and architects working in the field of Information Security, we ignore ourselves for the sake of fixing things around us. We try to approach things holistically and logically, but don’t always look inward.

That’s the troubleshooting equivalent of forgetting to ask a user, “Is it plugged in?”

Our mental health and emotional well-being aren’t secondary concerns. We’re people first and professionals second.

Sometimes, others may see us as “tools” or a means to an end. Many onlookers perceive our jobs as something that just happens or that we “wave a magic wand” to fix things. We are both the janitor and the mop, the artist and the brush. And, like an artist, our final result is all that is seen, as opposed to the education, thought processes, imagination, and hours of work that went into producing an attractive piece of art. There’s a certain duality to our role that is often overlooked which leads us to quietly tackling struggles both internally and externally.

Externally, we battle perceptions and are constantly at odds in terms of proving our worth. We may act as a subject matter expert, point of contact, or technical resource for our coworkers, clients, colleagues, friends, and family. It becomes an expectation at some point. Which, ultimately, may cause us to constantly seek that validation so we can feel better about ourselves and what we do, despite what we’re dealing with on the inside. And, even sometimes, that’s just the nature of our jobs. It could be that we’re not given time or the bandwidth to focus on ourselves because of the many hats we wear.

The interesting thing is, we are always solving problems for everyone else, but what about ourselves?

Should our approach for how we solve our inner turmoil be so different than how we solve any other problem we come across?

The shortest answer is no.

Much like any technical scenario we encounter, we must first have an awareness of the issue, understand the scope of the problem, then troubleshoot and ask for help where needed. We should treat ourselves with the same diligence and respect we would with anything else. Most importantly, we should try to come to a resolution, or at the very least, periodically check in with ourselves to gauge how we’re feeling.

Impostor Syndrome, Anyone?

An image from Plexus that outlines impostor syndrome through a diagram format.

Asking for help can be hard to do. Particularly when you are in a position where you are the designated “helper.” For some, this means admitting you don’t know something. For others, it’s an opportunity for further learning.

The majority of infosec professionals I know, myself included, echo sentiments of having “Impostor Syndrome.” It’s so agonizingly common for me to hear someone I laud as the epitome of intelligence define themselves as fraudulent. This is extremely true of other women and other neurodivergent people I’ve encountered.

Why is this so common?

As mentioned above, individuals that work in this field not only feel stretched thin, but they also understand that there is always more that they don’t know. I call this phenomenon “The Black Hole Effect.”

Do you ever remember watching a cartoon where the characters are exploring space, only to come across a black hole? And, when they’re sucked in, they’re stretched in a way that makes them exist in two places at once?

With this type of work, it’s incredibly easy to feel overwhelmed by the learning curve and workload that comes with the territory. No matter how good they feel about what they do, there is always something lurking around the corner, waiting to invalidate their confidence.

When we’re always expected to have the answers or solve unique problems in a limited amount of time, our ability to take care of ourselves can become increasingly strenuous. When we solve a problem, we get a short rush of serotonin and convince ourselves to move on to the next thing.

A part photograph, part illustration of a man being overwhelmed by people shouting demands through cartoon megaphones.

But, adding more stress doesn’t decrease our current stress levels.

Just like how adding more objects to your junk drawer doesn’t make you inherently more organized, adding unnecessary objectives or inundating yourself with tasks doesn’t necessarily make you “better” at your job.

In another recent blog, I addressed the prevalence and contributing factors of burnout. Within the post, I mentioned how intersecting factors such as Autism and ADHD can drastically increase the risk of burnout. As someone who deals with those specific circumstances, I felt that it was important to directly call it out.

How I Managed in the “Before Times”

An image of dinosaurs in all their feathered glory.

When I took a step back and looked at my own situation from a high level, I began to realize patterns in my own behavior. Most people looked at my work and said, “Wow! This is really put together and organized!” but they never saw what it took to get there. They never knew how much time, work, and energy I had to put in to make those things happen. Little did they know I grappled with attention issues, poor time management skills, executive dysfunction, forgetfulness, and a litany of other symptoms.

A few years ago, I was sharing my screen with a colleague and they happened to notice how detailed my notes in my One Note application were. To put it plainly, my One Note used to look as if a technical manual and a daily planner went on a date, both got food poisoning, and accidentally vomited in the same trashcan. It was a literal mind dump of everything I felt I had to remember, but might forget.

Back then, I took extensive notes during meetings, trainings, calls, and the like. I’d even been referred to as “The Scribe” and “The Rain Man of Notes.” Again, I didn’t do this because I wanted to have an encyclopedic knowledge of the things I’d done- I did it because I felt like I had to.

And, this conditioning happened for a few reasons. I felt as though I had to:

  1. Create a sense of organization where one did not exist: Making lists or tracking documentation have always been ways for me to physically see what I have accomplished and what I have yet to cover. Since that information wasn’t always readily available in my mind, I found a way to externally index what mattered to me.
  2. Have accurate reference material because sometimes, I’d just forget:  Holding on to previous conversations and saving notes helped me to better build an understanding of how I could identify recurring issues to help myself and others.
  3. Find a way to deal with micro-management: In the past, even though I did a lot of work, I still encountered managers that would say things like, “Yeah, that’s great, but you have nothing to show for it.” Some even wanted to know what I was doing down to 5-10 minute increments. In order to adhere to those unrealistic demands, I shifted my note taking abilities to convey how much I was actually doing in a way that was quantifiable.
  4. Sooth my own anxieties: A great deal of my anxiety originates from the unknown. I struggled (and sometimes still struggle) to feel confident when I’m unsure about something. Having a paper trail of success helps me feel more sure I can handle what’s to come.
  5. Mask my ADHD symptoms (Even before I knew what that meant): At some point, I realized my note taking and document dumps were crutches and way to withstand my inability to pay attention. Sometimes, I would sit at my desk, listening to a meeting, only to hear the Charlie Brown, “Wah wah wah wah” coming from the other end, unable to make sense of it.

So, a lot of my earlier habits derived from a sensation of continuously feeling over encumbered. Everyone else was running, moving freely. Here I was feeling stuck in the dirt while no one noticed.

A screenshot from the game Fallout with the caption "You are overencumbered and cannot run!"

When I started talking to others about what I was experiencing, some “got it” while others didn’t. Every person that “got it” either had ADHD, Autism, something similar, or both.

My ADHD Diagnosis

An illustration of a brain depicting the "right brain" / "left brain" paradigm.

“How did you figure out you had ADHD as an adult?”

I get asked about this a lot.

I wasn’t diagnosed as a child. Though, looking back, it was very obvious this is something I’ve had my entire life. Even when I told my mom about it, she responded with a resounding, “Huh, yeah. That totally makes sense!”

In 2019, I started seeing a therapist. Originally, I wanted to engage in therapy to work through my Complex Post Traumatic Stress Disorder (C-PTSD) symptoms.

The more I read about the condition, the more overlap I began to notice when it came to certain coping mechanisms or problems I’d encountered throughout my life. If ADHD was a compliance framework, I’d definitely check all the boxes and pass with flying colors. Again, and again, and again, I kept running into ADHD as if I were stepping on a rake.

As these things began to come to light, I discussed them with my therapist. She recommended I seek a psychiatrist that could do a full range of testing to get an answer. This way, we could adequately confirm or deny my suspicions. So, I did just that.

The testing was pretty overwhelming and intense. I did a series of surveys, assessments, and tests of all kinds. The whole process took somewhere between 4-5 hours to complete.

Keep in mind, this is not the only way to get a diagnosis. If you feel you might have ADHD, this is one of many ways to possibly confirm a diagnosis. There is no one way to do it, and in order to get diagnosed, you have to display several of the symptoms. Not just one or two.

At the end of the session, I received a readout that contained the psychiatrist’s conclusions matched with resources, further reading, and possible medications I could be prescribed to help ease the symptoms. I was prescribed Adderall, then subsequently Focalin, to combat my more prevalent and troubling symptoms.

Neurodiverse Just Means Different

Graphic art of faceless people with different shapes, colors, and imagery to represent the diversity of thought.

As you may have already guessed, for the longest time, I didn’t realize I was what is considered “neurodiverse.” I thought my quirks and my anxieties to be “nothing special.” I figured my complications and the flaming hoops I had to jump through just to get through my day were a normal part of Information Security. As time went on, I noticed how much energy it took me to focus on basic things that seemed to come naturally to others. And, I don’t know about you, but I became tired of the burnt hair smell that came with jumping through those flaming hoops day in and day out.

The “Spoon Theory” was something I stumbled on while browsing Reddit one day. The author, Christine Miserandino, used her website, “But You Don’t Look Sick“, to describe what it’s like to live with an invisible illness.

Several spoons of various types lined up against a white background.

The “Spoon Theory” is a metaphor that helps conceptualize the amount of mental or physical energy a person has for daily activities and tasks. Certain tasks cost more “spoons” than others and the amount of spoons you have to give can vary day by day. People with ADHD, Autism, and other social or thinking differences also seemed to attach to the idea.

Personally, I was elated to discover this because it helped me articulate how it feels to do certain tasks. Only, in my case, I feel like when I need a spoon, I’m given a spatula right out of the junk drawer. My energy levels tend to be all over the place. One second, I’m working on writing a white paper and feeling really useful, and the next I may be wondering how I’m going to make it until Friday.

This is significant because most neurotypical people see certain activities as an expectation of themselves and may feel inclined to categorize others who can’t do the same as unmotivated or lazy. Or, perhaps they see the extra effort that a neurodiverse person takes to compensate as pointless or annoying. Basically, to them, any deviation from the “norm” can come across as undesirable or superfluous due to a fundamental lack of understanding.

How It All Comes Together

A picture of a 100 sided dice.

Working in Information Security can occasionally feel like rolling a Zocchihedron for a neurodiverse person. Things are constantly changing and initiatives don’t seem to stay consistent, for the most part.

For a great deal of us, the “best” solution is to mask our differences and hope that things organically work out for the better. I put quotes around best because we all know that is, in fact, not at all the best way to go about things. Masking isn’t a longterm or scalable solution.

Periodically, consistently relying on masking can lead to dissociation, where someone feels as if their lived experiences are being seen from a second-hand account or that their life is running on auto-pilot. (Think of the movie “Click” where Adam Sandler is granted a magical remote that allows himself to sort of skip over the less desirable details of his life.)

In order for us to feel in control of our situations, and to exist as we are and as who we are, we have to find a balance, establish boundaries, and ask for reasonable accommodations.

Easy, right?

Eh, not always.

You could say, “If all of this is so hard, why don’t you just quit?”

That’s not the point.

Like many others, I really love doing what I do despite the mountains I have to scale. I love the feeling of accomplishment, the learning, and the people I meet. I love understanding things on a visceral level and applying that knowledge to support and interact with others. I love sitting at my desk, researching something to finally have my “Euerka!” moment.

It appears to me that tons of neurodiverse people love working on computers because they’re built from logical processes, have many facets of interest, and, most importantly, computers don’t care who is working on them: They’ll still provide the same output, regardless of who is at the helm of the ship. Troubleshooting the issues they present can feel like a puzzle waiting to be solved. Such challenges can feel invigorating.

In fact, I would argue that my passion, intensity, and desire to get into the weeds is likely a byproduct of my ADHD. During a previous interview for CyberWire’s Career Notes Podcast, I referred to my ADHD as both “my superpower and my kryptonite.” Because, to me, that’s how it can feel. Somedays I can’t even get out of bed, let alone focus. While others, I feel like I have the focus and ingenuity of a comic book super hero.

Asking for Accommodations

A screenshot of a Final Fantasy IX random battle.

When it boils down to it, the fault doesn’t lie on the individual when it comes to the perceived normalcy within our industry. Rather, we’re shoehorned into these situations that are unnatural to how we are meant to operate. Chiefly, for those of us that already grapple with what’s considered “normal.”

For those who are uncertain whether or not they are neurodivergent, talk to your primary care physician, psychologist, psychiatrist, or therapist to find answers.

If you already have a diagnosis or are well aware of your circumstances, you probably also know how hard it can be to manage everything on top of the hand you’ve been dealt.

As far as work is concerned, it can feel intimidating to ask for accommodations. Since this can look different for everyone, I recommend using this comprehensive guide on the different considerations you can make when asking for accommodations. Make sure you’re well aware of your rights and you understand the nuances involved in the process.

If you’re a job seeker and wondering whether or not you should disclose that you have ADHD, Autism, or any other condition that exists under the umbrella of qualified disabilities, that’s entirely up to you. It’s a highly personal choice that has no guaranteed outcomes. Most guidance will suggest it’s advisable to disclose, however, a 2022 report from the Bureau of Labor Statistics revealed “Across all age groups, persons with a disability were much less likely to be employed than those with no disability.”

The thing is, even though discrimination is illegal, it can be infinitely hard to prove if or when it occurs. When I apply somewhere, I choose the “I prefer not to disclose” option. At some point, depending on the culture and atmosphere of the place I’m employed at, I might disclose my status at a later time. Which, may or may not involve requesting accommodations- It all depends on what is asked of me.

Much of what we deal with seems like fighting a series of random battles with a mini boss just around the corner. There are processes in place that aim to make things better, but we often don’t have much control over the outcomes. Over and over again, we’re made to pick and choose whether we stand and fight, make a run for it, or sit in silence.

The Takeaway

Searching for answers was one of the most equally treacherous and rewarding things I’ve done for myself. In some ways, everything feels harder because I now have such an intense awareness of my shortcomings. But, at the same time, I know that’s not completely true, even if it seems like it. When I look back and see how far I’ve come, it feels good to know all the hurdles I’ve overcome. It’s even better knowing that I can pinpoint the how and why behind them, which inevitably helps me in moving forward instead of constantly spinning my wheels.

If you were to ask me what the biggest takeaway is from my experiences, I would say that prioritizing yourself is of the utmost importance. The longer you leave yourself in a constant state of disarray, the harder it will be to get out of it. This also includes being kind to yourself and learning to accept the things you cannot control, while methodically working on the things you can. Albeit, little by little, piece by piece.

Take the time to acknowledge what you’re doing, where you’re at, and how you feel. Gather your thoughts, and plot a course for yourself. If you stumble backward, that’s fine. Those moments can and will happen. Forgive yourself. Progress isn’t linear.

And, while you’re at it, organize that junk drawer. You’ll be glad you did.

A very organized drawer.

Your Home Page for Information Security News