That title is tongue-in-cheek. It is possibly the one universal truth that I’ve learned in my time working and communicating with members of InfoSec; everyone has bouts of imposter syndrome. The number of people that I revere and have the fortune to talk with, all admit to having their moments. And not just their moments when they were starting out or new to the field themselves, no, but to experiencing it all thorughout their careers. So if we all experience it, and we all acknowledge having feelings of it, why is it so much harder for some of us than others?
I admit to feeling like an imposter; a feeling I have often. It was strong in the beginning, when I was first starting out, but I couldn’t figure out why it continued as time went on and I gained more experience. There were conversations I would have with other professionals and they would acknowledge what I said, agree with the point, or engage in debate from a point of intellectual debate, not demeaning or dismissive. So if all that is true, why feel like an imposter?
In my case, and I don’t think I’m alone in this, I tend to compare myself to others in a way that’s unrealistic and unfair to myself. A prime example is how I’ll compare myself to other, well-known members of our InfoSec community. Specifically, I would compare my knowledge to those that were posting about exploit review, reverse engineering, and coding they wrote; more specifically, about how they would do a “hack.” That’s not my world. I haven’t really started the how-to’s of exploiting vulnerabilities, don’t write scripts, have no background as a programmer, so why would I compare myself to those?
Part of the issue, I think, is that that’s what we see a lot of and that’s where the “glory” is. Not to say the rest of us don’t qualify, but it doesn’t have that cache. They don’t make movies or television shows about those of us that formulate and advise on policy, implement standards, develop training and awareness programs. You can’t write an exciting scene, where the premise is whether ownership supports the policy decision you’re recommending and HR agrees to help implement it into the handbook and a section of the review. I’ve been a party to many policy drafts, planning the policies, discussion of the drafts, and gaining approval. Riveting entertainment, it is not.
The other issue is mistaking people in my age bracket as “peers.” I’m very close in age to most of the giants in the industry. It makes sense, we’re the generation that grew up with computers when they were first finally able to come into homes. But here’s the thing, I didn’t start playing with them, joining messaging boards, or any of the usual activity we hear that so many other have in their past. So while we’re the same age, some of us have been in the industry for the “same” number of years, they have twice as much system experience as I do. They may have only started making a living at it over the last decade plus, but they’ve been doing the technical component since they were children, some eight years old or younger. The same holds true when looking at someone younger that seems to have accomplished more. How can that be, I’m almost twice their age? Yeah, but they started on computers when they were five, wrote code and hacks all day in middle school, so they have twice the years of experience.
So I have to remind myself. It’s not imposter syndrome, it’s poor comparisons that trigger it. Michael Jordan is considered the greatest of all time at basketball. That’s practically undisputed. People who aren’t basketball or sports fans know of him and have an idea of how good he was. His baseball career is less glorious and far more pedestrian. Here was the greatest at his sport, not able to beat out or compete at the same level as those who were just very good at a different sport. Why? Practice, routine, and time. MJ didn’t have that. He was older than those he played with and against, but he had stopped playing baseball for over a decade. He wasn’t as sharp, his ability not as honed.
I’m not saying that imposter syndrome is false and we should acknowledge it and no one suffer from it anymore. That’s ridiculous, it is real, and we all suffer from it. I think it’s important to have some idea where it comes from in us. If you know where, it’ll make it a little easier to get over it that time. Not easier for the next, but hopefully, it’ll keep each time from being as crippling.