I have been a fan of Craig Ball ever since I met him in a forensic course years ago. I was so impressed with Craig, that I was honored that he agreed to write the foreword of a book that Eric Zimmerman and I wrote. It stands to figure that I have followed his blog for many years because I learn something every time he writes something.

Well….

His latest blog post was more than I typically expected, and I had to read it several times because Craig bared his soul with something that every single one of us would be fortunate enough to experience.  I tried to search for another way to say, “bared his soul” because that is what Craig said in his post. However, there is no other description that fits better, because that is what he did.

https://craigball.net/2019/09/09/who-am-i-if-im-not-that-guy-anymore/

I’ll let you read Craig’s blog post before reading further, and you should read it regardless of what point of your DFIR/infosec/ediscovery career point you currently sitting.  Then come back for my thoughts on the “Five Stages of Grief in a DFIR Career”.

Welcome back*

You may have already read a Swiss psychiatrist’s model detailed in a book, On Death and Dying. I’ve used that book on many occasions as a reference for teaching response to traumatic experiences to others and as a tool for coping with my own traumatic incidents. *I know you didn't read Craig's post and kept reading, but seriously, read his post.

https://www.psycom.net/depression.central.grief.html

The above visual describes the grief cycle succinctly. No need for me to add to it to describe it. But then again, I’ve done a lot of personal and professional research as well as teaching on the topic in a past career. I recommend digging further into it if this is the first time that you have seen this.

In my own life, I have gone through this grief cycle many times. Sometimes, it has taken me years to complete, and other times, seconds. Many of us are going through this now, and if not now, we will at some point in our lives. Police officers, especially those forced into deadly force incidents, will go through the entire cycle in a few seconds during an encounter and can spend years going through it after a deadly force encounter, regardless if deadly force was applied. They tend to go through this cycle a lot...same with those in combat.

Bringing this back around to you and your DFIR career

Since you read Craig’s post, you saw where it sounds that he feels his relevance has faded into a crisis of lost confidence.  If you didn’t read the post yet, do not fret; there’s a party at the end. 

This is where I see a direct resemblance to the grief cycle and a DFIR career, at least to where we will eventually feel that our relevance waned. Perhaps it will. Probably it will not.  Certainly, that which we did good, especially good for others, will never wane. The good that we did selfishly for ourselves will be forgotten faster than a long-tailed cat in a room full of rocking chairs. But the good for others is another story.

Go to work for money. Then you can do for yourself what you couldn't do before and do for others what they cannot do for themselves.

That’s what I tell my kids. Do your job, but do not be your job. The job didn’t miss you before you got there, and it won’t miss you when you are gone. But the job can help you to make this a better place by being a positive force on others.

<I’m getting to the point on the DFIR Career Grief Cycle, so bear with me>

When you create a ripple of positive change in a person’s life, you also spark a chain reaction of a tidal wave of good far past what you will ever have the fortune to see. The difference in a newcomer doing well or failing is in direct relation to your interaction with the newcomer.  Their failure or success in this field is directly tied to you. This is the point to know that the DFIR Career Grief Cycle is not a negative, but a positive in your career growth if you do it right. 

My suggestion is to push through the DFIR Career Grief Cycle as quickly as possible when it comes. Don’t be stuck at Anger, because you’ll be that ‘grumpy old person’.  And try to fly through Depression by knowing you are almost done with the cycle. Acceptance doesn’t mean the end. It means that your path has evolved, as it will for all of us, if all of us are lucky enough. The DFIR Career Grief Cycle is simply an evolution from doer to mentor or role model. Or maybe a not-so-subtle hint to move to a different job or position with a more instrumental role because your experience is incredible.

Our goal should be to be able to look back at the seeds that we planted, the good that we did, the bad that we prevented, and the positive guidance that we gave newcomers for them to grow.

We live our lives day-to-day knowing that tomorrow will never come, and that we have plenty of time to do something good for someone else tomorrow. When we accept that every new morning means that we have one less morning when we will not wake, then we can focus on what matters at home (and at work to make someone else’s life better). You have a fixed number of sunsets. A fixed number of sunrises. A fixed number of days to make a difference. Don't make the DFIR Career Cycle a Grief be one of regret, but one of satisfaction.

Craig Ball has nothing to worry about in regard to imposter syndrome, crisis of confidence, or whether or not he made a difference. I have followed his career for more than a decade. He has made a difference across the board in the forensics and electronic discovery fields as well as in the careers of many. We will all do better if we do better by others; then the grief cycle will not be feared as much as it will be welcomed.