Blog | Writing | Study | Projects | Arguments | About | Contact | SyndicationInformation Security Interview Questionswebse...
What’s the difference between symmetric and public-key cryptographyStandard stuff here’single key vs. two keys, etc, etc.I...
on: threats or vulnerabilities?This one is opinion-based, and we all have opinions. Focus on the quality of theargument pu...
shows 1) whether or not they know what they’re talking about in terms ofdevelopment, and 2) it really illustrates the matu...
And you can then say yes or no, etc.From there they continue to troubleshooting/investigating until they solve theproblem ...
An Atheist Debate Reference    Meaning is an Illusion    The Best Response to "Atheists are arrogant".    The Only Class T...
Twitter    Trickle-down (Supply Side) Economics is a Liberal Fiscal Policy | #politics    There’s Some...
AZSpot   NPRs Intelligence2   Philosophy, et cetera   Meteuphoric   Roissy in DC   Freakonomics Blog   Will Wilkinson   Th...
Upcoming SlideShare
Loading in …5

New text document


Published on

Published in: Technology
  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

New text document

  1. 1. Blog | Writing | Study | Projects | Arguments | About | Contact | SyndicationInformation Security Interview QuestionswebsecWhat follows is a list of questions for use in vetting candidates for positionsin Information Security. Many of the questions are designed to get the candidateto think, and to articulate that thought process in a scenario where preparationwas not possible. Observing these types of responses is often as important asthe actual answers.I’ve mixed technical questions with those that are more theory and opinion-based, and they are also mixed in terms of difficulty. A number of trickquestions are included, but the goal there is to expose glaring technicalweakness, not to be cute. I also include with each question a few words onexpected responses.’Where do you get your security news from?Here I’m looking to see how in tune they are with the security community.Answers I’m looking for include syndication feeds for solid sites likeliquidmatrix, packetstorm, rootsecure, secguru, astalavista, whitedust, internetstorm center, etc. The exact sources don’t really matter. What does matter isthat he doesn’t respond with, ’I go to the CNET website.’, or, ’Steve Gibson’shome page’. It’s these types of answers that will tell you he’s likely not ontop of things.If you had to both encrypt and compress data during transmission, which wouldyou do first, and why?If they don’t know the answer immediately it’s ok. The key is how they react. Dothey panic, or do they enjoy the challenge and think through it? I was askedthis question during an interview at Cisco. I told the interviewer that I didn’tknow the answer but that I needed just a few seconds to figure it out. I thoughtout loud and within 10 seconds gave him my answer: ’Compress then encrypt. Ifyou encrypt first you’ll have nothing but random data to work with, which willdestroy any potential benefit from compression.’What’s the difference between HTTP and HTML?Obviously the answer is that one is the networking/application protocol and theother is the markup language, but again’the main thing you’re looking for is forhim not to panic.How does HTTP handle state?It doesn’t, of course. Not natively. Good answers are things like ’cookies’, butthe best answer is that cookies are a hack to make up for the fact that HTTPdoesn’t do it itself.What exactly is Cross Site Scripting?You’d be amazed at how many security people don’t know even the basics of thisimmensely important topic. We’re looking for them to say anything regarding anattacker getting a victim to run script content (usually Javascript) withintheir browser.What’s the difference between stored and reflected XSS?Stored is on a static page or pulled from a database and displayed to the userdirectly. Reflected comes from the user in the form of a request (usuallyconstructed by an attacker), and then gets run in the victim’s browser when theresults are returned from the site.What are the common defenses against XSS?Input Validation/Output Sanitization, with focus on the latter.
  2. 2. What’s the difference between symmetric and public-key cryptographyStandard stuff here’single key vs. two keys, etc, etc.In public-key cryptography you have a public and a private key, and you oftenperform both encryption and signing functions. Which key is used for whichfunction?You encrypt with the other person’s public key, and you sign with your ownprivate. If they confuse the two, don’t put them in charge of your PKI project.What kind of network do you have at home?Good answers here are anything that shows you he’s acomputer/technology/security enthusiast and not just someone looking for apaycheck. So if he’s got multiple systems running multiple operating systemsyou’re probably in good shape. What you don’t want to hear is, ’I get enoughcomputers when I’m at work..’ I’ve yet to meet a serious security guy whodoesn’t have a considerable home network.What is Cross-Site Request Forgery?Not knowing this is more forgivable than not knowing what XSS is, but only forjunior positions. Desired answer: when an attacker gets a victim’s browser tomake requests, ideally with their credentials included, without their knowing. Asolid example of this is when an IMG tag points to a URL associated with anaction, e.g. A victim just loading that page couldpotentially get logged out from, and their browser would have made theaction, not them (since browsers load all IMG tags automatically).How does one defend against CSRF?Nonces required by the server for each page or each request is an accepted,albeit not foolproof, method. Again, we’re looking for recognition and basicunderstanding here’not a full, expert level dissertation on the subject. Adjustexpectations according to the position you’re hiring for.What port does ping work over?A trick question, to be sure, but an important one. If he starts throwing outport numbers you may want to immediately move to the next candidate. Hint: ICMPis a layer 3 protocol (it doesn’t work over a port) A good variation of thisquestion is to ask whether ping uses TCP or UDP. An answer of either is a fail,as those are layer 4 protocols.How exactly does traceroute/tracert work at the protocol level?This is a fairly technical question but it’s an important concept to understand.It’s not natively a ’security’ question really, but it shows you whether or notthey like to understand how things work, which is crucial for an Infosecprofessional. If they get it right you can lighten up and offer extra credit forthe difference between Linux and Windows versions.The key point people usually miss is that each packet that’s sent out doesn’t goto a different place. Many people think that it first sends a packet to thefirst hop, gets a time. Then it sends a packet to the second hop, gets a time,and keeps going until it gets done. That’s incorrect. It actually keeps sendingpackets to the final destination; the only change is the TTL that’s used. Theextra credit is the fact that Windows uses ICMP by default while Linux uses UDP.If you were to start a job as head engineer or CSO at a Fortune 500 company dueto the previous guy being fired for incompetence, what would your priorities be?[Imagine you start on day one with no knowledge of the environment]We don’t need a list here; we’re looking for the basics. Where is the importantdata? Who interacts with it? Network diagrams. Visibility touch points. Ingressand egress filtering. Previous vulnerability assessments. What’s being logged anaudited? Etc. The key is to see that they could quickly prioritize, in just afew seconds, what would be the most important things to learn in an unknownsituation.As a corporate Information Security professional, what’s more important to focus
  3. 3. on: threats or vulnerabilities?This one is opinion-based, and we all have opinions. Focus on the quality of theargument put forth rather than whether or not they they chose the same as you,necessarily. My answer to this is that vulnerabilities should usually be themain focus since we in the corporate world usually have little control over thethreats.Another way to take that, however, is to say that the threats (in terms ofvectors) will always remain the same, and that the vulnerabilities we are fixingare only the known ones. Therefore we should be applying defense-in-depth basedon threat modeling in addition to just keeping ourselves up to date.Both are true, of course; the key is to hear what they have to say on thematter.Describe the last program or script that you wrote. What problem did it solve?All we want to see here is if the color drains from the guy’s face. If he panicsthen we not only know he’s not a programmer (not necessarily bad), but that he’safraid of programming (bad). I know it’s controversial, but I think that anyhigh-level security guy needs some programming skills. They don’t need to be aGod at it, but they need to understand the concepts and at least be able tomuddle through some scripting when required.What are Linux’s strengths and weaknesses vs. Windows?Look for biases. Does he absolutely hate Windows and refuse to work with it?This is a sign of an immature hobbyist who will cause you problems in thefuture. Is he a Windows fanboy who hates Linux with a passion? If so just thankhim for his time and show him out. Linux is everywhere in the security world.What’s the difference between a threat, vulnerability, and a risk?As weak as the CISSP is as a security certification it does teach some goodconcepts. Knowing basics like risk, vulnerability, threat, exposure, etc. (andbeing able to differentiate them) is important for a security professional. Askas many of these as you’d like, but keep in mind that there are a few differingschools on this. Just look for solid answers that are self-consistent.Cryptographically speaking, what is the main method of building a shared secretover a public medium?Diffie-Hellman. And if they get that right you can follow-up with the next one.What’s the difference between Diffie-Hellman and RSA?Diffie-Hellman is a key-exchange protocol, and RSA is an encryption/signingprotocol. If they get that far, make sure they can elaborate on the actualdifference, which is that one requeres you to have key material beforehand(RSA), while the other does not (DH). Blank stares are undesirable.What kind of attack is a standard Diffie-Hellman exchange vulnerable to?Man-in-the-middle, as neither side is authenticated.What’s the goal of information security within an organization?This is a big one. What I look for is one of two approaches; the first is theüber-lockdown approach, i.e. ’To control access to information as much aspossible, sir!’ While admirable, this again shows a bit of immaturity. Notreally in a bad way, just not quite what I’m looking for. A much better answerin my view is something along the lines of, ’To help the organization succeed.’This type of response shows that the individual understands that business isthere to make money, and that we are there to help them do that. It is this sortof perspective that I think represents the highest level of securityunderstanding’-a realization that security is there for the company and not theother way around.Are open-source projects more or less secure than proprietary ones?The answer to this question is often very telling about a given candidate. It
  4. 4. shows 1) whether or not they know what they’re talking about in terms ofdevelopment, and 2) it really illustrates the maturity of the individual (acommon theme among my questions). My main goal here is to get them to show mepros and cons for each. If I just get the ’many eyes’ regurgitation then I’llknow he’s read Slashdot and not much else. And if I just get the ’people inChina can put anything in the kernel’ routine then I’ll know he’s not so good atlooking at the complete picture.The ideal answer involves the size of the project, how many developers areworking on it (and what their backgrounds are), and most importantly ’ qualitycontrol. In short, there’s no way to tell the quality of a project simply byknowing that it’s either open-source or proprietary. There are many examples ofhorribly insecure applications that came from both camps.What’s the difference between encoding, encryption, and hashing?Encoding is designed to protect the integrity of data as it crosses networks andsystems, i.e. to keep its original message upon arriving, and it isn’t primarilya security function. It is easily reversible because the system for encoding isalmost necessarily and by definition in wide use. Encryption is designed purelyfor confidentiality and is reversible only if you have the appropriate key/keys.With hashing the operation is one-way (non-reversible), and the output is of afixed length that is usually much smaller than the input.Who do you look up to within the field of Information Security? Why?A standard question type. All we’re looking for here is to see if they payattention to the industry leaders, and to possibly glean some more insight intohow they approach security. If they name a bunch of hackers/criminals that’lltell you one thing, and if they name a few of the pioneers that’ll say another.If they don’t know anyone in Security, well’consider closely what positionyou’re hiring them for. Hopefully it’s a junior position.AdvancedOk, now for some more advanced questions: If I’m on my laptop, here inside my company, and I have just plugged in mynetwork cable. How many packets must leave my NIC in order to complete atraceroute to The key here is that they need to factor in all layers: Ethernet, IP, DNS,ICMP/UDP, etc. And they need to consider round-trip times. What you’re lookingfor is a realization that this is the way to approach it, and an attempt toknock it out. A bad answer is the look of WTF on the fact of the interviewee. How would you build the ultimate botnet? Answers here can vary widely; you want to see them cover the basics:encryption, DNS rotation, the use of common protocols, obscuring the heartbeat,the mechanism for providing updates, etc. Again, poor answers are things like,’I don’t make them; I stop them.’Bonus: Scenario Role-PlayFor special situations you may want to do the ultimate interview question. Thisis a role-played scenario, where the candidate is a consultant and you controlthe environment. I had one of these during an interview and it was quitevaluable.So you tell them, for example, that they’ve been called in to help a clientwho’s received a call from their ISP stating that one or more computers on theirnetwork have been compromised. And it’s their job to fix it. They are now at theclient site and are free to talk to you as the client (interviewing them), or toask you as the controller of the environment, e.g. ’I sniff the externalconnection using tcpdump on port 80. Do I see any connections to IP’
  5. 5. And you can then say yes or no, etc.From there they continue to troubleshooting/investigating until they solve theproblem or you discontinue the exercise due to frustration or pity.’Feel free to contact me if you have any comments on the questions, or if youhave an ideas for additions.::Top A tcpdump Tutorial Tech Hiring Lessons Learned A lsof Introduction A git Primer A Security-focused HTTP Primer Vulnerability Assessment vs. Penetration Test WebAppSec Testing Resources Infosec Interview QuestionsPopular What You Learned in School About Airplane Flight Was Probably Wrong 10 Things Everyone Should Know About the Middle East The find Command The lsof Command Security and Obscurity RevisitedInformation Security / Technology My Preferred Definition of Information Security The Diffie-Hellman Protocol Differences in SYN Packets The Birthday Attack Explained Mac vs. PC Security in One Sentence A UNIX/Linux Permissions Refresher Cross Site Scripting Explained A tar Reference A Security/Obscurity Experiment Expect More Human-Based Infosec Attacks CISSPs Do Need to be Technical The Under-appreciated Danger of Password Reset Mechanisms Encoding vs. Encryption An lsof Tutorial The Nmap/Dshield Trick Using Splunk as a Syslog Server Thinking Through Subnetting Explaining Network PortsPolitics Free Will and Determinism as the Core of Political Disagreement Conservatives are Leave it to Beaver, Liberals are Star Trek Socialism and Anarchy On CFR/NWO Conspiracies The Worst Mistake People Make in Political Arguments How to Debate an IdiotPhilosophy & Religion
  6. 6. An Atheist Debate Reference Meaning is an Illusion The Best Response to "Atheists are arrogant". The Only Class That Matters Free Will: Absolute vs. Practical A Simplified Argument Against Free Will Happiness: Creation vs. Collection Want: A Disease Based in Low Self-Esteem How to See If Your Morality Comes from God Outrageous Beliefs Are Not Equal to Claims They Are False Was the Last Time Your Last? How I Became an Atheist A Letter to Religious Moderates Philosophy, Science, and Religion: Three Ways of Learning About the WorldTechnology & Science Building a Lifestream Interface Thoughts on the Future of the IT Field The Steam, Water, and Ice of Modern Communications Social Media as a Personal API Could You Prove Evolution? How to Pronounce "Linux" My Only Shot at Immortality How to Pronounce "Ubuntu" Does Acceleration Depend More on Horsepower or Torque? The Craziest Thing Youll Ever Learn about Pi How to Pronounce "OS X" How to Pronounce "Rijndael"Culture & Society Lifecasting and Society Please Submit Your Own Content to Social Media Sites The Bimbo and the Caveman Is it Wrong to Have Children? The Quality Of a Society Socialism and AnarchyMiscellaneous A Coffee PrimerArguments Evolution is True Free Will: Two-lever Argument more...Projects Content Extraction Ideas Vocabulary An Atheist Debate Reference Concepts more...Collections Quotes Jokes Grammar Movies
  7. 7. Twitter Trickle-down (Supply Side) Economics is a Liberal Fiscal Policy | #politics There’s Something to Fear in Both Obama and Romney | Worldwide Visual Flight Tracking Information | Facebook doesnt even feel like an app anymore. Its more like the nationalroad system, or the electricity grid. Its just there. The VMware site is a fustercluck. The process of upgrading from ESXi tovSphere 5 couldnt be more convoluted if they put a team on it. "If you vote against Obama because he cant get stuff done, its likesaying, This guy cant cure cancer, so Im gonna vote for cancer."What Im Reading The Quotable Hitchens Game of Thrones: Book 2 How the Mind Works Class: A Guide Through the American Status System Web Application Hackers Handbook, Second Edition Arguably (Christopher Hitchens) Lord of the Flies Lying (Sam Harris)Favorite Books and Essays The Ethics of Belief, William Clifford The America the Banana Republic Why The Future Doesnt Need Us, Bill Joy What I Believe, Bertrand Russell The Moral Landscape, Sam Harris God is Not Great, Christopher Hitchens 1984, George OrwellTop Blog Categories Politics Technology Information Security Philosophy Humor Religion Programming System Administration Education Culture Atheism Music Writing Geek Health AppleInputs Overcoming Bias The Last Psychiatrist The Big Questions Less Wrong Arts & Letters Daily Scott Adams Gene Expression
  8. 8. AZSpot NPRs Intelligence2 Philosophy, et cetera Meteuphoric Roissy in DC Freakonomics Blog Will Wilkinson The Rational Optimist Cosmic Variance Practical Ethics Barking Up the Wrong Tree Reddit* Hacker News Arts & Letters DailyDaniel Miessler | 1999-2012 | Share AlikePowered by Linode