Comments on: 10 Questions To Ask During An Information Security Interview http://dmiessler.com/blog/10-questions-to-ask-during-an-information-security-interview in search of intervals Tue, 18 Nov 2008 15:18:18 +0000 http://wordpress.org/?v=2.7-bleeding By: Max http://dmiessler.com/blog/10-questions-to-ask-during-an-information-security-interview#comment-223569 Max Fri, 07 Nov 2008 01:57:28 +0000 http://dmiessler.com/archives/1061#comment-223569 <p>these questions sound very basic.... for jr security position.</p> <p>what questions you would ask for pentester/sr sec analyst position?</p> <p>thanks Max</p> these questions sound very basic…. for jr security position.

what questions you would ask for pentester/sr sec analyst position?

thanks Max

]]> By: James http://dmiessler.com/blog/10-questions-to-ask-during-an-information-security-interview#comment-216643 James Sun, 19 Oct 2008 03:13:11 +0000 http://dmiessler.com/archives/1061#comment-216643 <p>You say, "As weak as the CISSP is as a security certification..."</p> <p>This cert seems to be der rigeur in the industry for any security position. Almost all the jobs I apply for say it is desirable, required, or you must get certified within 6 months of hire. Why do you have such a low opinion of it? And, if it's so weak, why do they all want you to have it?</p> You say, “As weak as the CISSP is as a security certification…”

This cert seems to be der rigeur in the industry for any security position. Almost all the jobs I apply for say it is desirable, required, or you must get certified within 6 months of hire. Why do you have such a low opinion of it? And, if it’s so weak, why do they all want you to have it?

]]> By: ash http://dmiessler.com/blog/10-questions-to-ask-during-an-information-security-interview#comment-180368 ash Tue, 26 Aug 2008 14:04:16 +0000 http://dmiessler.com/archives/1061#comment-180368 <p>Nice compilation of questions....!!</p> Nice compilation of questions….!!

]]> By: knight http://dmiessler.com/blog/10-questions-to-ask-during-an-information-security-interview#comment-160051 knight Mon, 14 Jul 2008 05:23:05 +0000 http://dmiessler.com/archives/1061#comment-160051 <p>Where are the answers to all the questions?</p> Where are the answers to all the questions?

]]> By: Define Panic Attack http://dmiessler.com/blog/10-questions-to-ask-during-an-information-security-interview#comment-129865 Define Panic Attack Fri, 21 Mar 2008 21:26:29 +0000 http://dmiessler.com/archives/1061#comment-129865 <p><strong>Define Panic Attack...</strong></p> <p>This article sounds well, but how everything is related together?...</p> Define Panic Attack…

This article sounds well, but how everything is related together?…

]]> By: Darby Weaver http://dmiessler.com/blog/10-questions-to-ask-during-an-information-security-interview#comment-23147 Darby Weaver Sat, 13 Jan 2007 10:13:41 +0000 http://dmiessler.com/archives/1061#comment-23147 <p>Hmmm...</p> <p>Interesting - I got the Compression vs. Encryption question in the terms of asking about how IPSec is handled once.</p> <p>I used to get the home computer question.</p> <p>But after I explain my home lab setup and some of the machines I keep around that run from Linux Appliances, Cobalt RAQ Appliances with CentOS and Solaris, or my Solaris Pizza Box that I installed Red Hat 6.0 on or just my run of the mill PC's with any various OS or some of my favorite tools.</p> <p>Then we have the Cisco and other vendors gear. I stop after the eyes start to glaze, unless they want to know where I get my bogon lists from or where I find my latest 0-Day Exploits from and how I have acquired so many tools of the trade...</p> <p>Hmmm...</p> <p>Well, you know...</p> <p>How are things going?</p> <p>Did you ever decide to use Cisco Gear? Get your CCNA yet?</p> <p>Are you in Orlando this week at SANS?</p> <p>Later</p> Hmmm…

Interesting - I got the Compression vs. Encryption question in the terms of asking about how IPSec is handled once.

I used to get the home computer question.

But after I explain my home lab setup and some of the machines I keep around that run from Linux Appliances, Cobalt RAQ Appliances with CentOS and Solaris, or my Solaris Pizza Box that I installed Red Hat 6.0 on or just my run of the mill PC’s with any various OS or some of my favorite tools.

Then we have the Cisco and other vendors gear. I stop after the eyes start to glaze, unless they want to know where I get my bogon lists from or where I find my latest 0-Day Exploits from and how I have acquired so many tools of the trade…

Hmmm…

Well, you know…

How are things going?

Did you ever decide to use Cisco Gear? Get your CCNA yet?

Are you in Orlando this week at SANS?

Later

]]> By: Waleed Alrodhan - Information Security Blog http://dmiessler.com/blog/10-questions-to-ask-during-an-information-security-interview#comment-22213 Waleed Alrodhan - Information Security Blog Tue, 09 Jan 2007 23:43:08 +0000 http://dmiessler.com/archives/1061#comment-22213 <p>[...] </p> [...]

]]> By: Daniel http://dmiessler.com/blog/10-questions-to-ask-during-an-information-security-interview#comment-22117 Daniel Tue, 09 Jan 2007 15:59:23 +0000 http://dmiessler.com/archives/1061#comment-22117 <p>Nice ones, Michael. For the crypto one I usually as them to describe exactly what happens when you send a message that's both signed and encrypted using PGP -- specifically relating to the cryptography. What I look for in the response is the not-so-well-known fact that the message is actually not encrypted with the other person's public key.</p> <p>...wait for it...</p> <p>Instead, the message is encrypted with a randomly generated SYMMETRIC key, and <em>that</em> key is encrypted using their public key. They then decrypt the symmetric key, and use that to read the encrypted message. Which directly illustrates the positives and negatives of both. You wouldn't want to use asymmetric cryptography to encrypt a very large message due to the time cost, so symmetric cryptography is used instead.</p> Nice ones, Michael. For the crypto one I usually as them to describe exactly what happens when you send a message that’s both signed and encrypted using PGP — specifically relating to the cryptography. What I look for in the response is the not-so-well-known fact that the message is actually not encrypted with the other person’s public key.

…wait for it…

Instead, the message is encrypted with a randomly generated SYMMETRIC key, and that key is encrypted using their public key. They then decrypt the symmetric key, and use that to read the encrypted message. Which directly illustrates the positives and negatives of both. You wouldn’t want to use asymmetric cryptography to encrypt a very large message due to the time cost, so symmetric cryptography is used instead.

]]> By: Michael S Black http://dmiessler.com/blog/10-questions-to-ask-during-an-information-security-interview#comment-22104 Michael S Black Tue, 09 Jan 2007 13:51:06 +0000 http://dmiessler.com/archives/1061#comment-22104 <p>Here is a few we use:</p> <p>Define non-repudiation and give a real world example.</p> <p>What would you do with a Rainbow Table?</p> <p>What is a downstream liability?</p> <p>What is the difference between symmetric and asymmetric cryptography?</p> Here is a few we use:

Define non-repudiation and give a real world example.

What would you do with a Rainbow Table?

What is a downstream liability?

What is the difference between symmetric and asymmetric cryptography?

]]> By: Cybercrime Law http://dmiessler.com/blog/10-questions-to-ask-during-an-information-security-interview#comment-21986 Cybercrime Law Tue, 09 Jan 2007 00:46:15 +0000 http://dmiessler.com/archives/1061#comment-21986 <p><strong>10 Questions To Ask During An Information Security Interview...</strong></p> <p>Daniel Miessler has compiled a list of 10 questions that should be asked of a candidate for a security (or even any IT position.) Although not perfect, this list should provide a good starting point for an employer trying to understand whether the cand...</p> 10 Questions To Ask During An Information Security Interview…

Daniel Miessler has compiled a list of 10 questions that should be asked of a candidate for a security (or even any IT position.) Although not perfect, this list should provide a good starting point for an employer trying to understand whether the cand…

]]> By: Philip http://dmiessler.com/blog/10-questions-to-ask-during-an-information-security-interview#comment-21932 Philip Mon, 08 Jan 2007 12:16:18 +0000 http://dmiessler.com/archives/1061#comment-21932 <p>Wow. Some of these are good. When I came to the interview for my current job, my boss had about 15 sheets of questions that are standard. I cannot remember them all now, but I was so nervous. We ended up hiring a guy who was straight out of college and has no Linux experience (he had heard of it before). It is really hurting. We have had to teach about the world all over again. He really doesn't know that much about the deep parts of Windows.</p> Wow. Some of these are good. When I came to the interview for my current job, my boss had about 15 sheets of questions that are standard. I cannot remember them all now, but I was so nervous. We ended up hiring a guy who was straight out of college and has no Linux experience (he had heard of it before). It is really hurting. We have had to teach about the world all over again. He really doesn’t know that much about the deep parts of Windows.

]]> By: Wonk http://dmiessler.com/blog/10-questions-to-ask-during-an-information-security-interview#comment-21929 Wonk Mon, 08 Jan 2007 12:09:26 +0000 http://dmiessler.com/archives/1061#comment-21929 <p>I think one could also argue for number 2 that encrypting before compressing would tend to reduce the possibility of known plaintext attacks. But, as you say, there's not any point in compressing data once it's been encrypted.</p> I think one could also argue for number 2 that encrypting before compressing would tend to reduce the possibility of known plaintext attacks. But, as you say, there’s not any point in compressing data once it’s been encrypted.

]]> By: Dave http://dmiessler.com/blog/10-questions-to-ask-during-an-information-security-interview#comment-21884 Dave Mon, 08 Jan 2007 03:10:47 +0000 http://dmiessler.com/archives/1061#comment-21884 <p>"Don’t forget that security is mostly an attitude, or actually a way of life, and only secondly knowledge."</p> <p>Well said.</p> <p>My favorite interview bonus question is "how many fire alarm levers did we pass on the way here?"</p> <p>I'd hire someone who got every technical question wrong but answered that one even in the ball park.</p> <p>-Dave</p> “Don’t forget that security is mostly an attitude, or actually a way of life, and only secondly knowledge.”

Well said.

My favorite interview bonus question is “how many fire alarm levers did we pass on the way here?”

I’d hire someone who got every technical question wrong but answered that one even in the ball park.

-Dave

]]> By: Arik http://dmiessler.com/blog/10-questions-to-ask-during-an-information-security-interview#comment-21862 Arik Mon, 08 Jan 2007 01:18:20 +0000 http://dmiessler.com/archives/1061#comment-21862 <p>I was once asked which is stronger - RSA with a 8192 bit key or AES with 128 bit key</p> <p>Don't forget that security is mostly an attitude, or actually a way of life, and only secondly knowledge.</p> <p>-- Arik</p> I was once asked which is stronger - RSA with a 8192 bit key or AES with 128 bit key

Don’t forget that security is mostly an attitude, or actually a way of life, and only secondly knowledge.

– Arik

]]>