Friday

Questions To Ask During An Information Security Interview

10 Questions to ask during an information security interview from dmiesslier.com

1. Where do you get your security news from?
2. If you had to both encrypt and compress data during transmission, which would you do first, and why?
3. What kind of computers do you run at home?
4. What port does ping work over?
5. How exactly does traceroute/tracert work?
6. Describe the last program or script that you wrote. What problem did it solve?
7. What are Linux’s strengths and weaknesses vs. Windows?
8. What’s the difference between a risk and a vulnerability?
9. What’s the goal of information security within an organization?
10. Are open-source projects more or less secure than proprietary ones?

Well, I think there are some nice questions in there. I had my share of job interviews and they didn't actually always focus on security. I think that those sort of questions should be more used in security job interviews. I also liked the quote in the end of the article: “Don’t forget that security is mostly an attitude, or actually a way of life, and only secondly knowledge.”

What questions would you ask during an interview?

Bonus (Liquidmatrix): How to prove the utility of an infosec interviewee in four questions

2 comments:

Anonymous said...

What about the dress code for an interview?
Blue jean vs. casual suit?
Is there any case in which they pose a live challenge, i.e. here is our wireless network, you have 20 mins to figure out a scheme to penetrate it?

Security4all said...

That depends on the company culture. Companies in the financial markets have a tie and suit look-and-feel. I think the age of the company and the average age of the employees plays a big role.
First impression is always the most important one so you can't do wrong with a casual suite. Once you had a look at the other employees, you 'know' the culture.
Pentesting is only one of the domains of security and wireless is a very specific one. I don't know of any Belgian companies asking for a 'live' test. You could get questions like "what is the option of nmap to do this" or "explain arp spoofing". You have to 'proof' yourself anyway in the first months. That goes both ways! ;-)