dmiessler.com | grep understanding - Latest Comments in 25 Questions to Ask During an Information Security Interview

Re: 25 Questions to Ask During an Information Security Interview

rathinapandi — Fri, 27 Feb 2009 01:38:27 -0000

good stuff

Re: 25 Questions to Ask During an Information Security Interview

MR AKBAR — Sun, 01 Feb 2009 19:37:20 -0000

VERY NICE LIST EXCELENT:

Re: 25 Questions to Ask During an Information Security Interview

Daniel Miessler — Sun, 23 Nov 2008 17:05:59 -0000

@Curtis Thank you for that.

Re: 25 Questions to Ask During an Information Security Interview

arikb — Sun, 23 Nov 2008 16:30:15 -0000

A network analysis D&D? Ouch.

Nice list, Daniel. I think you should float all the easy questions to the top, so that you can vet the incompetent early in the process.

What I like to ask a candidate is "what are you best at? what do people come to you about when they need help?" and then drill down into the bits and bytes on that topic. That shows me if they take what they do seriously enough to have an in-depth understanding of it. Also, at some point in time my questions inevitably exceed their knowledge (I might ask about things I don't know about...) and then I expect them to tell me they don't know and will find out. If they try to BS me... NEXT!

Also as mentioned I like to ask about the bigger picture, what does it all mean from an organizational point of view.

-- Arik

Re: 25 Questions to Ask During an Information Security Interview

The Real Steve C — Fri, 21 Nov 2008 23:50:59 -0000

Nice list, lol

Re: 25 Questions to Ask During an Information Security Interview

Mark Gamache — Fri, 21 Nov 2008 12:10:03 -0000

This is great stuff! I've had to argue with seasoned security professionals about DH being subject to MITM. A great follow up on that, they they miss it, is have them whiteboard for you how it works and then watch to see how they react when you white board the key switch. If you see the light bulb go on, they may still be OK. Even professionals take the pre-established trust of a local keystore for granted.

Re: 25 Questions to Ask During an Information Security Interview

Scott — Fri, 21 Nov 2008 09:02:36 -0000

My favorite question is "Prove to me you can protect my network". Poor candidates begin speaking about technology and solutions, good candidates talk about their previous experience, and great candidates take a high level view of the issue and speak about how they will help promote change, get management on board and begin to address the true scope of this open ended question.

Re: 25 Questions to Ask During an Information Security Interview

randy — Fri, 21 Nov 2008 08:39:25 -0000

Nice list. I've weeded people out before with the ping, tracert, and http vs html questions before. Good stuff!