Information Security Interview Questions

What follows is a list of questions for use in vetting candidates for positions in Information Security. Many of the questions are designed to get the candidate to think, and to articulate that thought process in a scenario where preparation was not possible. Observing these types of responses is often as important as the actual answers.

I’ve mixed technical questions with those that are more theory and opinion-based, and they are also mixed in terms of difficulty. A number of trick questions are included, but the goal there is to expose glaring technical weakness, not to be cute. I also include with each question a few words on expected responses.

–

Where do you get your security news from?

Here I’m looking to see how in tune they are with the security community. Answers I’m looking for include syndication feeds for solid sites like liquidmatrix, packetstorm, rootsecure, secguru, astalavista, whitedust, internet storm center, etc. The exact sources don’t really matter. What does matter is that he doesn’t respond with, “I go to the CNET website.”, or, “Steve Gibson’s home page”. It’s these types of answers that will tell you he’s likely not on top of things.

If you had to both encrypt and compress data during transmission, which would you do first, and why?

If they don’t know the answer immediately it’s ok. The key is how they react. Do they panic, or do they enjoy the challenge and think through it? I was asked this question during an interview at Cisco. I told the interviewer that I didn’t know the answer but that I needed just a few seconds to figure it out. I thought out loud and within 10 seconds gave him my answer: “Compress then encrypt. If you encrypt first you’ll have nothing but random data to work with, which will destroy any potential benefit from compression.”

What’s the difference between HTTP and HTML?

Obviously the answer is that one is the networking/application protocol and the other is the markup language, but again–the main thing you’re looking for is for him not to panic.

How does HTTP handle state?

It doesn’t, of course. Not natively. Good answers are things like “cookies”, but the best answer is that cookies are a hack to make up for the fact that HTTP doesn’t do it itself.

What exactly is Cross Site Scripting?

You’d be amazed at how many security people don’t know even the basics of this immensely important topic. We’re looking for them to say anything regarding an attacker getting a victim to run script content (usually Javascript) within their browser.

What’s the difference between stored and reflected XSS?

Stored is on a static page or pulled from a database and displayed to the user directly. Reflected comes from the user in the form of a request (usually constructed by an attacker), and then gets run in the victim’s browser when the results are returned from the site.

What are the common defenses against XSS?

Input Validation/Output Sanitization, with focus on the latter.

What’s the difference between symmetric and public-key cryptography

Standard stuff here–single key vs. two keys, etc, etc.

In public-key cryptography you have a public and a private key, and you often perform both encryption and signing functions. Which key is used for which function?

You encrypt with the other person’s public key, and you sign with your own private. If they confuse the two, don’t put them in charge of your PKI project.

What kind of network do you have at home?

Good answers here are anything that shows you he’s a computer/technology/security enthusiast and not just someone looking for a paycheck. So if he’s got multiple systems running multiple operating systems you’re probably in good shape. What you don’t want to hear is, “I get enough computers when I’m at work..” I’ve yet to meet a serious security guy who doesn’t have a considerable home network.

What is Cross-Site Request Forgery?

Not knowing this is more forgivable than not knowing what XSS is, but only for junior positions. Desired answer: when an attacker gets a victim’s browser to make requests, ideally with their credentials included, without their knowing. A solid example of this is when an IMG tag points to a URL associated with an action, e.g. http://foo.com/logout/. A victim just loading that page could potentially get logged out from foo.com, and their browser would have made the action, not them (since browsers load all IMG tags automatically).

How does one defend against CSRF?

Nonces required by the server for each page or each request is an accepted, albeit not foolproof, method. Again, we’re looking for recognition and basic understanding here–not a full, expert level dissertation on the subject. Adjust expectations according to the position you’re hiring for.

What port does ping work over?

A trick question, to be sure, but an important one. If he starts throwing out port numbers you may want to immediately move to the next candidate. Hint: ICMP is a layer 3 protocol (it doesn’t work over a port) A good variation of this question is to ask whether ping uses TCP or UDP. An answer of either is a fail, as those are layer 4 protocols.

How exactly does traceroute/tracert work at the protocol level?

This is a fairly technical question but it’s an important concept to understand. It’s not natively a “security” question really, but it shows you whether or not they like to understand how things work, which is crucial for an Infosec professional. If they get it right you can lighten up and offer extra credit for the difference between Linux and Windows versions.

The key point people usually miss is that each packet that’s sent out doesn’t go to a different place. Many people think that it first sends a packet to the first hop, gets a time. Then it sends a packet to the second hop, gets a time, and keeps going until it gets done. That’s incorrect. It actually keeps sending packets to the final destination; the only change is the TTL that’s used. The extra credit is the fact that Windows uses ICMP by default while Linux uses UDP.

If you were to start a job as head engineer or CSO at a Fortune 500 company due to the previous guy being fired for incompetence, what would your priorities be? [Imagine you start on day one with no knowledge of the environment]

We don’t need a list here; we’re looking for the basics. Where is the important data? Who interacts with it? Network diagrams. Visibility touch points. Ingress and egress filtering. Previous vulnerability assessments. What’s being logged an audited? Etc. The key is to see that they could quickly prioritize, in just a few seconds, what would be the most important things to learn in an unknown situation.

As a corporate Information Security professional, what’s more important to focus on: threats or vulnerabilities?

This one is opinion-based, and we all have opinions. Focus on the quality of the argument put forth rather than whether or not they they chose the same as you, necessarily. My answer to this is that vulnerabilities should usually be the main focus since we in the corporate world usually have little control over the threats.

Another way to take that, however, is to say that the threats (in terms of vectors) will always remain the same, and that the vulnerabilities we are fixing are only the known ones. Therefore we should be applying defense-in-depth based on threat modeling in addition to just keeping ourselves up to date.

Both are true, of course; the key is to hear what they have to say on the matter.

Describe the last program or script that you wrote. What problem did it solve?

All we want to see here is if the color drains from the guy’s face. If he panics then we not only know he’s not a programmer (not necessarily bad), but that he’s afraid of programming (bad). I know it’s controversial, but I think that any high-level security guy needs some programming skills. They don’t need to be a God at it, but they need to understand the concepts and at least be able to muddle through some scripting when required.

What are Linux’s strengths and weaknesses vs. Windows?

Look for biases. Does he absolutely hate Windows and refuse to work with it? This is a sign of an immature hobbyist who will cause you problems in the future. Is he a Windows fanboy who hates Linux with a passion? If so just thank him for his time and show him out. Linux is everywhere in the security world.

What’s the difference between a threat, vulnerability, and a risk?

As weak as the CISSP is as a security certification it does teach some good concepts. Knowing basics like risk, vulnerability, threat, exposure, etc. (and being able to differentiate them) is important for a security professional. Ask as many of these as you’d like, but keep in mind that there are a few differing schools on this. Just look for solid answers that are self-consistent.

Cryptographically speaking, what is the main method of building a shared secret over a public medium?

Diffie-Hellman. And if they get that right you can follow-up with the next one.

What’s the difference between Diffie-Hellman and RSA?

Diffie-Hellman is a key-exchange protocol, and RSA is an encryption/signing protocol. If they get that far, make sure they can elaborate on the actual difference, which is that one requeres you to have key material beforehand (RSA), while the other does not (DH). Blank stares are undesirable.

What kind of attack is a standard Diffie-Hellman exchange vulnerable to?

Man-in-the-middle, as neither side is authenticated.

What’s the goal of information security within an organization?

This is a big one. What I look for is one of two approaches; the first is the über-lockdown approach, i.e. “To control access to information as much as possible, sir!” While admirable, this again shows a bit of immaturity. Not really in a bad way, just not quite what I’m looking for. A much better answer in my view is something along the lines of, “To help the organization succeed. ”This type of response shows that the individual understands that business is there to make money, and that we are there to help them do that. It is this sort of perspective that I think represents the highest level of security understanding—-a realization that security is there for the company and not the other way around.

Are open-source projects more or less secure than proprietary ones?

The answer to this question is often very telling about a given candidate. It shows 1) whether or not they know what they’re talking about in terms of development, and 2) it really illustrates the maturity of the individual (a common theme among my questions). My main goal here is to get them to show me pros and cons for each. If I just get the “many eyes” regurgitation then I’ll know he’s read Slashdot and not much else. And if I just get the “people in China can put anything in the kernel” routine then I’ll know he’s not so good at looking at the complete picture.

The ideal answer involves the size of the project, how many developers are working on it (and what their backgrounds are), and most importantly — quality control. In short, there’s no way to tell the quality of a project simply by knowing that it’s either open-source or proprietary. There are many examples of horribly insecure applications that came from both camps.

What’s the difference between encoding, encryption, and hashing?

Encoding is designed to protect the integrity of data as it crosses networks and systems, i.e. to keep its original message upon arriving, and it isn’t primarily a security function. It is easily reversible because the system for encoding is almost necessarily and by definition in wide use. Encryption is designed purely for confidentiality and is reversible only if you have the appropriate key/keys. With hashing the operation is one-way (non-reversible), and the output is of a fixed length that is usually much smaller than the input.

Who do you look up to within the field of Information Security? Why?

A standard question type. All we’re looking for here is to see if they pay attention to the industry leaders, and to possibly glean some more insight into how they approach security. If they name a bunch of hackers/criminals that’ll tell you one thing, and if they name a few of the pioneers that’ll say another. If they don’t know anyone in Security, well…consider closely what position you’re hiring them for. Hopefully it’s a junior position.

Advanced

Ok, now for some more advanced questions:

1. If I’m on my laptop, here inside my company, and I have just plugged in my network cable. How many packets must leave my NIC in order to complete a traceroute to twitter.com?
   
   The key here is that they need to factor in all layers: Ethernet, IP, DNS, ICMP/UDP, etc. And they need to consider round-trip times. What you’re looking for is a realization that this is the way to approach it, and an attempt to knock it out. A bad answer is the look of WTF on the fact of the interviewee.



2. How would you build the ultimate botnet?
   
   Answers here can vary widely; you want to see them cover the basics: encryption, DNS rotation, the use of common protocols, obscuring the heartbeat, the mechanism for providing updates, etc. Again, poor answers are things like, “I don’t make them; I stop them.”

Bonus: Scenario Role-Play

For special situations you may want to do the ultimate interview question. This is a role-played scenario, where the candidate is a consultant and you control the environment. I had one of these during an interview and it was quite valuable.

So you tell them, for example, that they’ve been called in to help a client who’s received a call from their ISP stating that one or more computers on their network have been compromised. And it’s their job to fix it. They are now at the client site and are free to talk to you as the client (interviewing them), or to ask you as the controller of the environment, e.g. “I sniff the external connection using tcpdump on port 80. Do I see any connections to IP 4.2.2.2?” And you can then say yes or no, etc.

From there they continue to troubleshooting/investigating until they solve the problem or you discontinue the exercise due to frustration or pity.

–

Feel free to contact me if you have any comments on the questions, or if you have an ideas for additions.

A Kenyan blogger found a way to get information from the crowd. Now she wants to take the idea to other parts of the world in trouble.

Ory Okolloh turned the Web into a living record of crisis and relief.

Complete Contents

Subscribe to Forbes

On a recent day in November 15,000 people were pushing up against the barbed wire outside the United Nation's mission to the Democratic Republic of Congo in Goma. They were some of the quarter-million refugees who had fled violent clashes in the Congo in the last few weeks, and they were begging for help. Their camps were destroyed, there was no food, no toilets and very little water. Militias were fighting a mere 7 miles to the northeast.

Several hundred miles away in Johannesburg, South Africa, Ory Okolloh was receiving reports from the scene verified by an NGO, and uploading them onto a public Web site. Okolloh, 31, created the site using Ushahidi, a free piece of software that quickly creates Web sites to which eyewitnesses of war and crisis in out-of-reach places can send news by e-mail or text and have it attached to a Google (nasdaq: GOOG - news - people ) map. Ushahidi grew out of a citizen journalism effort Okolloh helped lead during the deadly postelection rioting in Kenya last January. The software, still in its early days, has been deployed in South Africa to help gather stories of xenophobic attacks there in May and is now in use in the Congo.

Ushahidi is the latest effort to "crowd-source" newsgathering on unfolding crises in remote areas via e-mail and mobile phones. The idea is to get immediate attention and relief to strife zones, and fill the gap left by news organizations that have slashed their foreign bureaus. Not-for-profit Witness.org, started with help from rocker Peter Gabriel, gives cameras and editing equipment to aid workers and trains them to record any human rights abuses. Sahana, an open-source software similar to Ushahidi, was created in Sri Lanka after the tsunami of December 2004. It has been used to coordinate requests for relief efforts, track victims in camps and shelters, and coordinate volunteers in the 2005 Pakistan earthquake, the 2006 mud slide in the Philippines, the 2007 earthquake in Peru and the 2008 earthquake in China.

Ushahidi, Swahili for "testimony," has simplified the technology so that anyone can use it, and it's designed to take input from hundreds of people by cell phone or e-mail. It uses free software called FrontlineSMS that turns a laptop and a mobile phone into a text-broadcasting hub. As an SMS is sent from a hot zone, the message synchs with the Ushahidi software and shows up in a Web administrator's in-box. The Web admin can decide to send a text message back to the sender to verify the information, send out a blast alert to large numbers of people or post the information onto a Web page with location information from Google Maps (or do all three). FrontlineSMS provides phone numbers in areas where the larger SMS gateways don't operate. Okolloh hopes Ushahidi can be used to send reminder alerts to people on antiretroviral medication or warnings in regions that are at high risk for natural disasters. Some of these ideas are currently being tried in Kenya, Liberia, Madagascar, Zimbabwe, Sudan, Chad and Ethiopia, among others. Okolloh has quit her consulting job to spread Ushahidi full-time and in June received a $200,000 grant from Humanity United, a Redwood City, Calif. not-for-profit.

Ushahidi got started late last year when Okolloh went home to vote in Kenya's elections. President Mwai Kibaki's victory looked rigged, and vicious riots and looting were sweeping the country. Okolloh found herself chained to her laptop, with her baby left in the care of her family. Okolloh, a native of Kenya with a 2005 Harvard law degree, had been living in Johannesburg but kept up a blog about Kenya politics.

Fifteen hundred were killed and half a million displaced while the news went black for three days. Okolloh was getting updates from both political parties, Kenyan journalists and her own sources within Parliament. She put up her e-mail address on her blog and was flooded with information. At times she was updating her blog every few seconds.

By Jan. 2 Okolloh was running out of diapers and formula and, with supplies scarce in Nairobi, she went back to Johannesburg. In a post she asked if there were any techies willing to do a mash-up of where the violence and destruction (and any peace efforts) were taking place using Google Earth. Next thing she knew, a reader of her blog had bought her a url and donated the server space. Two fellow bloggers wrote the initial software code and within three days Ushahidi was up and running. Okolloh tried to verify information by calling back people who had texted in the news or checking against media reports. "It was very ad hoc," she says. She applied the old maxim: When in doubt, leave it out. Radio deejays started reading some of the blog on air.

The State Department called on Iran on Friday to pony up any information it has on a former FBI agent who vanished there last year.

Christine Levinson, wife of Robert Levinson, went to Tehran last year to try to learn her husband's fate.

State Department spokesman Sean McCormack urged Tehran to share "any and all information" about Robert Levinson, who disappeared from Iran's Kish Island over 19 months ago.

"The U.S. Department of State remains committed to determining Mr. Levinson's whereabouts, and returning him safely to his family that includes seven children, one grandchild and a second grandchild on the way," McCormack said in a statement.

Senior administration officials say the United States is increasing pressure on Iran to provide information on Levinson's whereabouts. Several officials have said they suspect Iranian authorities are holding Levinson in a jail inside the country.

However, they stress they have no information confirming their suspicions and have consistently voiced frustration with the lack of developments in the case.

"Some people suspect he is being held by the Iranian government, but nobody knows that for a fact, or we would be saying that," one senior State Department official said. "We all agree the Iranians are not putting forth 110 percent effort to find this man."

Levinson is a retired FBI agent from Coral Springs, Florida. After leaving the agency, his wife says, he worked as a security consultant specializing in cigarette smuggling.

Last week, Undersecretary for Political Affairs William Burns, the State Department's third-ranking official, met with Levinson's family, and earlier this fall, the State Department sent a diplomatic note to Tehran through the Swiss government, which represents the U.S. interests in Iran in the absence of an American diplomatic presence in the country.

In September, Christine Levinson flew to the United Nations in New York to ask questions about her husband.

She sought a meeting with Iranian President Mahmoud Ahmadinejad, who was at the United Nations for the U.N. General Assembly. But Ahmadinejad declined to meet with her.

Last year, she traveled to Iran to try to retrace her husband's steps. Back then, Iranian officials told her they would investigate and report back to her. She still hasn't heard a word.

The State Department and FBI have denied he was working for the government and has demanded that Iran free Levinson -- if it is holding him.

Levinson says her husband suffers from diabetes and high blood pressure and has offered a $5,000 reward for information leading to his safe return.

Last year, CNN reported that Levinson met with Dawud Salahuddin, an American fugitive who lives in Iran, shortly before his disappearance.

Salahuddin -- known in Iran as Hassan Abdulrahman -- converted to Islam and was given refuge in Iran after admitting in interviews to killing Ali Akbar Tabatabai, a former Iranian diplomat under the shah, in Maryland in 1980.

Salahuddin said he was detained by Iranian officials in plain clothes and taken away from the room he shared with Levinson to be interrogated about his Iranian passport.

When he was freed the next day, he said, he was told by officials that Levinson had returned to Dubai.

Senior administration officials have told CNN that they think Salahuddin met with Levinson, but do not believe him to be a credible source of information on Levinson's whereabouts.

McCormack said the State Department is trying to keep the public aware of the case in the hopes of finding a fresh clue about Levinson's whereabouts.

"We're always looking for ways to maybe break loose that vital piece of information or the vital lead that may help us," McCormack said.

He asked anyone with information about his case to contact the State Department or the Levinson family via their Web site.