-
Website
http://danielmiessler.com/ -
Original page
http://danielmiessler.com/blog/25-questions-to-ask-during-an-information-security-interview -
Subscribe
All Comments -
Community
-
-
Top Commenters
-
Popular Threads
Nice list. I've weeded people out before with the ping, tracert, and http vs html questions before. Good stuff!
My favorite question is "Prove to me you can protect my network". Poor candidates begin speaking about technology and solutions, good candidates talk about their previous experience, and great candidates take a high level view of the issue and speak about how they will help promote change, get management on board and begin to address the true scope of this open ended question.
This is great stuff! I've had to argue with seasoned security professionals about DH being subject to MITM. A great follow up on that, they they miss it, is have them whiteboard for you how it works and then watch to see how they react when you white board the key switch. If you see the light bulb go on, they may still be OK. Even professionals take the pre-established trust of a local keystore for granted.
Nice list, lol
Roll a d20.
A one? You don't see any connections to IP 4.2.2.2.
A network analysis D&D? Ouch.
Nice list, Daniel. I think you should float all the easy questions to the top, so that you can vet the incompetent early in the process.
What I like to ask a candidate is "what are you best at? what do people come to you about when they need help?" and then drill down into the bits and bytes on that topic. That shows me if they take what they do seriously enough to have an in-depth understanding of it. Also, at some point in time my questions inevitably exceed their knowledge (I might ask about things I don't know about...) and then I expect them to tell me they don't know and will find out. If they try to BS me... NEXT!
Also as mentioned I like to ask about the bigger picture, what does it all mean from an organizational point of view.
-- Arik
@Curtis Thank you for that.