Re: Questions when interviewing new people

Eric Murray wrote:

> I've been using a similar question for the last 5 or 6 years.
> 
> I treat it as two parts-- a general security design part where the
> candidate tells me about the threats to the system, and a specific design
> part where they tell me specifically how they'd solve it (alice sends
> bob xyz encrypted in algorithm pdq, etc).

Could you mail me (or the list) some examples of the things you ask?

You assume that the candidate knows a little cryptography, but the idea 
is good.
I would change the questions in relation to what profile I was looking for.

My problem is that I can easily find software arquitects but it is VERY 
hard to find software architects or programmers that know just a little 
bit of security, not to talk about cryptography, most of the people I 
have interviewed doesn't know the difference between symmetric and 
asymmetic cryptography. So its my job to train them if they prove to be 
skilled enough to start working :o)

I would like them to tune in on the right track at the job interview to 
better evaluate their skills.

I like your approach where the candidate has to do a threat analysis and 
then a specific solution to a problem. I just don't know if I would be 
able to find people who could pass the second test.

I would ask them to do a code review or something after the threat 
analysis.

Mads