5 ms·

I know a guy who interviews ops people and asks for certain details of their current employer's network security. The only answer he accepts is "no".

reikonomusha 10y ago
Is it really wrong to give architectural considerations of the security of a system? It seems like security is a problem if having a discussion about such things could lead to its compromise. However, I have no expertise in the subject so I could be wrong.
- codingdave 10y ago
  High-level discussions of how you designed your architecture is fine. But once you get into details, that gives someone enough information to start to fine-tune an attack on it. The more information they get, the better they can attack it. So, yes, in an ideal situation, you would be secure even if they did know your details, but security is never perfect. So it is wise to be conservative in sharing details.
- asperous 10y ago
  Yeah, that's Kerckhoffs' principle: > "A cryptosystem should be secure even if everything about the system, except the key, is public knowledge"
  - prodigal_erik 10y ago
    But real world systems have simple defects that can be exploited without breaking a cryptographic algorithm.
    - jasonpeacock 10y ago
      Then it's not secure. Security is about the whole system, not just the crypto algo being used. It's defense in depth, not security through obscurity.
      - prodigal_erik 10y ago
        Defense in depth is stacking several flawed defenses hoping no attacker is aware of enough flaws to get through all of them. If any of the defenses were actually secure you wouldn't need the others. But we as an industry can't yet make anything secure.
- x0x0 10y ago
  It's really dependent on precisely what those "certain details" that Erik mentions are.
- paulddraper 10y ago
  Yes, we like to have all of the secrecy condensed in secret key(s). On the other hand, there's "defense in depth" too. Just in case we made a mistake, let's not make it any easier on the hacker then we need to. Social hacking in particular (gaining access to employee, who has access to local network, which has access to server X, which connects to the database...) can be assisted by inside information.
- rgbrenner 10y ago
  Yes, it is wrong. There's no reason to disclose the security systems of your previous employer, and there's no reason for an employer to ask. Any security question that can be asked specifically about one company, can be asked and answered in a more general way. It's the difference between - "What security controls were in place at Corp?" and "What security controls would you put in place to protect X system?" The 1st version is bad, not just because it discloses security controls at the previous employer.. but also because it makes the candidate responsible for (possibly bad) security decisions that were outside of their control and/or existed before they were hired. The 2nd version gives the candidate a chance to talk generally/ideally about security.. even if the previous employer did something else.
  - Chris2048 10y ago
    > There's no reason to disclose the security systems of your previous employer But isn't it relevant what technologies you used in your most recent roles?
    - deleted 10y ago
      [deleted]
    - deleted 10y ago
      [deleted]
  - technofiend 10y ago
    So if my current employer uses SELinux heavily and I answer a question on how to fix an http server because of a missing or incorrect context your guy would say "Nope, you disclosed secrets, get lost?" Probably not. But if I give it as an example because I once had to do it for real I'm out? That's a very fine line to draw. I agree something specific to an employer could be an issue, but there are plenty of problems no employer may uniquely claim.
chrisseaton 10y ago
That sounds like a great trick until someone doesn't see that it's just a hiring game, calls him out on it and publicly accuses him and his company of abusing interviews to socially engineer information about rival companies.
gaius 10y ago
What about "air gap"?
- prodigal_erik 10y ago
  You don't want the adversary to know that common attacks are certain to fail, focusing them on more practical (physical) attacks.
Gigablah 10y ago
In that case he's got it the wrong way round. Let me put it this way: is he also going to ask about the candidate's religion, expecting the answer to be "I can't answer that"?

reikonomusha 10y ago

Is it really wrong to give architectural considerations of the security of a system? It seems like security is a problem if having a discussion about such things could lead to its compromise. However, I have no expertise in the subject so I could be wrong.

codingdave 10y ago
High-level discussions of how you designed your architecture is fine. But once you get into details, that gives someone enough information to start to fine-tune an attack on it. The more information they get, the better they can attack it. So, yes, in an ideal situation, you would be secure even if they did know your details, but security is never perfect. So it is wise to be conservative in sharing details.
asperous 10y ago
Yeah, that's Kerckhoffs' principle: > "A cryptosystem should be secure even if everything about the system, except the key, is public knowledge"
- prodigal_erik 10y ago
  But real world systems have simple defects that can be exploited without breaking a cryptographic algorithm.
  - jasonpeacock 10y ago
    Then it's not secure. Security is about the whole system, not just the crypto algo being used. It's defense in depth, not security through obscurity.
    - prodigal_erik 10y ago
      Defense in depth is stacking several flawed defenses hoping no attacker is aware of enough flaws to get through all of them. If any of the defenses were actually secure you wouldn't need the others. But we as an industry can't yet make anything secure.
x0x0 10y ago
It's really dependent on precisely what those "certain details" that Erik mentions are.
paulddraper 10y ago
Yes, we like to have all of the secrecy condensed in secret key(s). On the other hand, there's "defense in depth" too. Just in case we made a mistake, let's not make it any easier on the hacker then we need to. Social hacking in particular (gaining access to employee, who has access to local network, which has access to server X, which connects to the database...) can be assisted by inside information.
rgbrenner 10y ago
Yes, it is wrong. There's no reason to disclose the security systems of your previous employer, and there's no reason for an employer to ask. Any security question that can be asked specifically about one company, can be asked and answered in a more general way. It's the difference between - "What security controls were in place at Corp?" and "What security controls would you put in place to protect X system?" The 1st version is bad, not just because it discloses security controls at the previous employer.. but also because it makes the candidate responsible for (possibly bad) security decisions that were outside of their control and/or existed before they were hired. The 2nd version gives the candidate a chance to talk generally/ideally about security.. even if the previous employer did something else.
- Chris2048 10y ago
  > There's no reason to disclose the security systems of your previous employer But isn't it relevant what technologies you used in your most recent roles?
  - deleted 10y ago
    [deleted]
  - deleted 10y ago
    [deleted]
- technofiend 10y ago
  So if my current employer uses SELinux heavily and I answer a question on how to fix an http server because of a missing or incorrect context your guy would say "Nope, you disclosed secrets, get lost?" Probably not. But if I give it as an example because I once had to do it for real I'm out? That's a very fine line to draw. I agree something specific to an employer could be an issue, but there are plenty of problems no employer may uniquely claim.

chrisseaton 10y ago

That sounds like a great trick until someone doesn't see that it's just a hiring game, calls him out on it and publicly accuses him and his company of abusing interviews to socially engineer information about rival companies.

gaius 10y ago

What about "air gap"?

prodigal_erik 10y ago
You don't want the adversary to know that common attacks are certain to fail, focusing them on more practical (physical) attacks.

Gigablah 10y ago

In that case he's got it the wrong way round. Let me put it this way: is he also going to ask about the candidate's religion, expecting the answer to be "I can't answer that"?