Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

See Server Fault and the original test. In other words what are some good questions that an information security professional should ask of a prospective employer? These questions might also lend themselves to helping to improve an existing work environment and enable an employer to attract the best and brightest in information security.

share|improve this question
2  
wow, GREAT question! Though I think many are not familiar with this, and should clarify for them: The point of this, is that questions have to yield an immediate YES/NO answer - no complicated results, no going digging to calculate, just a straight answer that everyone should know. –  AviD Dec 5 '10 at 8:49
    
I don't think there are many yes/no questions you can ask about security. The 'how' questions would probably be a much better measure of one's skill assessment. But I'm curious to see what people will come up with beyond 'do you have logging' and 'do you roll your own crypto.' –  Marcin Dec 7 '10 at 18:38
    
@AviD thanks and thank you for the clarification. –  sdanelson Dec 9 '10 at 2:10
1  
@Marcin just to clarify this isn't a skills assessment test it is more of a maturity test. As in is a company mature in its practice of information security. –  sdanelson Dec 9 '10 at 2:20
add comment

5 Answers

One which seems to impact security teams significantly would be:

  • Do you have a CISO or equivalent sponsoring security at board level and development of security skills and expertise

Without it, teams very rapidly become disillusioned at their lack of influence and will move to organisations with a more mature outlook on security.

Also, in order to attract individuals who are looking to secure their long term career

share|improve this answer
    
+1, but the CISO would have to be both technical enough to understand the threats, and business-savvy enough to translate to risk. Hmm, I guess thats another test... –  AviD Dec 5 '10 at 8:44
    
Good point AviD - starting to see a good shift towards improving this situation, but only really in orgs where the regulator is putting serious pressure on them to get their act together. –  Rory Alsop Dec 5 '10 at 13:36
    
+1 for the sponsor at board level. –  frankodwyer Apr 19 '11 at 23:30
add comment
  • Do you have a seperate Application Security team? (as opposed to just network sec running the show)
  • Is the CISO / head of security / whatever you call him - both technical enough to understand the threats, and business-savvy enough to translate to risk
  • Is there a holistic SDL in place, with executive-, managerial-, and developer-buyin?
  • Do all employees must have relevant security training, relevant to their area of work?
  • Does any product/system/application/etc have to get security signoff before deployment, and can security stop it?
  • If/when security does stop a system from going live because of severe vulnerabilities, are they thanked or cursed by the business?
  • Are Board directors bound by corporate security policy? :)
  • Is the security department seen as a technical roadblock, or as an executive aid to managing business risk?
share|improve this answer
add comment

A few to add:

  • Do you use automated log management and analysis tools?
  • Do you segment your network?
  • Do IT Security personnel maintain any production systems? (Is there segregation of duties)
  • Do normal users have administrator rights?
share|improve this answer
1  
Particularly like the last question. –  user185 Dec 5 '10 at 11:29
add comment
  • Do you perform regular backups to more than one physical location?
  • Do you regularly test restoring from backup?
  • Do you have a risk management strategy for security issues?
  • Do you regularly educate your employees about security issues that pertain to them?
  • Do you have a security budget?
  • Are there controls, both technical and managerial, in place for sensitive data?
  • Do you stay current on security issues?
  • Do you store passwords in plain text?
  • What software do you use to protect your computers, servers, and data?
  • Do you regularly update critical software to newer versions?
  • Are password changes for all employees mandatory?
share|improve this answer
3  
I don't think the "how" questions fit in with the spirit of the Joel test. –  user185 Dec 4 '10 at 12:06
1  
There were only two as follow-up questions, but I removed them. –  VirtuosiMedia Dec 7 '10 at 8:05
add comment

In addition to those from VirtuosiMedia:

  • What is the security team accountable for and how many people are on it?
  • When were your security policies last updated?
  • Who does the security team report to?
  • What is the oldest application running in your environment?
  • Is the security team part of the compliance program? If so what types of audits are performed annually?
share|improve this answer
2  
while these are of course important details to know, the point of the Joel Test is immediate, simple YES/NO responses. –  AviD Dec 5 '10 at 8:50
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.