I work in a medium sized startup as DevOps Engineer and we need to hire a security engineer. Since I have never done it, the company asked me to create an environment where the security engineer candidate should do his tasks as part of the selection process.

I know a bit about security, but I don't know what/how to set up the environment.

The requirement that the candidate should have are

  • Penetration testing
  • AWS security practise
  • Demonstrated technical knowledge of security engineering, computer and network security, authentication and security protocols, and applied cryptography.
  • Knowledge of the JVM and best security practices
  • Broad knowledge of security toolsets, including IDS/IPS, SIEM
  • Experience in CTF contests

What do you suggest? I mean do you suggest to set up IDS, honeypot, services to break and so on. What should be the tasks that the candidate should focus more?

  • How long does the candidate have in this environment? What outcomes are you expecting in this timeframe? – schroeder Jan 11 '18 at 11:13
  • Honestly I don't know about the time. I was thinking maybe 2 hours and the outcome should , explain what he did, what he discover and produce a report about it. The timeframe can vary based on the amount of tasks assigned to the candidate. – marcodv Jan 11 '18 at 11:17
  • Why is this tagged code-review? – Tom K. Jan 11 '18 at 11:28
  • honestly I didn't know which tags are good for this questions – marcodv Jan 11 '18 at 11:37

2 possible approaches (these ones are based on whether the candidate will be "blue" - defensive security - or "red" - offensive security"):

  • Provide AWS account and then ask the candidate to create a minimal secure Java application (meaning create a linux box in AWS secure it in AWS console > linux box > how to secure it (can be even network level considerations, like TIME_WAIT sessions) > webserver > app server / java runtime > JVM security > application security > IDS/SIEM for that application and so on).
  • For a more offensive bend - create a vulnerable JAVA app (if you so insist on JAVA) or DWVA and ask him to map out the attack surface or find vulnerabilities > then move from application layer to analyzing the server, maybe ask him to break into the server using knowledge gained though application hacking (DWVA in some modes has a vulnerability where you can see all the users - you might leave one user w/ only password protected login shell). After breaking into the server ask him how he would cover his traces and how he would acomplish some goal (you need to have the goal pre-determined, like copying customer information).

This answer should give you:

  • a simple framework to think about the interview process;
  • a starting point that could be improved upon;
| improve this answer | |
  • Thanks so much mindaugas. At least now I have a starting point – marcodv Jan 11 '18 at 14:37
  • Consider accepting the answer if it was helpful. Good luck. – Mindaugas Bernatavičius Jan 11 '18 at 15:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.