Information Security Interview Questions • Hacker News Board

Re: Information Security Interview Questions

#11

Post by hackinthebochs » Wed, Mar 19, 2014, 9:10 PM UTC

djacobs7 wrote: post #6

Is it really true that you should compress before you encrypt? IT seems to me that the encrypted message should have the same amount of "information entropy" as the original message, so it should compress equally well.

Definitely compress first. While it is true that there is the same amount of entropy before and after encryption, you'll never be able to identify it from the bitstream (otherwise your encryption is broken). Compression works by understanding statistical patterns in the process that is creating the data stream, and encoding the data based on this information to achieve a reduced stream size. An encrypted stream is generally assumed to be indistinguishable from random data, so you won't get nearly as much (if any) compression from this pseudorandom stream.

Re: Information Security Interview Questions

#12

Post by hackinthebochs » Wed, Mar 19, 2014, 9:14 PM UTC

Thaxll wrote: post #2

"Encoding is designed to protect the integrity of data as it crosses networks and systems" What?

Think of integrity as fidelity. Encoding ensures that your information can be reconstructed accurately on the other end of a communications channel (whether that be the internet, to and from the hard drive, or even just to the person standing next to you).

Re: Information Security Interview Questions

#13

Post by untaken » Wed, Mar 19, 2014, 10:20 PM UTC

aisdfuoi wrote: post #9

"How would you implement a secure login field on a high traffic website where performance is a consideration?" .... "wanting to serve the front page in HTTP, while needing to present the login form via HTTPs" Maybe. There will still be a link on the HTTP page that takes you to a HTTPS page with a login form. Someone with MITM access could alter that link. A better way would be to serve all pages via HTTPS

If "performance is a consideration", then don't encrypt everything

Re: Information Security Interview Questions

#14

Post by PeterWhittaker » Thu, Mar 20, 2014, 9:03 PM UTC

These are not IS questions, they are ITS questions. There is a very serious difference between the two.

ITS without IS governance, policy, and management is worthless. It is chasing ménaces du jour, not actually managing security.

Were I interviewing someone for a serious and senior IS role, I would start with social questions, asking them to describe what organizations they consider to be the most threatening in general and to businesses in my country and field specifically, and why.

I would describe (hypothetically, without saying so) an organization like mine (but different enough to give away little), its flaws and concerns, and ask them how they would address those flaws.

Were I to hire that senior IS person, I would let them build an IS organization, which would include an ITS component.

Without policy, governance, and management, you do not have security, you have techno farce - and your organization will remain perpetually reactive, never really knowing how secure it is, never really being able to assess risk reasonably.