Most Important Frequently Asked Application Security Interview Questions
-
Question 1. Describe The Last Program Or Script That You Wrote. What Problem Did It Solve?
Answer :
All we want to see here is if the color drains from the guy’s face. If he panics then we not only know he’s not a programmer (not necessarily bad), but that he’s afraid of programming (bad). I know it’s controversial, but I think that any high-level security guy needs some programming skills. They don’t need to be a God at it, but they need to understand the concepts and at least be able to muddle through some scripting when required.
-
Answer :
We’re looking for a basic understanding of the issue of wanting to serve the front page in HTTP, while needing to present the login form via HTTPs, and how they’d recommend doing that. A key piece of the answer should center around avoidance of the MiTM threat posed by pure HTTP. Blank stares here mean that they’ve never seen or heard of this problem, which means they’re not likely to be anything near pro level.
Network Security Interview Questions -
Question 3. What Are The Various Ways To Handle Account Brute Forcing?
Answer :
Look for discussion of account lockouts, IP restrictions, fail2ban, etc.
-
Question 4. What Is Cross-site Request Forgery?
Answer :
Not knowing this is more forgivable than not knowing what XSS is, but only for junior positions. Desired answer: when an attacker gets a victim’s browser to make requests, ideally with their credentials included, without their knowing. A solid example of this is when an IMG tag points to a URL associated with an action.
Example: http://www.wisdomjobs.com/logout/. A victim just loading that page could potentially get logged out from foo.com, and their browser would have made the action, not them (since browsers load all IMG tags automatically).
Network Security Tutorial -
Question 5. How Does One Defend Against Csrf?
Answer :
Nonces required by the server for each page or each request is an accepted, albeit not foolproof, method. Again, we’re looking for recognition and basic understanding here–not a full, expert level dissertation on the subject. Adjust expectations according to the position you’re hiring for.
Computer Security Interview Questions -
Answer :
This is a fun one, as it requires them to set some ground rules. Desired answers are things like, “Did we already implement nonces?”, or, “That depends on whether we already have controls in place…” Undesired answers are things like checking referrer headers, or wild panic.
-
Question 7. What’s The Difference Between Http And Html?
Answer :
Obviously the answer is that one is the networking/application protocol and the other is the markup language, but again, the main thing you’re looking for is for him not to panic.
Computer Security Tutorial Cyber Security Interview Questions -
Question 8. How Does Http Handle State?
Answer :
It does not, of course. Not natively. Good answers are things like “cookies”, but the best answer is that cookies are a hack to make up for the fact that HTTP doesn’t do it itself.
-
Question 9. What Exactly Is Cross Site Scripting?
Answer :
You’d be amazed at how many security people don’t know even the basics of this immensely important topic. We’re looking for them to say anything regarding an attacker getting a victim to run script content (usually JavaScript) within their browser.
Information Security Analyst Interview Questions -
Question 10. What’s The Difference Between Stored And Reflected Xss?
Answer :
Stored is on a static page or pulled from a database and displayed to the user directly. Reflected comes from the user in the form of a request (usually constructed by an attacker), and then gets run in the victim’s browser when the results are returned from the site.
-
Question 11. What Are The Common Defenses Against Xss?
Answer :
Input Validation/Output Sanitization, with focus on the latter.
Topic: Application Security Interview Questions
No comments:
Post a Comment