RE: Interview Questions

["BARRETT,WILL" <BARRETW () airproducts com>]

To avoid misunderstanding, let me clarify slightly as to what I was
trying to say.  

I was replying to the post that said that one should go to Test King to
compile questions.  Why on earth would you want to do this?  You KNOW
they can pass test questions.  What you want is to know if they can pass
the real world.  

Having been on both sides of this situation I understand the need to
qualify the person you are hiring.  What I disagree with is using
questions from practice exams to do it.  As an interviewer it has
absolutely no use to me, since if they have already passed the exam the
question comes from and will in all likelihood be able to answer the
question from rote memory, if nothing else, without understanding the
reasoning as to WHY the answer is correct.

Obviously you have this same problem.  

As an interviewee, asking me these test questions says one thing loud
and clear and that is, "As an organization we have no idea what we are
looking for so we are going to hire the cheapest person we can get that
can pass the same exam twice."

In my opinion, using real-world scenarios to create questions to test a
individuals true knowledge will get you farther than asking a series of
test questions.  This will allow you to easily tell the difference
between the guy who knows his stuff, certified or not, and the "paper"
applicant.

-WTB 

-----Original Message-----
From: Keith T. Morgan [mailto:keith.morgan () terradon com] 
Sent: Thursday, August 24, 2006 2:01 AM
To: security-basics () securityfocus com
Subject: RE: Interview Questions

<rant>
I personally could care less if a candidate is "insulted" by having to
demonstrate understanding of specific technology in an interview.  If he
has "checkpoint firewalls" on a resume, I expect him to be able to
provide me some details about checkpoint firewalls.  If he has
"extensive cisco experience" on his resume, you can bet I'm going to be
asking him to write me a quick ingress/egress ACL during the interview
process.

We get yahoos that come in the door boasting so many certifications
it'll make an HR director have an orgasm.  Then where the rubber hits
the highway, we find those certifications don't mean a thing.  Lots of
certified people out there are very good at taking certification tests.

To prove this point, about six months ago I had five MCSEs and two CCNAs
walk into my office boasting extensive networking experience.  None of
them could subnet a network.  Out of twenty candidates I interviewed for
the position, all of which boasted networking experience, exactly two
understood subnetting and could convert a CIDR block to a network mask.
Neither of those had any certifications at all.  One was an experienced
network engineer, the other was a guy fresh out of college who had spent
his time running the school's networks while his buddies were out
partying.

This has been a hot button issue with me.  I've had my time wasted by so
many candidates that the first thing I do after interview introductions
is start grilling them on specific technologies they've listed on their
resumes.  This sorts out the people who have greatly exaggerated their
experience level with various technologies and systems.  It's that
exaggeration of skill and experience that drives me nuts.  I don't care
if candidates don't have a decade of experience with some technology we
use here.  But if you don't have the experience, don't put it on your
resume. At least not on a resume you're going to send to me.  I will
call BS and "thank you very much for your time" and send you on your
way.

</rant>

Now back to the subject at hand.

What I've found works, is a compromise between very specific technical
questions, and then more general questions such as the one mentioned by
another poster.  I hit 'em with a tech quiz, then follow it up with the
"we're planning on deploying ....... and security is a huge concern with
this project, as such what suggestions would you have for ...... and how
would you approach ......"

But that comes after I determine if their resume is full of lies and
exaggerations.

We've had great hiring success with this mixed approach. 

> -----Original Message-----
> From: BARRETT,WILL [mailto:BARRETW () airproducts com]
> Sent: Wednesday, August 23, 2006 5:15 AM
> To: revnic () gmail com; security-basics () securityfocus com
> Subject: RE: Interview Questions
>
> If you are going to do that why bother?  Chances are pretty good that 
> the person you are interviewing has already passed certification so
why
> ask them again?  Personally I find this kind of interview insulting
and
> it definitely indicates that the company either doesn't know about 
> security, or more likely doesn't care enough about it to make it worth

> my while to work there.  Bad interview techniques = bad hire = bad 
> security.

<snip>
************************************************************************
**********************
IMPORTANT: The contents of this email and any attachments are
confidential. They are intended for the named recipient(s) only.
If you have received this email in error, please notify the system
manager or the sender immediately and do not disclose the contents to
anyone or make copies thereof.
*** eSafe scanned this email for viruses, vandals, and malicious
content. ***
************************************************************************
**********************


------------------------------------------------------------------------
---
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The NSA has
designated Norwich University a center of Academic Excellence in
Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting
experience. 
Using interactive e-Learning technology, you can earn this esteemed
degree, without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
------------------------------------------------------------------------
---


---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------