Cyber security detection analyst interview questions
lsud00d
Member Posts: 1,571
As the title says and for those in the industry, what would be some common questions during a cyber security detection analyst interview? The responsibilities revolve around--
- Non-signature based detection of intruders (non-authorized users) and internal employees overstepping duties/permissions
- Detecting cyber security incidents
- Network and log analysis
- Penetration testing experience
- Malware analysis experience
- Knowledge of cyber crime threats
Comments
-
lsud00d
Member Posts: 1,571
I found this blog link which has a nice variation of questions...a few choice examples:
20 Questions for an Intrusion Analyst
You are given 500 pieces of straw and told that one piece is a needle which looks like straw. How would you find the needle? What other pieces of information would you like to have?
Describe a method to find an intruder using only network flow data (no content).
Describe the activity detected by the following Snort rule. What could be done to make the rule more effective? alert icmp $EXTERNAL_NET any <> $HOME_NET any (msg: “activity alert!”; sid:10000011; content:”MZ”;)
What type of encoding is used in this example: aGVsbG8gd29ybGQNCg==
Others input is still welcome, I'm sure others are curious
-
YFZblu
Member Posts: 1,462 ■■■■■■■■□□
A couple non-technical questions:
-Who do you look up to in security?
-Where do you get security-related news? -
Bill3rdshift
Member Posts: 36 ■■■□□□□□□□
A couple non-technical questions:
-Who do you look up to in security?
-Where do you get security-related news?
I always like this topic... My answer:
I look up to Bruce Schneier & Steve Gibson.
Security related news from SANS, Security Now podcast, FBI's Infragard, Tech Republic, etc.Reading: Incident Response & Disaster Recovery, Server 2008r2 Administration, IT Security Interviews Exposed
Telecom Info Page: http://telecom.tbi.net -
ChooseLife
Member Posts: 941 ■■■■■■■□□□
- cr@zy_m0nkey, rEdHaShTaG, 0xd00d, icmpppping (*)-Who do you look up to in security?
I wonder how an interviewer would react to this
*) I made these up. Any resemblance to actual persons is purely coincidental.“You don’t become great by trying to be great. You become great by wanting to do something, and then doing it so hard that you become great in the process.” (c) xkcd #896
GetCertified4Less - discounted vouchers for certs -
ChooseLife
Member Posts: 941 ■■■■■■■□□□
These are awesome!I found this blog link which has a nice variation of questions...a few choice examples:
20 Questions for an Intrusion Analyst
Would aneone be interested in taking these and turning them into "Security Analyst Question of the Day" thread? I'd love to bounces ideas around for most of them one at a time “You don’t become great by trying to be great. You become great by wanting to do something, and then doing it so hard that you become great in the process.” (c) xkcd #896
GetCertified4Less - discounted vouchers for certs -
lsud00d
Member Posts: 1,571
ChooseLife wrote: »These are awesome!
Would aneone be interested in taking these and turning them into "Security Analyst Question of the Day" thread? I'd love to bounces ideas around for most of them one at a time
What, you mean spread our awesome "Linux Question of the Day" thread to other areas of IT? Never.
FTR there's a Reddit /r/netsec thread on this, maybe we could revive it?
20 Questions for an Intrusion Analyst : netsec -
eansdad
Member Posts: 775 ■■■■□□□□□□
"You are given 500 pieces of straw and told that one piece is a needle which looks like straw. How would you find the needle? What other pieces of information would you like to have?"
I see several answers to this. What would an interviewer view as a good answer? -
YFZblu
Member Posts: 1,462 ■■■■■■■■□□
ChooseLife wrote: »These are awesome!
Would aneone be interested in taking these and turning them into "Security Analyst Question of the Day" thread? I'd love to bounces ideas around for most of them one at a time
I like this idea a lot. -
dover
Member Posts: 184 ■■■■□□□□□□
Devise a straw capture and sorting device along with a transport network of belt-driven tracks. Implement an inline needle detection system that performs heuristic scanning of straw integrity and consistency based on established metrics. Create a rule to drop identified metallic anomalies into a quarantine compartment for later analysis.
Or leave the pile of straw on the floor and let me walk over it - the needle will, no doubt, instantly shoot two inches into my foot.
Or a magnet. -
coffeeluvr
Member Posts: 734 ■■■■■□□□□□
"Something feels funny, I must be thinking too hard. - Pooh" -
badrottie
Member Posts: 116
Throw the straw into a pool of water large enough to hold it all. Agitate. The needle will sink to the bottom of the pool. Retrieve.
Corporate version: Hold a meeting with all affected stakeholders and get buy in. Write ISO 9001:2008 compliant procedure. Assign an intern to the project with the vague promise of a permanent job if they find the needle.
Social engineering version: Go to sewing store. Buy a pack of needles. Select one. Use Jedi mind powers and say to the requesting party "This is the needle that you are looking for." -
colemic
Member Posts: 1,569 ■■■■■■■□□□
I would simply figure out the common characteristics of straw (color, weight) and then sort it all to see what stands out.Working on: staying alive and staying employed -
dover
Member Posts: 184 ■■■■□□□□□□
Describe the activity detected by the following Snort rule. What could be done to make the rule more effective? alert icmp $EXTERNAL_NET any <> $HOME_NET any (msg: “activity alert!”; sid:10000011; content:”MZ”;)
Ok, this one is bothering me and I'm the first to admit there is a TON of stuff I don't know about....so someone chime in and set me straight if I'm way off.
Describe the activity detected by the following Snort rule.
The signature is set to alert on ICMP traffic that contains the 'Magic Number MZ' which presumably indicates that there is some kind of Microsoft/MSDos type exe file inside the ICMP traffic originated in either direction: outside ($External_net) in ($Home_net) or inside -> out
What could be done to make the rule more effective?
To prevent false positive alerts from ICMP traffic that contains the hex string '4d 5a' just anywhere in the packet add the within: condition to the sig specifying that the magic number hex string must be within in the first 2 bytes of the payload.
So my sig would read:
alert icmp $EXTERNAL_NET any <> $HOME_NET any (msg: "Covert ICMP EXE transfer ALERT!"; content:"MZ"; within:2; sid: 10000011; rev:1; )
Does that make sense to ANYONE besides me?
//edited to prevent end of sig from looking like a winkie-face -
GarudaMin
Member Posts: 204
The first thought that came was fire. The second though that came was 'let's get more detail'. Do we care about what happens to straw? If so, fire is out. Water will come in. Then the next question is 'how significant is straw? can we get it wet?'. Then magnet or a fan would come in. Then the question became, do we have budget to get magnet/fan? And then the main question comes. What's the significant of trying to find the needle? are you asking to know how I think/analyze things? why do we need to find the needle?....
I think that's probably how my conversation would go if someone ask me that. -
YFZblu
Member Posts: 1,462 ■■■■■■■■□□
Ok, this one is bothering me and I'm the first to admit there is a TON of stuff I don't know about....so someone chime in and set me straight if I'm way off.
Describe the activity detected by the following Snort rule.
The signature is set to alert on ICMP traffic that contains the 'Magic Number MZ' which presumably indicates that there is some kind of Microsoft/MSDos type exe file inside the ICMP traffic originated in either direction: outside ($External_net) in ($Home_net) or inside -> out
What could be done to make the rule more effective?
To prevent false positive alerts from ICMP traffic that contains the hex string '4d 5a' just anywhere in the packet add the within: condition to the sig specifying that the magic number hex string must be within in the first 2 bytes of the payload.
So my sig would read:
alert icmp $EXTERNAL_NET any <> $HOME_NET any (msg: "Covert ICMP EXE transfer ALERT!"; content:"MZ"; within:2; sid: 10000011; rev:1; )
Does that make sense to ANYONE besides me?
//edited to prevent end of sig from looking like a winkie-face
Suggestion from an infosec noob: add "This program cannot run in DOS mode" to the content piece. I recently read an article from Invincea that showed the Magic Number being altered to ".Z" - an effort to avoid detection when the Snort rule only alerts on the Magic Number matching "MZ".
Other than that, looks good to me. I think changing the description to "Covert....." as you have done is a good idea as well. -
dover
Member Posts: 184 ■■■■□□□□□□
I recently read an article from Invincea that showed the Magic Number being altered to ".Z" - an effort to avoid detection when the Snort rule only alerts on the Magic Number matching "MZ".
Nice!
Was it this one?
Invicea Link
That's a great article! I didn't see anything about the "This program cannot be run in DOS mode" - maybe I just missed it; I haven't had a chance to read the whole thing yet. -
YFZblu
Member Posts: 1,462 ■■■■■■■■□□
That's the one! Invincea was quite proud of itself for catching that malware, and I do like the writeup.
The DOS message should be in the packet text - Here is the picture from the Invincea article. It also shows the Magic Number alteration:
-
wes allen
Member Posts: 540 ■■■■■□□□□□
Bumping a bit older thread, but the liquidmatrix podcast had a good section on hiring analysts the last show. One of the tasks he sets out for potential hires is that he has a script that generates a million log entries, which have a few "interesting" logs mixed in. The interviewee has to sort and pull out the interesting data while showing their work. Automatic fail is to try to go through them one at a time.
