Hiring pentesters - http://blog.pentesterlab.com

Hiring the right people is becoming harder and harder. I decided to share some tips and feedback based on few years of reading resumes and interviewing people.

I don't think you can really have an equation to rate the right person, I think it's more like a list of things I like or dislike in a resume.

In my opinion, the best hiring process follows the following steps (for the technical side of it):

• Review resume.
• Technical interview.
• Hands-on interview.
• Drinks.

In this first post, I'm going to provide more details on how I review a resume and what affect my decision.

Pre-processing:

• Resume looks ugly: -1
• Obvious spelling mistakes in the resume: -3 (native speakers), -1 (others)
• Resume sent by a recruiter: +/- 5, some recruiters can take a resume and make it looks terrible or can make it look better...
• Buzzwords in the resume: -3
• Hotmail address: -3 ("Excuse me, are you from the past?")
• Own domain name: +2, with own SMTP server: +3
• Number of occurrence of the word "hack" in the resume: -1 per occurrence
• No internet presence: +/-10, can indicate the best and the worst

Formation:

• Developer formation: +2 someone who can write code will often be more useful than someone who can't
• Learn different things at school: +3, with special points for Maths, Cryptography, Data Mining, Signal processing, Electronic, ...
• Didn't go to high school: +/-0, some really really smart people didn't spend much time at school.

Job experiences:

• Job hopper: -5, training people takes time (especially if you're not using our exercises), you cannot afford to hire someone who is going to leave after a year (with your company's knowledge).
• More than 7 years working for one big company/big 4 and bragging about it: -2, if someone is not happy, he should move on, and not stay at the same place for that long
• Worked as a developer: +2, someone who can write code will often be more useful than someone that can't.
• Web site developer: +3, a big part of our job is web-based, knowing how to develop for the web gives people a lot of knowledge needed for penetration testing (common mistakes, ability to review code, ...).

Certifications:

• CEH: -2, too often I have been disappointed during technical interview by CEH. Most of them just want to hack stuff and don't learn properly how things work.
• CISSP: -3, CISSP is in my opinion a good certification for people who want to show general knowledge in security... not really the kind of people a pentest company is after in my opinion.
• ISO-2700*: -4, same as CISSP with even less technical knowledge
• PCI-DSS: -2, not really technical but some really good people are certified.
• All of these certifications together: -3
• Special points for "Firstname Lastname CISSP": -4

IT knowledge:

• List tool instead of Technic: -3, sqlmap" instead of "sql injection"
• List really old security tools: -3
• Obvious lack of security knowledge: -10, Non-sense in the resume for example

Code:

• github profile: +5
• github profile with projects: +5, +3 if really good code, +4 if code in different languages
• github profile with patches for opensource projects: +5 (-3 if advisory published for silly vulnerabilities)

Vulnerabilities:

• published a vulnerability in some project in version 0.1: -3, +3 if it's a full code review and they found "all" the bugs and report them prior to the disclosure.
• published a stack-overflow in some Russian mp3 player: -3 (typical CEH profile)

Others:

• References from someone: +10
• Twitter account: +1, -1 if only chitchat, -3 if security circus, +2 if real information on vulnerabilities
• Blog with interesting articles: +5
• Play CTF: +5
• Available on IRC: +2
• Talk during conferences: +5, unless talk on SCADA: -3
• Read Phrack: +5
• Wrote in Phrack: +20 (Phrack is the *BIG* deal, writing in phrack shows both a lot of skills and the good attitude)

Hobbies:

• Any achievement: +3, black belt in some martial arts, won something, ...
• Did/do some team sports: +/- 0. to be honest I don't think most good pentesters are team players, they are more like traders, sharing information/tools with people they know/like/respect or people who share with them.

I know a lot of people won't agree with this rating, mostly because it's really subjective (and part of it is a bit trollish I guess). However, most of the time it provides a good overview of a resume... Obviously, if I get a resume that matches all these points, I will be really suspicious now :p 

 

==============================================================

 

After the first post on hiring pentesters I thought I had to keep going... A lot of people read it and apparently liked it... If you are really interested by the interview process, matasano's one is pretty impressive...

Before the interview (or even before you read the resume), it's good to have a basic opinion on someone's skills... I wrote a simple website with 20 questions to get a quick feeling of who I'm talking to.

The questions are simple but allow to detect people with no security knowledge. Below are 2 of the 20 questions so you can see what I'm talking about:

• unmd5 is the PHP function used to retrieve the clear text of a md5 ? True/False
• Windows passwords are stored in C:\Windows\System32\drivers\etc\shadow ? True/False

If someone passes this test, the real technical interview can start.

As always, you will have the normal security questions (I guarantee most security companies ask for these):

• explain a tcp handshake
• how Windows passwords are stored?
• what is a cookie?
• opinion on disclosure?

From my experience, I think it's better to ask people to explain things than just to ask them what it's. You can really see what level of understanding people have of a problem...

For example, with Cross Site Scripting, you can have the following responses:

• "it's a problem of filtering and it allows an attacker to inject script in the page"
• "it's a problem of filtering and an attacker can display/run arbitrary code in victims' browser"
• "it's a problem of output encoding and can be used to inject Javascript or HTML in the page sent back to victims"
• ...

That way, you're able to see if the person really understands what's going on and how he will be able to explain it to someone else.

You need to have 2 types of questions:

• questions based on memory: "what port is used by X", "what nmap options do you used"
• questions based on reflection: "how will you solve that problem"

I also have my favorite set of questions:

• "You're going to PentesterLab's website, explain what happens...", that way you can see someone's knowledge of TCP/IP, DNS, HTTP, SSL, ...
• "What is the last cool thing you learned/read", that way you can see what people are interested by and where they at

After this test, another interview is setup with hands-on test (only if the person did good enough obviously), it's currently the web application of the exercise "From SQL injection to shell" and it's used to see how people think and behave with a computer.

You can see a lot of different things:

• what people use for desktop
• how fast someone is with his computer
• how people solve a problem
• if people bring a working laptop (yes it happened, someone came to an interview with a broken gentoo...)
• learn from people: sometime people show you cool tricks you didn't think of
• ...

Obviously, not everyone (actually only one person did it without any help so far) knows how to exploit a SQL injection manually (why do you think I created PentesterLab). But during the test, we help people and show how things work to see how they can learn new things and incorporate information into their way of thinking.