I usually ask some technical detail questions, but I also ask stuff like, "How do you keep up to date? Do you read blogs, listen to podcasts, mailing lists? Which ones?"
@LucasKauffman mind, thats more about seeing if they have an interest, if they're passionate about it and read on their own time, or if its just a paycheck.
If he never went mucking around with that, I would say it's unlikely he's a fit for the job.
and if he knows CS theory - you can talk about buffers, overflows, canaries, etc. Basics, but dig deep on the basics.
also maybe things like access control, depending on his education.
Really though, since there are no specific requirements here - let him lead you. Uni student? "What are your favorite classes? what do you enjoy about them?"
Partcipate on SE? "which sites? What q's did you have? what are your best tags for answering?"
etc.
Not about what he has done, not even what he CAN do, but about what he WILL BE ABLE to do.
Another thing you need to look at, considering that you're at Big4 (though this might be another interviewer's job). How well they can express themselves, explain complex issues (that they barely understand), and format a big pretty lookin report.
btw, another thing you can try - I had this done to me once, it was awesome - teach him about a new attack he's not familiar with, just the basics. Then ask him to figure out an exploit, or the next level, or how to mitigate it, etc.
Basically how he thinks, how he absorbs new information, etc.
added benefit, if you dont take him, he goes out and tells all his friends about how awesome this place is, he already learned so much.
@CodesInChaos My bet is on the demands being overboard, don't go with an established threat model, aren't governed by a cost-benefit analysis, and/or are unclear.
So I was having something of an argument WRT the security implications of using regular expressions as a parser
And specifically for use validating certain kinds of input. Like email addresses, etc.
Is this a thing in the security industry? Is there a common viewpoint?
OK, this even better. Just now I was just digging through a customer's database to figure out how the passwords were stored. I literally laughed out loud when I saw this:
mysql> select * from user limit 1 \G
*************************** 1. row ***************************
id: 1
usr_username: jim
usr_password: 123456q
usr_encpassword: 3cf347b9265534a17d098d9564f85400
@Adnan I wouldn't want to bet either way. There are incompetent devs (just send me the SQL. No need for SQL injection) and overly annoying security people
Personally I think "it has exactly one @ in it. Move along." It's an email.
For a time I used a mail service where a number or * indicated how many emails should be sent to this address before it shuts down. The * variant often got rejected
hmm [a-z0-9!#$%&'+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9]) from the page tylerl linked seems like a sane choice. It doesn't support the quoted variant, but I've *never seen that one. I'm not really bothered about rejecting @ip either.
(on a related note: markdown backtick escaping rules suck)
why not something simple, like doubling the backtick
@CodesInChaos well, I will discover it eventually, development thinks the requirements were overbord, but I am sure that security thinks they are being reasonable.
