Hats Off Security

Why should I care?

This type of work is the bread and butter of defenders, it also helps highlight how defenders operate if you are on the red-team. Understanding what is useful for looking backwards vs forwards is important. Hashes, IPs and other items at the easy end of the pyramid of pain are typically for looking backwards, seeing what has already happened and responding to that.

Where do you go to get information on vulnerabilities/exploits or to keep up to date with security?

This one is not gatekeeping, it is making sure the candidate knows where and how to get information. For example if a new vulnerability is found a SOC analyst would need to know what software is effected, how to detect any potential attack as well as understand if something is a false positive.

What is the difference between an ‘exploit’ and a ‘vulnerability’?

This is a base level question in my mind, we talk about these on a daily basis and I would expect a technical candidate to understand the difference between them. Explaining it can be tricky, so don’t mistake someone struggling to find the right words with not understanding.

Which is better, network based security or host based?

There are a few “it depends” style answers to this question, my typical go-to on this is that all network traffic needs to originate from somewhere and is being sent somewhere. Meaning host based is superior. However, not all host based technologies work on all devices (think printers, or routers).

What is the difference between a Vulnerability Assessment, a Penetration Test and a Red Team Engagement?

This is less about the dictionary definition of each of these, but instead the understanding of depth. A VA will typically be very superficial and some security products will ignore it as noise. A penetration test (pen test) is often done from a position of strength, meaning the tester may have been given an account with a high level of privilege and are testing a specific target.