Hacker recruitment: When it is safe to have a hacker on your IT staff

By David Strom  14 comments

An entry on Network World's site by Mich Kabay got me thinking about how corporations should go about hiring a hacker. Kabay makes a lot of good points, especially to re-think the entire interview process to delve deeper into the personality of the potential employee and whether s/he has "reformed" enough to be suitable for your shop. But the more I looked at some of his suggestions, the more I began to realize that much of what he says is germane for highly skilled staffers, even those that don't come with arrest records or who have done something questionable in their pasts.

Kabay suggests that you pose a hypothetical case of someone who is badly treated by a supervisor and feels abused. What should the candidate do? How does the candidate feel and what actions should s/he take in response, if any? We all get a bum rap by our supervisors at some point in our lives; the question is how to absorb that treatment and how we move on.

How much of a sense of entitlement does a candidate have, and how much do you (or the greater organization) have as well? One time when I interviewed with Microsoft in Redmond I couldn't get over this sense of corporate entitlement – it was one of the biggest turn-offs that I had during my interviewing day there. I got the feeling that I wasn't going to fit in, no matter how smart I thought (or they thought) I was.

Kabay also suggests posing another hypothetical case of criminal hacking that steals someone's identity, and then ask the candidate how the victim would feel. You are looking for signs of empathy or its absence. Finally, evaluate the candidate in terms of their honesty and how they discuss their past behavior, how they justify or gloss over things that you think they should have gone into more detail or been more contrite.

14 comments

    Anonymous 2 years ago
    I think using the public record online would be the first thing. It can provide lot of valuable information.
    Anonymous 2 years ago
    Can anyone help with any recommendations with IT Recruitment in Milton Keynes I have been having issues withmy CV and trying to write a good CV is proving difficult, can anyone suggest anything?
    Anonymous 2 years ago
    The problem faced is the same as trying to keep communities safe. Commumities don't hire criminals to prevent crime, they hire detectives who make it their life persuit to understand and prevent criminal behavior. Great detectives have a record of foiling the most intricate crimes. A computer detective should have a great record of foiling the most insidious acts attempted by hackers. This record should be on their resume. It is up to the hiring manager to properly distinguish the good computer detective from the protentially dangerous criminal hacker. In my opinion, empathy does not matter and in fact could be used as a disguise to "Get In Your Door".
    Anonymous 2 years ago
    Some previous coworkers & HR people I know, told me that just because I have done some websites, know some linux & open source stuff, consider me a hacker.Even that I have no idea how to get into networks, & to honest, not interested at all.The worst part is that instead I having trouble getting a job...
    Anonymous 2 years ago
    I think you guys are missing the point. It's to screen against potentially bad employees. If you ask a criminal an empathy question, you're hoping they respond with some. Lack of empathy is dangerous.
    Anonymous 2 years ago
    Kabay is a moron. If Kabay was interviewing me and trying to play these mind games I'd call him on it. Why, because part of my job function would be getting information out of people using basic psychology. If you can't spot it you're not worth a damn. The doctor he quotes says breaking into system out of curosity is a trait of criminals. Now it's criminal, but it wasn't always that way. Alot of my generation learned alot by gaining access to systems and studing them. The thought of stealing something for profit never crossed out mines. Our goal wasn't to hurt someone or cause damage. We just wanted to learn about something we couldn't possible afford to buy.
    Anonymous 2 years ago in reply to Anonymous
    -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA1Anonymous writes, "Our goal wasn't to hurt someone or cause damage. We justwanted to learn about something we couldn't possible afford to buy."Eric Corley was in a panel discussion at an NCSA (National ComputerSecurity Association) conference in the mid-1990s. He said something like"I don't know why you security guys are getting your shorts in a knot --we're just breaking in to look around. We're not doing any harm."I stood up in the middle of the room of security experts and shouted,"BULLSHIT" just like "Anonymous." However, I continued (loudly), "If youdon't understand the concept of the TCB (Trusted Computing Base) thenyou're an idiot. If you do, then you're a liar."Any unauthorized access to a system poses a potential corruption of theoperating environment. If someone broke into your house and opened thebottles of baby food in your fridge, would you smile and agree that theyhad caused no harm because they were just looking around? Or would youthrow out the baby food on the grounds that they were potentiallycontaminated?System managers _must_ respond to unauthorized access to any productionsystem by verifying the integrity of _all_ the software and data on thepotentially-contaminated system. Failing to do so is a breach of due careand diligence in carrying out one's fiduciary responsibilities forsafeguarding data and system integrity.So breaking in and looking around without authorization have _never_ beenharmless exercises in self-education. They have _always_ been inexcusableethical breaches and later, explicit crimes in exactly the same way thatbreaking into someone's house or office without permission has been anethical and legal breach.For other discussions of criminal-hacker propaganda, distortions, lies, andillogic, see the articles at< http://www.mekabay.com/ethics/index.htm >.For a discussion of anonymity and pseudonymity, see the paper "Anonymityand Pseudonymity in Cyberspace" at Best wishes,MichM. E. Kabay, PhD, CISSP-ISSMP* Assoc Chair of Computing* Assoc Prof of Information AssuranceSchool of Business & ManagementNorwich UniversityExpect Challenge. Achieve Distinction.W: http://www.mekabay.com* Network World Security Strategies Newslettershttp://www.networkworld.com/newsletters/sec/=>o ASCII ribbon campaign against HTML e-mail o<=-----BEGIN PGP SIGNATURE-----Version: PGP Desktop 9.8.3 (Build 4028)Charset: utf-8wj8DBQFKqlSdUbF73uXqlJ8RAmFoAKCUX0+QlO9AszYf8wmGXvCDIAJyfgCgkSDwkhWXA3uKH9jdq8A73J6iwMI==nZaN-----END PGP SIGNATURE-----
    Anonymous 2 years ago
    A good hacker will be able to figure out what the interviewer wants and answer accordingly.
    Anonymous 2 years ago
    This is a very unusual type of hacker to look for since so many of them are the complete opposite of empathetic. I would suggest just looking for an efficient hacker and not some emotional guy who just happens to hack. A hacker is actually best if he is stoic.
    Anonymous 2 years ago in reply to Anonymous
    I think he means you are looking for people that feel empathetic and are less likely to do something disruptive because it would negatively affect people.
    Anonymous 2 years ago in reply to Anonymous
    That is a stereotype. Like all walks of people there are all different types of hackers from overly empathetic to totally selfish.
    Anonymous 2 years ago in reply to Anonymous
    Believe it or not, most employers don't want to hire emotionless drones. Emotion-deficient employees develop no sense of ownership over their work, they don't integrate well with co-workers, they are unwilling to mentor and train, they often display low adaptability to changing conditions and they are very poor team leaders. The real working world is full of miscommunication, differing skill levels, and conflict. An employee who can't deal with those factors is a liability. Most of us who were typing alone on our 6502 machines back in the 80s eventually grew up and learned to play well with others, and today's top tech people will need to do the same or they're going to be replaced by the next crop of college superstars before they turn 40.

      Add a comment

      Post a comment using one of these accounts
      Or join now
      At least 6 characters

      Note: Comment will appear soon after you have activated your account.
      Obscene/spam comments will be removed and accounts suspended.
      The information you submit is subject to our Privacy Policy and Terms of Service.

      ITworld LIVE

      IT Management/StrategyWhite Papers & Webcasts

      White Paper

      PBX Buyer's Guide

      PBXs connect internal telephones of businesses, while also connecting the business to the Public Switched Telephone Network, or PSTN. They handle the processing of all calls within the PBX's system, and they have all the telecommunications features that companies need to conduct day-to-day business built into the system itself, so that you won't need to purchase them from the telephone company.

      White Paper

      Phone System Buying Disasters to Avoid: C-Level Executives Share Hard Learned Lessons

      Phone system buying disasters can prove costly for any business. Unfortunately this hard lesson is learned too often as companies upgrade their phone systems. This whitepaper gets advice from phone system managers who were forefront in remedying phone system disasters. Also presents phone system buying oversights that created disasters that could have been averted with proper preparation and foresight.

      White Paper

      Checklist for Phone System Buyers

      Before you even think about purchasing a business phone system, make sure you have all your bases covered. This checklist will ensure you do not overlook any crucial steps in the evaluation process. Some of the items addressed in this checklist include:* Cost reduction* Capacity* Integration* Communication needsAnd much more. Read this checklist now.

      White Paper

      9 Important Business Phone System Buyer Questions

      Learn about the most important factors that go into buying the right phone system, such as: scalability, compatibilities, how to negotiate pricing, and more. This demo and compatible white paper are designed to help you be an informed buyer so you can make the optimal decision for your organization. Whether yours is a small, medium, or large-sized business, you'll want to know the nine key questions to ask sales reps to get the best deal on the right phone system for your needs.

      White Paper

      Phone Systems for Small, Medium & Enterprise Business: Which to Buy?

      Read reviews on the leading five phone system brands in each category and understand why they lead their niche. See the differences between premise and hosted solutions, and help decide the best phone system for your company.

      See more White Papers | Webcasts

      Ask a question

      Ask a Question