Questions to ask a company during a job interview

Re:Questions to ask a company during a job interview by chii on Monday September 09, 2019 @09:14AM (#20917789)

i wonder if making the development machine use something similar to qubes (https://www.qubes-os.org/) by default works.

Also, if a compromised machine on the internal network destroys your company's security assumptions, then there must not have much defense in depth.

[ Parent | on HN ]

Re:Questions to ask a company during a job interview by theamk on Monday September 09, 2019 @09:23AM (#20917855)

qubes-like solutions are great at preventing malicious code from accessing your internal websites, but pretty useless from "code leak" perspective.

If you have downloaded a trojaned "super library" and put it to your build process, it will, by definition, be in the same security domain as your source code.

Unless you audit all file accesses and outgoing internet access, you won't be able to prevent code exfiltration.

[ Parent | on HN ]

Re:Questions to ask a company during a job interview by chii on Monday September 09, 2019 @10:50AM (#20918700)

is code exfiltration really the threat model though?

[ Parent | on HN ]

Re:Questions to ask a company during a job interview by ThrowawayR2 on Monday September 09, 2019 @12:45PM (#20919799)

Depends on whether you work on a product or in IT. For products in certain industries, yes, it is a concern.

[ Parent | on HN ]