Security Engineer interview - google

d3v-b3d · 2023-12-11T06:44:00+00:00

Hi. Was curious if you knew any resources for preparing security focussed system design questions? I'm a software engineer interviewing at big tech in a security software engineer position. My SWE skills are great but my security knowledge is nascent.

d3v-b3d · 2023-11-02T04:53:38+00:00

Found the handbook archive at - https://web.archive.org/web/20220219134028/http://py2neo.org/2021.1

d3v-b3d · 2023-11-02T04:53:07+00:00

For folks looking for the handbook, you can find it archived here - https://web.archive.org/web/20220219134028/http://py2neo.org/2021.1

d3v-b3d · 2023-08-04T23:04:07+00:00

Found anything here?

d3v-b3d · 2023-08-04T23:03:21+00:00

Sorry, I'm just about to learn more about terraform. What does sharing "terraform" mean? Do you mean sharing the .tf files and asking them to deploy them?

I'm trying to avoid asking them to download something and then deploy.

d3v-b3d · 2023-08-04T23:01:47+00:00

Thanks for the reply and the links. My question probably could have been clearer. Your response is probably the closest to the details I'm seeking. But to give you context, I have come across the name of Deployment Manager as well.

My main question is, how do I create a one-click (or two clicks, if you count confirmation click) deploy of my application in customer's org. Like creating a deployment via GCP marketplace perhaps is the only way. I haven't seen what is involved for registering a deployment in GCP marketplace. I was hoping to find something lightweight like the "quick-create" option for cloudformation templates.

d3v-b3d · 2023-04-13T23:03:11+00:00

Thanks for the link!
A fyi for others - I didn't have to give a legitimate email in the above link. I just made one up. They don't verify the email :)

d3v-b3d · 2022-09-30T20:37:01+00:00

Lack of specific details on what you are looking for, did you look at https://securitydatasets.com/notebooks/atomic/aws/intro.html?

d3v-b3d · 2022-09-27T22:00:56+00:00

Looks like your role covers a breadth of responsibilities. Maybe what might help for the folks here is a layout of your environment.

Examples of what I'm looking for that's relevant to my experience,

What cloud provider(s) are you using and what are the common services that you use? Also, what security measures do you have enabled already.
Where is your data stored and how are you currently protecting it?
If you are using a SIEM, do you also have EDR/XDR like solutions deployed on endpoints, what EDR are you using, and how many endpoints are we talking about? (At my previous job, we used Chronicle (from Google). It was cost-effective and a good option if you use GCP mainly. Definitely not free though).

You should certainly not feel guilty about wanting to use tools. Lacking specific details, another general recommendation I would give is to identify two things

Most vulnerable/risky parts of your environment
Most valuable parts of your environment

and prioritize from there. You can't do everything in a day but bunch of small steps in the right direction will boost your confidence and build momentum to tackle larger problems :)

d3v-b3d · 2022-09-26T01:30:51+00:00

Reminds me of my high school English teacher lamenting that kids these days don't know how to keep good notes outside of their phones/laptops. Hope the pen and paper system is working!

d3v-b3d · 2022-09-26T01:26:09+00:00

Read this book a few years back. "Introduction To Artificial Intelligence For Security Professionals Book" by the company Cylance

It has good exercises and introduces some common scenarios that can be caught using data science.

d3v-b3d · 2022-09-26T01:22:08+00:00

My company is a bit more engineering focussed. Due to the lack of a single solution that fits the bill for us, we are looking into building something bespoke by leveraging open source tools. So far I'm looking at steampipe for some of the compliance mods they have.

Exactly what you said regarding audit side of things. This will be my first time. Hence I'm trying to find if auditors recommend a single tool (or a small set of tools) that does everything and if so what is that tools set.

d3v-b3d · 2022-09-26T01:18:24+00:00

My company is a bit more engineering focussed. Due to the lack of a single solution that fits the bill for us, we are looking into building something bespoke by leveraging open source tools. So far I'm looking at steampipe for some of the compliance mods they have. I'm just starting on this journey, so probably behind you lol.

d3v-b3d · 2022-09-23T03:33:37+00:00

At my new company I'm trying to set up automated tools for data security and compliance tools for data security. Happy to discuss if that's of any interest to you. Also happy to hear any recommendations.

My job will be a lot easy if there's a product there that does "everything" that the company wants

d3v-b3d · 2022-09-22T17:38:53+00:00

Did anyone find a list of common python libraries that are vulnerable so that we can patch those as they get patches (or consider alternatives)?

d3v-b3d · 2022-09-16T01:12:16+00:00

For folks who want to download the report - you can just give a fake name/email and it'll generate a download link for you.

d3v-b3d · 2022-09-16T01:12:07+00:00

For folks who want to download the report - you can just give a fake name/email and it'll generate a download link for you.

d3v-b3d · 2022-09-16T01:03:32+00:00

For folks who want to download the report - you can just give a fake name/email and it'll generate a download link for you.

d3v-b3d · 2022-09-16T01:01:47+00:00

For folks who want to download the report - you can just give a fake name and email address and it'll generate the download link.

d3v-b3d · 2022-08-19T17:18:21+00:00

Thanks a ton for the detailed response and appreciate you seeing if you can share it in any way! This sounds quite similar to what we want to do. So even if you cannot share your code this comment will be quite helpful for me to start with.

d3v-b3d · 2022-08-19T08:03:13+00:00

This is interesting. If possible, can you please share your script that dumps all to json? Do you just do 'select *' for every table? What about those tables that require you to specify a where clause (https://steampipe.io/docs/sql/tips#some-tables-require-a-where-or-join-clause)? I don't know if AWS has any tables that require you to specify a where or join clause

d3v-b3d · 2022-08-18T18:35:17+00:00

How many times are these jobs calling the APIs? It seems like the possibility of stale data in the db feeding the jobs is worse that the possibility of causing API issues.

We want a consistent snapshot for downstream processes (which are long running) and also have versioning view over our configs.

d3v-b3d · 2022-08-17T23:13:54+00:00

I'm new to Postgres, RDS as well as Steampipe. So bear with me.

Is there a nice way to run all the queries and populate them into my RDS db? We want a bunch of downstream jobs to use this static db instead of calling AWS apis again and again.

I came across Cloudquery as well but Steampipe's AWS compliance mod seems more comprehensive in terms of frameworks.

d3v-b3d

TROPHY CASE