The Workplace Stack Exchange is a question and answer site for members of the workforce navigating the professional setting. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A person indulged in the negative aspects of information security (social engineering, active information gathering etc.)

  • Should he reference these experiences in his CV
  • And if so, how should he reference it?

The debate about the legality and morality of the mentioned actions will be irrelevant here and out of the scope of the argument.

share|improve this question

migrated from Sep 4 '13 at 11:01

This question came from our site for information security professionals.

marked as duplicate by jmac, Paul Brown, Chad, nadyne, enderland Sep 4 '13 at 17:23

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

The debate about legality is quite important when it comes to your CV. Don't put on paper that you did anything illegal. It's bad for you, and bad for the company who wants to hire you. – tylerl Sep 4 '13 at 9:24
By themselves, those aren't illegal. Companies often have people or hire consultants to try to break security through means such as those that you have mentioned. Was this your job, or were you using these techniques outside of employment for possibly illegal reasons? – Thomas Owens Sep 4 '13 at 11:15
I don't usually forward received resumes to the police, but I also don't have a policy against it. – emory Sep 4 '13 at 16:19

It somewhat depends on the role, but in general I'd steer clear of any mention of legally dubious activities on a CV.

A lot of large companies like to play it safe with that kind of thing and could drop an otherwise good candidate to avoid potential complications down the line.

Also if it is legally dubious putting it in writing is never a good idea.

I'd say that if the person has expertise that's relevant to the role (so the role includes Social engineering for example) that kind of thing could be expressed verbally in an interview where it can be put in the correct context.

share|improve this answer
... if it is legally dubious putting it in writing is never a good idea. YES! – FrustratedWithFormsDesigner Sep 4 '13 at 13:55
@RoryMcCune - As you point out there is a difference between a reference to a report on an exploit say in Android you have discovered and documented at a security conference ( with references to the white paper for bonus points ) and saying you were the person responsible for the Linken compromise. One isn't illegal as you in theory reported the exploit to Google before you released the paper the other is illegal and anyone who read that on a resume would be without any moral compass not to report it to the proper law enforcement. – Ramhound Sep 4 '13 at 14:16
@Ramhound absolutely, I don't think many employers would have a problem with responsibly disclosed vulnerability research, I was guessing that the question referred to a greyer area than that. Obviously if it was outright criminal putting it in writing would be an amazingly bad plan. – Rоry McCune Sep 4 '13 at 15:15

It depends. If you're not applying to a security company, then I would leave them off or reference them in an innocent way - "security consultant" or some highly spun version of the truth.

If you are applying to a security company, it still depends. If you are outside of the statute of limitations or you've been tried for the illegal activity, just list it (with some spin to provide the right tone). People with practical experience breaking security are invaluable to security companies.

If you've done things that people don't know about, and are within the statute of limitations I suggest listing something inbetween. You've done something shady, but unspecific enough to be useless as evidence (by itself).

share|improve this answer
I would advise ever in any capacity putting on paper that you admited to a crime. The laws can be changed at any time. Working for a security company is legal, their work legal, nobody is harmed by that work. Illegal activity is illegal for a reason, some harm is likely done to somebody, doesn't matter who. – Ramhound Sep 4 '13 at 14:18

This sounds like the 'phone phreaks' of the late 1970s that morphed into the hackers of the 1980s and 1990s. This is written up in various hacker books on social engineering and reverse engineering, some of which are very entertaining and also a wake-up call. '2600 Magazine' tends to document 'sitting duck' installations - generally companies and government organizations that should make at least a trivial effort to implement security.

Among some of the 'illegal' acts recorded in 2600 were the reprint of store coupons with higher discount amounts that the originals they were copied from, carrying around laptop sniffers in backpacks outside of retail stores that had unencrypted wireless Point-of-Sale equipment transacting credit cards, and staff that had never been trained to recognize social engineering. In short, such companies left themselves open to hacks. Often the people that did it first were simply curious, and did nothing more damaging than publish what they found. Situations that resulted in serious damage tended to occur later, and were only identified by law enforcement after either millions were stolen or millions of customer accounts were compromised.

It is not necessarily a good idea to indicate that 'you did it', however those interested in the 'dark side' often go to hacker meets where such matters are discussed. The times and places of these meetings are often documented in 2600 magazine - such meetings might be held in food courts in malls.

** Social Engineering ** If one has successfully 'socially engineered' account extraction from clerks in multiple businesses and local governments, this would be presented on a CV as 'local hacker consensus is that organizations in the area have not trained staff in social engineering practices'. One would reference 'The Art of Deception: Controlling the Human Element of Security' by Kevin Mitnick to document examples.

** Unprotected Infrastructure ** If one has a nose for sniffing out unprotected infrastructure, one would reference this on the CV as 'repeated scans of IP addresses within the US have determined that 70% of embedded systems (i.e., machine tools, refinery controllers, or water utility valves) have no password or firewall protection'. A link to this article would be attached, at least in the PDF version.

** Obsolete Business Practices ** Bar coded coupons are basically 'sitting ducks'. It is trivially easy to scan a coupon, print the copy on a color laser printer, and regenerate the bar code with a higher discount. The bar coding software is either 'free' or can be had for trivial cost, particularly if one can get 'their money back' in applying discounting technology 'creatively'. This would appear on the CV as 'ability to demonstrate alteration or interception of encoded artifacts (coupons, cash cards, etc.) using published examples'. In such circumstances one doesn't say that they did it, they just indicate that were someone to follow certain instructions published in magazines, the potential employer's resources could be compromised.

Much of the reason 2600 exists is that the publishers find open doors wherever they look. This is as much about warning people to cover their assets as it is instructing hackers in their craft.

share|improve this answer