Hacker News Reader

Comment by looperhacks | Hacker News Reader

Is there any way to recognize adversary IT workers? Not many companies have the capabilities of cybersecurity experts

Biggest thing you can do is just ensure you conduct at least 1 on-site interview, and make sure that interviewer is in a position to realize if the person they met is not the same one who shows up for other interviews and/or the work. Cost of a flight is nothing really compared to recruiting and hiring (and if you really are fully-remote and geographically distributed, you probably already have somebody in their metro area), on-sites used to be standard.

I mean, it's not the biggest thing you can do; you could start selling to the government, become a cleared contractor, and then you could require a USG security clearance for job applicants.

I would call the on-site interview and/or minimal background check "the most pareto frontier thing you can do."

How much of that would you get from just using e-verify? That doesn't find criminal issues like a security clearance does but seems like it would at least reduce the pool of nefarious applicants by a significant margin.

Just make them show up in person at least once for onboarding. They're not going to fly out from China or Russia (where they tend to be based) to do this; especially not to the US.

Verify their ID in person, issue their laptop etc in person, make sure someone who interviewed them is there to meet and greet them (and attest that it's the same person they talked to.)

If you can at least do a final interview in person also, then that's even better.

Start with a fingerprint check before you even talk to them.[1] Then ask for a REAL ID at the interview, take fingerprints again, and match with the ones from the pre-screen fingerprint check. You need to be signed up with a driver's license verification service to validate the ID.[2]

It takes that level of verification to become a security guard or a school bus driver. Anybody in computer security should be doing this.

[1] https://www.sterlingcheck.com/services/fingerprinting/

[2] https://www.aamva.org/technology/systems/verification-system...

Are you serious about this?

I live in China, a supposedly autocratic country and one with universal ID, and even companies here don't take fingerprints. ID will be shown when you are officially onboard. I can't say for all, but for most companies (at least the ones without the need for a security clearance), requiring ID at interview will be seen as a red flag, and requiring fingerprint would probably be put on social media and name shamed, if not straight up reported to the authorities.

Not a typical job but one in a high security environment, seems somewhat understandable.

Not that I’d do it. The paradox that security for a firm means zero privacy for me is too much to bear these days.

I have some experience working for financial institutions with access to highly confidential information, and haven't been required to produce my fingerprint for, like, ever.

Again, I can't say for all, and I'm sure there are certain companies and positions which require such measures, but I could not imagine requiring fingerprints (or even ID during interview) to be acceptable in most cases.

You probably worked in divisions where the auditors didn’t issue a finding yet, or outside the regulatory scope.

It’s pretty common in finance, government and human services. Amazon is very aggressive with this - contractors in their facilities get regular background checks.

Usually the employee goes to a third party run by a company like Idemia to collect the biometric. I can’t imagine not collecting the ID information of perspective employees - that’s just asking for fraud.

You didn't have to do an in-person background check that included fingerprinting? When I worked at a bank this was required. It was run by a third party company not at the office.

No, but I didn't deal with money directly. I dealt with corporate governance and capital market related information for the company, so perhaps other people needed to have their fingerprints taken.

In a high security environment, you can get a report from law enforcement; in the Netherlands this is called a "declaration around behaviour" (??), which is basically a signed / authenticated document saying "this person was not involved in financial crimes" - you need to have it specified for a category of crimes, the previous is for example one I had to get to work at a bank as a contractor.

I don't know what the equivalent in the US is, but https://www.fbi.gov/how-we-can-help-you/more-fbi-services-an... seems similar enough.

I'd trust an FBI report more than taking their fingerprints and the like.

The way it worked for a real US high security job (TS/SCI) was that the clearance process was totally separate from the employer. The fingerprints and polygraph exams were done off premises. The famous SF-86 form[1], all 130 pages, had to be filled out, but nobody at the employer ever saw it. The checking and processing were done by the FBI or a unit in DoD.

(The current SF-86 only wants your residence addresses for the last 10 years. Used to be "List all residences from birth".)

[1] https://www.opm.gov/forms/pdf_fill/sf86.pdf

If you're under attack by a foreign government, this isn't optional.

> I live in China, a supposedly autocratic country and one with universal ID, and even companies here don't take fingerprints. ID will be shown when you are officially onboard. I can't say for all, but for most companies (at least the ones without the need for a security clearance), requiring ID at interview will be seen as a red flag, and requiring fingerprint would probably be put on social media and name shamed, if not straight up reported to the authorities.

You're in a much more authoritarian country, and that would be using your non-universal, national ID. How do you authenticate someone coming in from overseas?

Answer: your authoritarian government doesn't let them in, or authenticates them for you in a joint process with your HR department.

For overseas workers, a. it is quite difficult for foreigners to get a working visa in China (though I suppose it's more of an immigration issue rather than the country being authoritarian); b. companies would probably use their passports. So you're kind of correct. However, my point still holds: fingerprints for interviewees, even in China, is at best extremely uncommon, and at worst (?) illegal in most cases.

Btw, I am nitpicking here, but by universal I meant used across the whole country, i.e. national.

The latest advice about spotting at least north koreans who apply under fake identities is asking them to comment on how fat Kim Jong Un is. Real north koreans could not comment on that..

Is this technique used in the real world?

The solution is just-in-time access controls, context-aware authorization for things like database access (i.e. given a justification with an approval workflow, the employee can access a user X for 2 hours). These are the guard rails against a rogue employee, by introducing friction.

I rolled out these level of controls at a big company and got push back from the sales team -- they needed access to generate leads. do demos on the spot, etc. Was a hard fight and I lost.

Some high-level advice is listed here: https://ofac.treasury.gov/media/923131/download?inline

I run outsourcing agency, we work with US clients and have seen lots of fake applications (different degree of sophistication), so far we have either rejected them right away, or we were able to filter them during (remote) interviews.

Definitely the 'regular' application procedures - check someone's ID, check their references, ideally meet them face to face, etc.

This is more tricky with remote-only jobs or worse, "gigs" where you don't even meet people. But also, I would've expected open source to be "infiltrated" a lot more than it has, since that's very much anonymous internet culture... but also a culture of code reviews and the like.

There's often red flags, such as a Polish name, graduate from a Polish university, but doesn't actually speak Polish.

Local knowledge, too. If they claim to be from Krakow, get someone from there to chat to them. If you hear frantic typing, they're imposters.

> There's often red flags, such as a Polish name, graduate from a Polish university, but doesn't actually speak Polish.

That's oddly specific. Any famous examples?

Famous, I don't know, but one example comes to mind:

https://www.bellingcat.com/news/americas/2022/06/16/the-braz... The Brazilian Candidate: The Studious Cover Identity of an Alleged Russian Spy

Maybe also Pablo González Yagüe aka Pavel Alekseyevich Rubtsov.

Might have been a retelling of https://newsletter.pragmaticengineer.com/p/ai-fakers, which is only about two months old.

> "The candidate did not speak Serbian, despite graduating from the University of Kragujevac, in Serbia."

Yes there are lot of identifiers. They are improving a lot, so things are changing daily. There are certain steps to take pre hiring and post hiring. If you need help share your email and I can provide details.

The reality is a bunch of people trying to secure their insurance relationship. Useless money absorbers are running things.

Young naive and full of memes, parachuted into place from a billionaire, completely unaccountable and completely unaware of how todo anything securely.

Reply on news.ycombinator.com