Q: Perform a threat modeling exercise (using STRIDE) for an interbank money transfer feature via Napas in Vietnam. What are the most critical threats you identify?

STRIDE applied: (1) Spoofing: impersonating user/source bank - mitigate: MFA + mutual TLS with Napas, (2) Tampering: modifying amount/account in transit - mitigate: request signing, integrity check, (3) Repudiation: denying a transaction - mitigate: immutable audit log, digital signature, (4) Information Disclosure: exposing transaction details - mitigate: encryption at rest + in transit, (5) DoS: flooding the transfer API - mitigate: rate limiting per user per day, (6) Elevation of Privilege: exceeding transfer limits - mitigate: server-side limit enforcement. Bonus: drawing a DFD (Data Flow Diagram) before STRIDE; recognizing that race conditions in concurrent transactions are a critical threat (TOCTOU - Time of Check vs. Time of Use); mentioning Napas HSM (Hardware Security Module) for transaction signing.

Question 1

Among the OWASP Top 10, which vulnerabilities do you encounter most often at Vietnamese companies, and how have you addressed them in practice?

Accepted Answer

Answer should: (1) Identify 2-3 specific vulnerabilities with real Vietnam examples (SQL injection in legacy PHP, IDOR in REST APIs, cloud misconfigurations), (2) Describe detection methods (pentest, code review, SAST/DAST), (3) Specific remediation beyond theory, (4) Prevention of recurrence (secure coding guidelines, training). Look for: Broken Access Control (#1 in 2021) is extremely common in Vietnam due to many legacy systems with weak authn/authz; Injection remains common in PHP legacy; Security Misconfiguration due to debug/test endpoints left in production.

Question 2

Describe your penetration testing methodology for a Vietnamese banking web application. How do you define and respect scope to avoid legal violations?

Accepted Answer

Phases: (1) Pre-engagement: signed NDA, clear written scope (IP ranges, domains, excluded systems like production DB), (2) Reconnaissance: passive (OSINT, Shodan, Certificate Transparency) → active, (3) Scanning and Enumeration (Nmap, Burp Suite), (4) Exploitation with immediate reporting on critical findings, (5) Reporting: CVSS scoring, PoC, remediation guidance, (6) Retest. Vietnam-specific factors: Circular 09/2020/TT-NHNN requires SBV-sanctioned security assessments; Decree 13/2023 on personal data protection; written authorization from the client is required before any testing activity.

Question 3

At 2 AM, monitoring alerts detect anomalous traffic from an internal server exfiltrating data at 500MB/hour. You are the on-call incident responder. What do you do in the first 30 minutes?

Accepted Answer

Following NIST IR framework: (1) Triage (5 min): confirm alert is not a false positive, notify incident commander, (2) Containment (10 min): isolate server from network but do NOT power off (preserve memory forensics), capture memory dump and packet capture, (3) Eradication: identify intrusion vector, (4) Full timeline documentation, (5) Communication: alert CISO, prepare management notification. Key bonus points: do not immediately power off (loses volatile memory - running processes, network connections, encryption keys); use chain of custody for evidence; verify this is not scheduled backup or data replication before escalating.

Question 4

Your company is transitioning from perimeter-based security (VPN + firewall) to Zero Trust. Describe a 12-month implementation roadmap on a limited budget.

Accepted Answer

Three-phase roadmap: (1) Q1 - Foundation: deploy strong Identity Provider (mandatory MFA, SSO), complete asset inventory, (2) Q2-Q3 - Micro-segmentation: divide network into small segments, implement strict RBAC, establish device trust (EDR), (3) Q4 - Continuous verification: conditional access policies, SIEM + behavior analytics, gradual VPN elimination. Zero Trust principles: 'Never trust, always verify'; 'Assume breach'; 'Least privilege access'. On a limited budget: prioritize identity (Microsoft Entra/Okta is the highest-ROI investment), followed by privileged access management (PAM).

Question 5

How does Decree 13/2023/ND-CP on personal data protection affect the system architecture you are building? Name 3 specific requirements and how you implement them technically.

Accepted Answer

Technical requirements from Decree 13: (1) Consent management - store consent with timestamp, version, scope; implement consent audit log, (2) Right to erasure - design data deletion cascade, soft delete with 30-day deletion scheduler, anonymization instead of deletion for analytics data, (3) Data breach notification - system must support reporting within 72 hours to the Ministry of Public Security. Bonus: knowing that Decree 13 classifies data as 'basic' and 'sensitive' (health, biometric, religion...) with different protection levels; data localization requirement for Vietnamese citizen data; DPO not mandatory but recommended.

Question 6

You are tasked with conducting a security audit for a mobile banking application (iOS + Android) with 500,000 users in Vietnam. What do you prioritize and why?

Accepted Answer

Prioritize by risk and impact: (1) Authentication and session management (secure token storage, certificate pinning, biometric bypass), (2) API security (IDOR in transaction endpoints, mass assignment, rate limiting), (3) Local data storage (no sensitive data in SharedPreferences/NSUserDefaults, unencrypted SQLite), (4) Network security (SSL pinning, traffic analysis), (5) Business logic (transfer limit bypass, race conditions in transactions). Look for: reference to OWASP Mobile Top 10 (different from Web Top 10); knowledge of using Frida/Objection for dynamic analysis; OWASP MAS Testing Guide (MASTG); testing requirements per Circular 35/2018/TT-NHNN.

Question 7

Your engineering team moves fast with CI/CD but security reviews are a bottleneck. How would you integrate security into the pipeline without slowing down development?

Accepted Answer

DevSecOps pipeline: (1) IDE plugins (SonarLint, Semgrep) - developers catch issues early, (2) Pre-commit hooks: secret scanning (Gitleaks, detect-secrets), (3) CI pipeline: SAST (Semgrep/Checkmarx), dependency scanning (Snyk/OWASP Dependency Check), (4) Container image scanning (Trivy) before registry push, (5) DAST (OWASP ZAP) in staging environment, (6) SLA for security findings: Critical < 24h, High < 7 days. Key strategy to avoid slowdowns: only block pipeline on Critical/High findings; Medium/Low create issue tracker tickets instead of blocking; security champion model within each team; threat modeling early in the design phase.

Question 8

Perform a threat modeling exercise (using STRIDE) for an interbank money transfer feature via Napas in Vietnam. What are the most critical threats you identify?

Accepted Answer

STRIDE applied: (1) Spoofing: impersonating user/source bank - mitigate: MFA + mutual TLS with Napas, (2) Tampering: modifying amount/account in transit - mitigate: request signing, integrity check, (3) Repudiation: denying a transaction - mitigate: immutable audit log, digital signature, (4) Information Disclosure: exposing transaction details - mitigate: encryption at rest + in transit, (5) DoS: flooding the transfer API - mitigate: rate limiting per user per day, (6) Elevation of Privilege: exceeding transfer limits - mitigate: server-side limit enforcement. Bonus: drawing a DFD (Data Flow Diagram) before STRIDE; recognizing that race conditions in concurrent transactions are a critical threat (TOCTOU - Time of Check vs. Time of Use); mentioning Napas HSM (Hardware Security Module) for transaction signing.