Contents
Why is security by obscurity bad?
Security through obscurity is bad because it substitutes real security for secrecy in such a way that if someone learns the trick they compromise the system. Obscurity can be extremely valuable when added to actual security as an additional way to lower the chances of a successful attack, e.g., camouflage, OPSEC, etc.
Why is security through obscurity not a good practice?
Security through obscurity can be said to be bad because it often implies that the obscurity is being used as the principal means of security. Obscurity is fine until it is discovered, but once someone has worked out your particular obscurity, then your system is vulnerable again.
Is security through obscurity secure?
Security by obscurity alone is discouraged and not recommended by standards bodies. The National Institute of Standards and Technology (NIST) in the United States sometimes recommends against this practice: “System security should not depend on the secrecy of the implementation or its components.”
Why is complexity the enemy of security?
Complexity is the enemy of security, as it creates a significant amount of risk for organizations. Today, there are too many surfaces to defend, too many tools and siloes between teams, and too little context about infrastructure, apps and data. The current approach to security consumes too much time, money and effort.
Is it bad to use security by obscurity?
The term has negative connotations within the infosec community—usually for the wrong reason. There’s little debate about whether security by obscurity is bad; this is true because it means the secret being hidden is the key to the entire system’s security. Watch a video presentation of me making a similar argument.
Which is an example of the use of obscurity?
A powerful example of where obscurity and is used to improve security is camouflage. Consider an armored tank such as the M-1. The tank is equipped with some of the most advanced armor ever created, and has been shown repeatedly to be effective in actual real-world battle.
Who was an opponent of security through obscurity?
An early opponent of security through obscurity was the locksmith Alfred Charles Hobbs, who in 1851 demonstrated to the public how state-of-the-art locks could be picked.
Who is the author of security through obscurity?
In the field of legal academia, Peter Swire has written about the trade-off between the notion that “security through obscurity is an illusion” and the military notion that ” loose lips sink ships ” as well as how competition affects the incentives to disclose.