crowmoor.se

Security experts are an interesting breed. Ask them about the effectiveness of obscurity and they will give you a long tale of why it doesn´t work. Ask them about the theory of encryption system and they will tell you that you should always assume that the attacker knows everything. Ask them about their own security and they will fall silent as a rock. It is hidden behind secrecy, covered with confidential marks and the general principle is “Security by obscurity”.

So why it that security by obscurity always is practiced? Why are security people so secretive and always hides in shadows? There is of course not an easy answer to this but there are a few things that could partly explain it: Lack of own knowledge and slow processes.

Not being in total control of your security setup means that there is always a possibility for attack ways you didn´t know of. The biggest threat is as always the complexity but I want to challenge that assumption. Security is not complex. If it is, you have done it all wrong. Yes, it may be that you have a thousand systems you need to secure. But the models you should use should all be the same, the processes should be the same. Patching one system or patch a thousand is all the same. Same thing goes for network security. You may have a complex firewall concept including hundreds of firewall but the process of managing them is the same. One or hundred.

If you have done your risk analysis correctly you will inevitable understand what would be the fastest way to mitigate a threat. Sure it takes a longer time to patch thousand servers but you won´t have a thousand servers that are all in peril just because there is a new vulnerability.
In the end believing in security by obscurity will only work against you because you have no incitement to actually learn to work faster or improve your way of thinking. It is easier to just add another firewall. 😉