1. “Security by Obscurity” – hiding the inner working of a system to make it sec

Question

1.      “Security by Obscurity” – hiding the inner working of a system to make it secure – is often considered a bad idea to achieve security. However, since we are students of science, we should be prepared to make arguments both for and against a notion and then weigh the two. Give two examples, one in favor of the statement and one against it and argue that there definitely are scenarios in which hiding information about inner working of a system do not add appreciably to security; however, there are also scenarios in which hiding such information can help enhance security.                                                                              

Explanation / Answer

Answer)

Security by Obscurity is a means for hiding the inner working of te system to make it secure. This idea is sometime mostly a bad idea and sometimes a good idea. Hiding information about an application to secure the application is not actually security. It is concealing information or technique to secure the system. A system should be secure because of its design, not because the design is unknown to an adversary. Security through Obscurity wouldn't completely block the attack vector, but it would significantly mitigate the problem. This approach merely conceals the measure to take security on and thus this is not actually a security feature.

For example as against the approach, you may decide to move the Web server to port 81 instead of 80 so only those who know where to find your Web server will be able to do so. In reality, moving your Web server to port 81 stops only some attacks, and mostly just inconveniences the end user. Thus this approach is not correct and inner working of a system do not add appreciably to security. An attacker who is smart can guess that but it will primarily cause inconveniences.

For example as for the approach, ATM machines and algorithms which operate them, they are better off if concealed. But that doesn't mean that they'll not be having additional protection measures as a part of the security. It is just that the hiding information about inner working of a system in case of ATM machines or likely machines, will add additional benefits to the protection of the system and enhance security.

Related Questions

Navigate

• Browse (All)
• Browse 1
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.