I know, I know… For years, you have been hearing how security through obscurity [1] doesn’t work. Pundits, myself included, auditors, security consultants and everyone else who has been through infosec 101 consistently hammer home the point that security through obscurity is a dangerous practice. But, with some of the recent things that have emerged, and some of the changes in play today, I can honestly tell you that it just might be useful to your organization. 

There is, of course, a caveat to using security through obscurity and to discovering its value. That is very easy. Security through obscurity is ONLY valuable if it is a part of your overall security posture. That is, it is a component of your defense-in-depth strategy. Rely on security through obscurity alone as a defense at your own peril. That does not mean, however, that it is a useless tool, as many pundits would have you believe.

There are primarily two ways in which organizations can use security through obscurity as a useful component in their security posture today. The first one is the most obvious. Using security through obscurity for example to use unpredictable system names, account names and other information makes the job of an attacker much more difficult in many ways. If your organization uses random system names for example, it becomes much harder for an attacker to target the workstations of key staff members, even if that attacker has access to AD and such. In fact, without access to a database of hosts to users or a list of items, attackers are usually forced to scan or perform NETBios probes to each machine to identify logged on users. This is an excellent example where security through obscurity helps the security team, in this case forcing the attacker to perform noisy scanning and likely raising the chance of detection by the organization’s defensive tools and processes.

The second way you can effectively use security through obscurity is as a threat source risk calculator. How can you do that? Well, statistically speaking, over the last several years, probes and attacks from the Internet have become increasingly isolated. As such, they have begun to establish and exhibit normal patterns of behavior. That is, for example, web scans and worms tend to probe ports 80 and 443, while worms against ssh attack on port 22. Many of our clients are moving their non-business essential ports and services to alternate locations. The pundits would tell you that this security through obscurity does not provide increased security for the organization, and they would be right. But they fail to see that it provides, not increased security, but increased intelligence. If you move your ports to different locations, and you see attacks, you have a bit of intelligence on your side. You should know right away that the probes you are seeing are not from the common worms, bots and auto-rooters spreading randomly through the Net. You would understand that this is likely a broader scoped attack and depending on the actions that follow it or how unique it appears, you might suddenly realize that this is a dedicated human attacker focused on your organization!

Such intelligence is useful because it is easily sorted from the noise when the majority of common automated probes and assaults are removed from the picture. In addition, just about any organization wants to treat a dedicated human attack focused on their business differently than a random worm scanning for known holes. This approach, and the use of security through obscurity just might provide you with the insight that someone has focused on you as a target. Knowing that fact can make a huge difference!

So, is security through obscurity useless, as some would have us believe? Perhaps not. These are just a few examples, and I am sure there are many, many more out there. Who knows, maybe we ought to go back and look at some the other “laws of information security” and make sure they still make sense in the modern world. I will leave that exercise to you. Let me know what you come up with.

[1] http://en.wikipedia.org/wiki/Security_through_obscurity