An example of where this would be used is as part of a honeypot. The idea is to give the attacker a false sense of confidence that the obscurity has been uncovered and defeated.

The essence of this principle is that raising the time or risk involved, the attacker is denied the information required to make a solid risk-reward decision about whether to attack in the first place.Ī variant of the defense in the previous paragraph is to have a double-layer of detection of the exploit both of which are kept secret but one is allowed to be 'leaked'. If the system is set to detect this vulnerability, it will recognize that it is under attack and can respond, either by locking the system down until proper administrators have a chance to react, by monitoring the attack and tracing the assailant, or by disconnecting the attacker. Lacking the security layout of the target, the attacker must consider whether to attempt to exploit the vulnerability or not. For example, consider a computer network that appears to exhibit a known vulnerability. Security through obscurity can also be used to create a risk that can detect or deter potential attackers. Here, the goal is simply to reduce the short-run risk of exploitation of a vulnerability in the main components of the system. Although relying solely on security through obscurity is almost always a very poor design decision, keeping secret some of the details of an otherwise well-engineered system may be a reasonable tactic as part of a defense in depth strategy.įor example, security through obscurity may (but cannot be guaranteed to) act as a temporary 'speed bump' for attackers while a resolution to a known security issue is implemented. Perfect or 'unbroken' solutions provide security, but absolutes may be difficult to obtain. Indeed, such reasoning is very often used by lawyers and administrators to justify policies which were designed to control or limit high quality cryptography only to those authorized.

The wide availability of high quality cryptography was disturbing to the US government, which seems to have been using a security through obscurity analysis to support its opposition to such work. An example is PGP released as source code, and generally regarded (when properly used) as a military-grade cryptosystem. Now that cryptographers often work at universities, where researchers publish many or even all of their results, and publicly test others' designs, or in private industry, where results are more often controlled by patents and copyrights than by secrecy, the argument has lost some of its former popularity. The principle of security through obscurity was more generally accepted in cryptographic work in the days when essentially all well-informed cryptographers were employed by national intelligence agencies, such as the National Security Agency. In the field of legal academia, Peter Swire has written about the trade-off between the notion that 'security through obscurity is an illusion' and the military notion that 'loose lips sink ships' as well as how competition affects the incentives to disclose. This is a modern reincarnation of Kerckhoffs' doctrine, first put forward in the nineteenth century, that the security of a system should depend on its key, not on its design remaining obscure. For example, in a discussion about secrecy and openness in Nuclear Command and Control: he benefits of reducing the likelihood of an accidental war were considered to outweigh the possible benefits of secrecy.

Books on security engineering will cite Kerckhoffs' doctrine from 1883, if they cite anything at all. There is scant formal literature on the issue of security through obscurity.

Security via obscurity