CertiGuide to Security+  9  Chapter 0:  Read.Me

0.4  Security Checklist 1 0.6  Resources

Security through Obscurity can make a black hat feel that a resource “isn’t exciting enough” to explore, prompting them to move on to another target

The authors of this text are in the position of devil’s advocate as are the authors of Writing Secure Code²⁴ by Michael Howard and David LeBlanc. Page 34 states “…it is trivially easy for an attacker to determine obscured information.” Other parts of this book show many examples of how such information can be found. The book The Art Of Deception²⁵ by Kevin D. Mitnick (page 82) says: “Security through obscurity does not have any effect in blocking social engineering attacks.”

Showing that some security recommendations are a matter of opinion, co-author Helen chimes in here with a somewhat-dissenting view. While running an obscure OS won’t protect you from an attack that specifically targets your site (as Howard and LeBlanc point out, using an obscure platform might make it a bit more difficult, but not impossible), it does discourage those attackers who are looking for any old random site running a certain popular OS (like Linux) that is vulnerable to the latest “script kiddie” program. If you can eliminate the effectiveness of a large percentage of the random attacks without losing required functionality, it may be worth considering.

Appendix B, “The Ten Immutable Laws of Security”²⁶, and Appendix C, “The Ten Immutable Laws of Security Administration”²⁷, originally by Scott Culp of the Microsoft Security Response Center, make Howard and LeBlanc’s book a must-have on the reference shelf of every IT person.

A possible look at the year 2010 and the years leading up to it if we don't get our security act together is here²⁸.

From a technical viewpoint we face an oxymoron. Under the single umbrella of security we have two opposing solutions. One is to filter out potentially bad stuff, such as closing ports or examining traffic for something bad. The other solution is to encrypt at some level of the OSI model, to help ensure that only authorized individuals can do anything on your network. The challenge lies in the fact that once you encrypt at a given layer of the OSI model, you can no longer filter traffic because it is encrypted!

0.4  Security Checklist 1 0.6  Resources