One method of securing a computer system is called “Security through obscurity”. While a poor method by itself it is however a good compliment to a holistic security methodology. All this amounts to is not advertising (hiding) what systems are or where they are within your network, whether this is at home or the office.
A prime example of this is not keeping your wifi SSID as the factory default or naming it something that clearly relates to you. While this may not stop a hacker it will at least slow one down. I believe this is a valid compliment to your security because when it comes down to it most people are lazy and when confronted with two networks an attacker is likely to go after the easier one to exploit, so you can be doing yourself a favour by making it more difficult.
One thing anyone who has tested perimeter security will tell you it can be quite difficult to initially determine the makeup of a potential target, especially if they’ve made an effort to ensure services don’t announce themselves (like Apache giving you version number and all the modules installed). By making it difficult to determine the makeup of a network you will force many attackers to scan the network, which will make it more likely for security systems to detect the attack.
While being a good addition to a secure network I have seen some people use this as the primary method of security. That is if we give everything obscure names and turn any broadcasting off this will secure our systems. This is a bad mentality to get into because it will not stop a determine attacker from getting in as they will not be deterred by the lack of information gleaned from the initially reconnaissance. Plus once the attacker does gain access there is likely little to no security to stop them gaining full access.
The problem with most security that people implement is that they think they can be more lax behind the scenes. Take a firewall for example, i’ve seen many networks that rely so heavily on the firewall working that the security of the LAN behind the firewall is so laughable anyone can plug in a computer and quickly get access with a small set of free tools.
The main problem with security through obscurity is that it is becoming increasingly difficult to implement properly because so many of the systems we take for granted rely on gathering information about us.
For any security methodology to work it must be part of a whole, that is you must ensure that no single part of the system can cause a total collapse if compromised, and let’s face it, computers these days are incredibly complex systems built by many people with a huge potential for mistakes and security is rarely taken as a critical factor in the design of most products.
In the end when you want to keep people out of your systems you need to ensure you have setup multiple methods of stopping or at least slowing them down enough that it becomes too much effort to bother and they go and attack someone else.
Security through obscurity – wikipedia
Copyright © 2020 | Ben Hutton