Monday, October 5, 2015
What is best open security VS security through obscurity?
For a long time it was believed that security through obscurity is the answer. Security through obscurity means that as long as you keep the details of a system or algorithm secret, that system is secure because the attackers don't know the details. Open security on the other hand implies disclosing an algorithm or a system and let the people test it and report the problems.
Because it was proven that security through obscurity is not good at all, many people argue that open security is the answer. This approach is not desirable either. Every method has it's flaws.
Security through obscurity major issue is that the security bugs will exist and a very skilled attacker will find them, plus a major security flaw can be overlooked for many years. Open security relies on the honesty of the ones reviewing the algorithm to report their findings.
The term defense in depth refers in implementing multiple layers of security assuring that one method of attack won't be able to undermine the overall system security. This being said, both the methods should be implemented.
Now you might argue that what I said is impossible, because this practices are mutually exclusive. Not they are not. First, we have to imagine the security of an entire system, second we have to look at these methods as two separate layers of security.
Let's imagine we have an encryption system. The encryption algorithm must be made public, but the implementation procedures might be kept private. By implementation procedures I mean: password policy, token storage policy etc. You just can't publish everything. In the real world it's not the one or the other. The difficult thing is deciding when to use what.