Take for example the cryptographic world. Would you trust a cryptographic suite that says “It’s secure, we say it is, but you can’t see the actually math” or would you trust the suite that has been through the public rigors and has been deemed computationally secure? This is an area where I believe the security through obscurity model does not work.

As for the high horse, I must apologize if I came off as a rude blogger, that’s not my deal. I’ve been around enough (not nearly as long as some)to see that there is room for both “real world” views and the attempt to apply portions academic design. Unfortunately, budget in the business is never as big as the budget of a professor’s mind.

Denying information helps to keep the low level ankle biters who just do massive banner scans away. This helps to keep the threat down to only attackers worth our time. It also reduces the false positive rate on the NIDS, WAFs, etc to a dull roar. Because so many companies fail to invest adequately in real security professionals and instead rely on the all in one super security box this is important. Reducing the rate of threat presentation allows each threat to be given more attention. If every banner-scanning script kiddie is hitting the unit and setting off the alarm the staff then learns to ignore the alarms. As a tester that is great so that we can hide in the noise but as a defender it is annoying. Obscurity helps reduce the noise and keep people focused on the real threats. It just can not be your only means of defense, which sadly it is all to often.

Keep up the good work but you may want to get off your high horse and realize that the real world is a lot more complicated than some academic perfect security mindset. Developers never want to acknowledge that their code sucks, finance guys never want to pay for something that has a ROI of ‘it makes us more secure’, how do you put that in a spreadsheet? Defending against 1000 threats has no ROI. Even a breach has a very low cost except for a few big cases. (reading http://www.databreaches.net/ for a few days should convince you how little people care about the issue). Security people are not cheap, obscurity is.

Thanks very much for the response. I must apologize for only commenting on the blurb portion of the article. In response though, I would lend a word of caution, be careful with sarcasm on the written page (or typed page for that matter). It does not shine through in many cases.

The rest of the article goes on:

————————-
Considering that it’s not yet offered commercially on computers, Chrome OS is as obscure as it gets, lending credence to Hilwa’s argument.

However, Hilwa added, this strategy does not always work with precision-targeted attacks, as the attackers would invest what it takes to target an environment.

“More often, software that is less popularly deployed may in some cases harbor basic vulnerabilities that would have been discovered with broader field testing and deployment. It is a judgment call,” he said.
—————————————

This is the main article: http://www.eweek.com/c/a/Application-Development/Google-Shunning-of-Windows-Paves-the-Way-for-Chrome-OS-293116/

Anyone familiar with security issues is also familiar with the age-old mantra that there is no security in obscurity, which is why I keyed off the phrase implying that deploying an unknown and untested operating system like Chrome OS may have some such risks. Truth be said, though, anyone who has kept quiet in a closet while a thief ravaged their house may have understood the value of security through obscurity (in certain settings .

Josh, again thanks for taking the time to pay attention. As another mantra goes, at the end of the day, no attention is bad attention.

Cheers!