According to my dictionary the use of obscurity was spot on. Your desire to keep knowledge of the infrastructure private and not well known is pretty much the dictionary's definition.
Bullshit. By that definition,
not keeping your password on a post-it note stuck to your monitor would be security-through-obscurity also.
In the industry, "security through obscurity" is used to describe the situation when knowing the technical and implementation details of the system is sufficient to break the security scheme. "Operational security" is used to describe the situation when the technical details of the system are kept private to limit the attack surface: knowing them does not break the security scheme, but it may help an attacker trying to break the security scheme by providing useful targeting information.
For example, if one accepts incoming SSH connections on a nonstandard port, and keeps that port number private (only telling those who do use those SSH connections), one applies operational security, not security through obscurity. Revealing the port does not compromise security per se, but it can help attackers. As security measures go, it is a
very weak one, but if combined with diverting incoming connections from addresses that have recently tried to connect to other ports (especially the standard SSH port) to a designated
honey pot, it can be a powerful tool for early
automated attack detection. Essentially, it does not provide any added security per se, but it definitely can help in detecting intrusion attempts, and focusing human security monitoring to where it is most likely needed. Also, it does nothing at all against directed attacks.
Gnif uses the simplest operational security approach there is, one that is literal millenia old: minimize the attack surface by only providing information to those who actually need it.
The reason this is done, is that it makes attacks and intrusion attempts harder and more costly. Before anyone can attack, they need to know what they are attacking, where, and how. Even if an attacker uncovers this information, the security is not yet compromised; they still need to do the attack itself. If an attacker cannot uncover that information, they need to guess what kind of an attack might work, and usually try several ones to have any kind of chance at success, and
failed attack attemps tend to be easy to detect.
What benefit would there be for gnif or Dave or other gnif's clients, if they revealed the system security scheme details publicly? Here, absolutely nothing; it would just make it easier for attackers to design and plan intrusion attempts to these systems.
There are certain forums where specific details and their application and usefulness are discussed, but to reduce the possibility of attackers exploiting the information discussed, they tend to be closed/insular, invitation-only, with real-world identity verification. Me, I prefer physical meetings and face-to-face discussions, because of body language.
Home
Help
Search
Login
Register
