Security through Obscurity

Updated on September 9, 2020 at 12:22 am

This is one of those constant arguments you see in InfoSec where many people believe that you either have security or you don’t and there is no in between.

My opinion is that a step which contributes to better overall security is in fact security.

One of the best examples, which I see all the time on my own internet facing servers is simply reconfiguring SSH to listen on some other random port instead of the default port 22.

Many people will argue that particular step is nothing more than security through obscurity and is pointless.

However that simple step will almost always bring SSH brute-force attempts down to nothing. So that simple reconfiguration of SSH did in fact contribute to the overall security of the host by moving the attack surface out of view of the brute-force cannons.

Obscurity does have a place in security.