Security through obscurity

A security approach that depends on concealing a system’s design or implementation to hinder attackers. It can supplement protective controls but cannot replace sound security engineering.

Kerckhoffs's principle: A cryptographic design principle that assumes an adversary knows the system, except for the secret key. It directly challenges reliance on a hidden design by requiring security to survive disclosure.
Open-source software security: The study and practice of securing software whose source code is publicly available. Public code makes design secrecy unavailable, shifting assurance toward review and controls.
Auguste Kerckhoffs: A Dutch linguist and cryptographer who formulated influential principles for military ciphers in 1883. His principles supplied a durable argument against depending on secret system design.
Port knocking: A method that keeps network services closed until a client sends a prescribed sequence of connection attempts. It hides service availability from casual scans, but does not replace authentication or patching.
Security audit: A systematic evaluation of an organization's security controls, policies, and practices. Auditors need access to concealed designs to determine whether protections work independently of secrecy.
Attack surface: The set of points where an attacker can interact with or affect a system. Concealing internals may hide some entry points without eliminating them.
Responsible disclosure: A process for reporting vulnerabilities to affected parties while allowing time for remediation before public release. It distinguishes temporary vulnerability confidentiality from hiding a system's design as its defense.
Claude Shannon: An American mathematician whose work founded information theory and transformed the mathematical study of cryptography. His maxim that one should assume an enemy knows a system reinforced the case for resilient design.
Secret URL: A URL whose unguessability or confidentiality is used to restrict access to the resource it identifies. It is a common practical case where obscurity acts as an access barrier.
Vulnerability disclosure: The communication of security flaws to vendors, users, or the public, often following a coordinated process. A secrecy-centered culture can delay reports that would expose weaknesses and enable fixes.

Linked from 1 page

CybersecurityCompared with: Secrecy alone cannot replace robust controls that remain effective when designs are known.