The IT Law Wiki

Security through obscurity

32,062pages on
this wiki
Add New Page
Add New Page Talk0

Definition Edit

Security through obscurity (also called security by obscurity) is a pejorative reference to a principle in security engineering, which attempts to use secrecy of design or implementation to provide security. A system relying on security through obscurity may have theoretical or actual security vulnerabilities, but its owners or designers believe that if the flaws are not known, then attackers will be unlikely to find them.

Overview Edit

A system may use security through obscurity as a defense in depth measure; while all known security vulnerabilities would be mitigated through other measures, public disclosure of products and versions in use makes them early targets for newly discovered vulnerabilities in those products and versions. An attacker's first step is usually information gathering; this step is delayed by security through obscurity. The technique stands in contrast with security by design and open security, although many real-world projects include elements of all strategies.

This page uses Creative Commons Licensed content from Wikipedia (view authors). Smallwikipedialogo.png

Also on Fandom

Random Wiki