#SECURITY VIA OBSCURITY PASSWORD#

It is well established that given the opportunity users will choose weak, easy to remember passwords. Basic authentication today is thought to consist of 2 pieces of knowledge. So how can Security Through Obscurity be deployed to effectively combat these attacks? We can start with authentication. Even though these attacks are well documented, as are their countermeasures, many companies assume they are too small to be targeted.

#SECURITY VIA OBSCURITY PASSWORD#

That is why we are still seeing large numbers of attacks on RDP (Microsoft’s Remote Desktop Protocol) and password spraying attacks in Office 365. Attackers usually focus on one, or a few, very limited vulnerabilities, where they expect the numbers game to play in their favor.

Whereas a Pen-testers are paid to find avenues of attack and therefore will attempt more robust search and discovery techniques, attackers with malicious intent generally follow a more basic approach. You can’t attack what you don’t know about, so if attackers can’t find it during enumeration they will focus on what they do find. Speak with any Pen-tester (Penetration Tester or Ethical Hacker) and they will tell you that their first order of business is to perform a process called Enumeration (Discovery of Devices and Services). It generally conjures negative associations but when used strategically it could help to improve an organization’s security posture.

Security Through Obscurity is the practice of hiding vs securing. Moving ports also makes your logs a lot cleaner, if you’re into that type of thing.Security Through Obscurity – What is it and When is it is OK to Employ it?.I have a more in-depth video explainer of this on YouTube.Changing an SSH port is a lot like a dead-drop or camouflage.It’s not a bad algorithm, it’s bad key management. It’s like using RSA-Bruce-Lee-5000 but leaving your private key lying around where people can get access to it. It’s not Security by Obscurity technically (because you’re not hiding the mechanism), but it’s still dumb. But if you have a plant next to the door, and you keep the key under that plant, well…you’ve now made it easy to get the key, which is a different kind of stupid. So a good lock, with the key secure in your pocket is not Security by Obscurity. The door and key example can get a bit confusing when you poorly secure your actual key.Don’t let people term-shame you who don’t grasp the underlying concepts.As long as you have a good key, it’s ok for people to know the mechanism.It’s where you keep the mechanism secret, not the key.But most people don’t know what it actually is.Having a known defense but a hidden key is a well-established part of good security, and it has been for millennia. Obscurity doesn’t apply if people know the mechanism you’re using and they simply have a resource problem. Sure, they can check under every rock in Central Park and eventually find the package, but you’ll be done with the mission by then.

In short, you just made it harder for the enemy to successfully attack you by giving them a resource problem. I did an experiment one weekend and got ~10,000 probes on port 22 and 4 on some random high port. Sure, that’s not too difficult, but how many people are actually going to do that? Not many, because it’s costly in terms of time and effort. But now they have to scan all the ports and find the new one. It’s fine that people know you changed your SSH port.

Security via obscurity