Security by obscurity is underrated

I can neither confirm nor deny

>However, if you can reduce the risk with zero cost, you should do that.

Zero cost is rarely, rarely true with regards to operations. If you use non-standard ports, you'll have to document that somewhere, or else it becomes tribal knowledge.

If you don't document it, and someone leaves, how do you know how to access your servers? At the very moment you don't know how to SSH in, you've just paid the price. It's no longer zero cost.

If you do document it, you must now take the time to manage the permissions to that document, figure out who needs to know, and then change access as people come and go. All of that requires time, which also has a cost.

Plus all of this also has training costs when you onboard new people.

Zero cost is a real thing with computer science but not operations.

Good, thought-provoking article, but use with caution.

I've seen security through obscurity misused too often as the only line of defence, or as a "temporary" stop-gap that outlives its usefulness. It can lead to a false sense of security.

Such measures also do not tend to keep up with changes as attacks become more sophisticated or cheaper to carry out.

You also need to make sure that there are no unintended consequences - does your non-standard configuration make it harder to apply upgrades? Does your own penetration testing also scan all ports, or is it only going to discover weak servers running on port 22 on your network?

That said, I would do the type of things mentioned in the article as an "added bonus", but try to exclude them from my overall security evaluation (either rough mental model or formal threat model).

There's something to the idea of rehabilitating "obscurity", or at least recognizing that "cost" is part of threat models, and you can raise costs for particular attack vectors by degrees instead of "to infinity".

But SSH is a terrible example, because the cost to the defender of simply not having SSH vulnerabilities is the same, or even less, than the cost of obfuscating it with nonstandard ports, "port knocking", or fail2ban, which are all silly ideas.

Just use SSH keys, and disable passwords.

I think maybe it comes down to this: dialing attacker costs up incrementally can make sense if it's the most cost-effective way for a fully-informed defender to improve security. But incremental cost-increasing countermeasures aren't a substitute for sound engineering; you don't get to count "having to learn stuff" as a valid defender cost.

To me this seems like a bit of a strawman argument.

The claim was never that using obscurity is bad and should be avoided. As I first heard it, "Security through obscurity is not security" is saying that if you are relying on obscurity to keep your stuff secure then you aren't doing enough.

I think this is still true and the conclusion of the article agrees

    Security by obscurity is not enough by itself. You should always enforce the best practices.