Is it more or less secure when an entity shares it's security procedures?

Question

Right now I'm doing a work term through my school and they want me to write a report on something I've worked on. They are really serious about "proprietary reports" and reports requiring destruction after they've been marked. I'm planning to write about becoming PCI compliant and my boss tells me not to worry about marketing it as a "proprietary report". My question is, does making security details public increase or decrease security? I can't find the wikipedia article I read this on but after 9/11 a report found that agencies such as the FBI didn't share information enough, each agency felt that they worked to obtain the information and wanted to keep it confidential and to themselves which ultimately was counterproductive. Can it be seen as the same, the more people who look over a PCI implementation the more likely someone can spot a weakness?

Answer 1

In general, the consensuses within the security community is that disclosing security practices (aka, transparency) leads to improved security. Transparency has many benefits:

• It gives you motivation to do security right. Sometimes doing the right thing for security is annoying or costly, and having no one to account to makes it tempting to not do it the right way. When everyone can see what you're doing, you have more motivation to do things correctly.

• It means that more people can scrutinize what you're doing wrong. An open system can be analyzed by many more people who can suggest improvements. In general it is assumed that motivated attackers will find these weaknesses anyway, so the more honest people that can see the weaknesses the more likely it is that the weaknesses will be reported in a timely manner. The alternative is living in bliss and only knowing about a problem once the attacker has exploited it.

• It means that you are confident in your design. Security is hard to do well, and many people hide their security practices because their practices would appear bad. Making it open shows that you are not only comfortable with them, but that you are willing to fix problems that arise.

• It allows others to learn from the things you do right or wrong. This has little direct benefit for you, but it allows others to benefit.

That said, transparency is really only beneficial if you plan to respond to security problems. If you aren't planning on it, transparency can cause problems because you make the attackers work less hard to find vulnerabilities.

PCI is a public standard that a lot of people conform to, so it's unlikely that very many of the details related to your implementation will be very unique. It's possible your boss doesn't think that information about proposed PCI compliance would be harmful.