Hot answers tagged security-theater
You don't need DNS names to be detectable. The entire IPv4 can be scanned in less than a day. And it has been done. And it is still going on. Therefore you must assume, that your IP address has been discovered. You can download all the certificates for all the IPv4's port 443 from Rapid7's Sonar project. -> Make this a nice demo. Download the ...
This might make very casual surfers move on, but anyone running any sort of scan on your server will discover the OS, web server version and running software. For example the nmap http-enum NSE script should detect that Outlook Web Access is running should anyone care to run it against your server. Yes, by all means replace the home page with something ...
I agree with you that security by obscurity should never be the primary defense, but I also agree that you should never make it easy for an attacker to detect the services you are running. An attacker would probably first try to figure out the version of your web server by banner grabbing. So you should make sure that IIS is not giving away such information ...
At least your server wouldn't show up in a simple evil crawler that looks just for these welcome pages. Or if you mask yourself as an Apache, following automatic attacks would hopefully fail. So for a dedicated attack on your server, this makes it maybe just a tiny bit harder. But for automatic attacks this can make the difference.
Only top voted, non community-wiki answers of a minimum length are eligible