I have worked for a number of organizations in the past that utilize practices that are justified by what I would describe as "Security through Obscurity" including the following:
- Weak/Vulnerable two way hashing of passwords
- Utilizing various API's/Utilities know to all to contain serious vulnerabilities
- Various forms of data/code obfuscation
- Sloppy/No user management
- The continued use of incredibly insecure passwords
- (The list goes on and on...)
Often times the fixes to these issues do not involve a large investment/change and I find it easy to get resources aligned to resolve them. My issue is in justifying any potential fixes, when these practices are challenged typically the concerns are dismissed with comments such as:
- "only group xyz has access to that network/product/machine/login/whatever"
- "that isn't a big concern" - The unstated version of:
- "no one could guess that/know to test that"
Even when in environments where security is very taken seriously, and audits are an ongoing concern, I have always found it challenging to convince others(especially non-technical/managerial types) of the importance of designing and maintaining systems that are secure by design.
I've found that when you use an example people will agree with you on principal, but the lesson really never sinks in. When confronted with an thorough explanation of why a particular system/subsystem is vulnerable management will often fall back on "it's not a priority right now"(I can't defend it and I don't care) argument, valid in it's own right, but more times than not rather than identifying and logging the issue, reflecting on lessons learned, and establishing a schedule to meet a certain pre-definded level of compliance, management often times discards any evidence contrary to full compliance, ensures all related parties that the previously mentioned system is "secure", and ships the product.
I am of the opinion that security through obscurity is not an effective part of a secure system and that resources spent of such schema's are resources better used for other parts of the application.
I've found over my career that the most difficult part of implementing a secure system is not convincing others of the value of a secure system or in gathering the requisite resources, but in convincing others of this principal. Efforts expended to improve an organizations security often turn into one man crusades rather than systematic and long term changes in culture and practice.
At the risk of being to broad or generally opinion based, what are the best strategies for teaching others the value and reasoning behind avoiding "Security through Obscurity"?