This question already has an answer here:
- The valid role of obscurity 3 answers
I'm a beginner and reading about attitudes towards "security by obscurity." I understand that there are varying degrees of vehemence in the opposition to the use of obscurity, but I am trying to clarify for myself how absolute this is.
I understand that relying exclusively on obscurity is pretty unanimously frowned upon. I'm only discussing types of obscurity which could be added to in-depth defense strategies.
For example, things like configuring hosts to not respond to ICMP echo requests (in cases where that makes sense) or sanitizing banner info in order to obscure the topology or software of my network seem like no-cost practices that make it one step harder for a non-determined attacker to target my network.
Is there some line of delineation at which everyone agrees that obscurity is a good idea, or is there something I am missing in which even these types of obscurity would be discouraged? Is there perhaps a different term or category for these types of obscurity?