Everyone has heard the mantra, “Security through obscurity is no security at all.” I hope that people remember where it came from – when companies were announcing proprietary cryptographic algorithms, everyone pointed out that cryptanalysis is an almost impossible task to get right, so you couldn’t really know how secure your algorithm was unless it had been peer-reviewed.
But this comes up every few days, when people discuss security systems and architectures. And there, I contend, obscurity is the single most important component of every security system. Because let’s face it, there is no such thing as perfect security. So every architecture has its holes.
The job of a good security professional is to reduce those holes; to make exploiting the holes more expensive than the value of doing so, and to implement layered security systems so that attackers are unlikely to make it all the way through a system without tripping an alarm somewhere. Without obscurity, that’s impossible.
Put another way, an attacker, or even a neutral party, has absolutely no need to know the details of your architecture.