CommunityDevOps ExchangePartners
Articles
10/18/2021
10 minutes

Why Security Through Obscurity Is No Match for a Hacker

Written by
Copado Team
Table of contents

The first thing any organization needs to know about security through obscurity is that it's not a technique. With it, companies make a mistake that puts them at a disadvantage when faced with an attack on their network. It may make theoretical sense to some, but in practice, this policy of obfuscating system information does more to help hackers than hinder them.

System transparency is far more beneficial to organizations that want to protect their network and respond to threats proactively. It helps both developers and their customers understand the various components in their system and locate issues that could lead to vulnerabilities.

What is Security Through Obscurity?

Security through obscurity is the practice of “hiding” information, presumably to keep it out of the hands of bad actors. A straightforward explanation is when a company requires a person to have a specific URL—which isn’t published or linked from the site’s navigation—to get onto a site or portion of a webpage. The theory in this is that no one will accidentally guess a link, so as long as it's hidden and only given to certain people, it's safe.

That's exactly how the practice of "Zoom bombing" was born. At the pandemic's start, many schools had to move classes online and took advantage of meeting-specific links. They'd share those with students, under the belief that only they would be able to access the meeting. However, it wasn't long before bad actors took advantage of it. There was a rash of incidents where uninvited guests showed up to meetings, said inappropriate things, or shared objectionable content. Of course, this issue stemmed from the pandemic's rapid digital transformation, where individuals weren't entirely aware of the necessary precautions for the technology they used. At the same time, reliance on security through obscurity could be to blame. In the Zoom bombing cases, it created a false sense of security that led teachers and students to assume they were secure just because the link was private.

At an organizational level, security through obscurity is even riskier. Junior members of the IT department may hide the components that make up their system. They'll create paths that are difficult to follow and understand to keep bad actors from mapping their softwares and locating the vulnerabilities within. However, hackers are experts at breaking down the various software components of a system. Hiding information will do very little to dissuade them. What it will do is enable an undocumented vulnerability. People responding to threats won't know where to look to locate issues and resolve them. They'll have to waste valuable time mapping the system first.

Using Transparency to Drive Security

There are some situations where security through obscurity will work, but they are small, isolated segments that act as additional layers and not as the primary system protection strategy. Camouflaging user passwords within binary code or hiding the versions of a software used (but not the software itself) are two common examples of security through obscurity tricks. These only work in conjunction with other strategies; they're not the primary method of system protection, but instead avoid granting an attacker easy answers or insights. A determined actor could still gain that information, but they’ll have to work for it. There’s no reason to make their job easy!

Transparency is a far better method of managing security. It's so effective that the federal government recently issued an order requiring it. Under the Executive Order on Improving the Nation’s Cybersecurity, all government software vendors must create a machine and human-readable Software Bill of Materials (SBOM) to go with products. Organizations will have to publish all the smaller software packages that make up their overall system so users know what is in them. The idea is that with the SBOM, organizations can quickly respond to threats and share intelligence. When vulnerabilities arise, they stem from a specific component of software. With the SBOM, the organization may note that they have this piece of software and can take steps to mitigate issues.

Even organizations not impacted by the executive order mandating SBOMs should consider adopting their own. A detailed map of their system will put them ahead of threats by showing where vulnerabilities lie. This process can be automated by security teams who will use the SBOM to cross-check with other cyber threat intelligence tools and enhance safety.

Security through obscurity should never be a primary means of defense. It's entirely dependent on secrets—and once that secret is out, the entire plan falls apart. Transparency is the vital component that will help organizations proactively address issues and minimize their vulnerabilities.

 

 

Book a demo

About The Author

#1 DevOps Platform for Salesforce

We Build Unstoppable Teams By Equipping DevOps Professionals With The Platform, Tools And Training They Need To Make Release Days Obsolete. Work Smarter, Not Longer.

Building a Scalable Governance Framework for Sustainable Value
Copado Launches Copado Explorer to Simplify and Streamline Testing on Salesforce
Exploring Top Cloud Automation Testing Tools
Master Salesforce DevOps with Copado Robotic Testing
Exploratory Testing vs. Automated Testing: Finding the Right Balance
A Guide to Salesforce Source Control
A Guide to DevOps Branching Strategies
Family Time vs. Mobile App Release Days: Can Test Automation Help Us Have Both?
How to Resolve Salesforce Merge Conflicts: A Guide
Copado Expands Beta Access to CopadoGPT for All Customers, Revolutionizing SaaS DevOps with AI
Is Mobile Test Automation Unnecessarily Hard? A Guide to Simplify Mobile Test Automation
From Silos to Streamlined Development: Tarun’s Tale of DevOps Success
Simplified Scaling: 10 Ways to Grow Your Salesforce Development Practice
What is Salesforce Incident Management?
What Is Automated Salesforce Testing? Choosing the Right Automation Tool for Salesforce
Copado Appoints Seasoned Sales Executive Bob Grewal to Chief Revenue Officer
Business Benefits of DevOps: A Guide
Copado Brings Generative AI to Its DevOps Platform to Improve Software Development for Enterprise SaaS
Celebrating 10 Years of Copado: A Decade of DevOps Evolution and Growth
Copado Celebrates 10 Years of DevOps for Enterprise SaaS Solutions
5 Reasons Why Copado = Less Divorces for Developers
What is DevOps? Build a Successful DevOps Ecosystem with Copado’s Best Practices
Scaling App Development While Meeting Security Standards
5 Data Deploy Features You Don’t Want to Miss
Top 5 Reasons I Choose Copado for Salesforce Development
How to Elevate Customer Experiences with Automated Testing
Getting Started With Value Stream Maps
Copado and nCino Partner to Provide Proven DevOps Tools for Financial Institutions
Unlocking Success with Copado: Mission-Critical Tools for Developers
How Automated Testing Enables DevOps Efficiency
How to Keep Salesforce Sandboxes in Sync
How to Switch from Manual to Automated Testing with Robotic Testing
Best Practices to Prevent Merge Conflicts with Copado 1 Platform
Software Bugs: The Three Causes of Programming Errors
How Does Copado Solve Release Readiness Roadblocks?
Why I Choose Copado Robotic Testing for my Test Automation
How to schedule a Function and Job Template in DevOps: A Step-by-Step Guide
Delivering Quality nCino Experiences with Automated Deployments and Testing
Best Practices Matter for Accelerated Salesforce Release Management
Maximize Your Code Quality, Security and performance with Copado Salesforce Code Analyzer
Upgrade Your Test Automation Game: The Benefits of Switching from Selenium to a More Advanced Platform
Three Takeaways From Copa Community Day
Cloud Native Applications: 5 Characteristics to Look for in the Right Tools
Using Salesforce nCino Architecture for Best Testing Results
How To Develop A Salesforce Testing Strategy For Your Enterprise
What Is Multi Cloud: Key Use Cases and Benefits for Enterprise Settings
5 Steps to Building a Salesforce Center of Excellence for Government Agencies
Salesforce UI testing: Benefits to Staying on Top of Updates
Benefits of UI Test Automation and Why You Should Care
Types of Salesforce Testing and When To Use Them
Copado + DataColada: Enabling CI/CD for Developers Across APAC
What is Salesforce API Testing and It Why Should Be Automated
Machine Learning Models: Adapting Data Patterns With Copado For AI Test Automation
Automated Testing Benefits: The Case For As Little Manual Testing As Possible
Beyond Selenium: Low Code Testing To Maximize Speed and Quality
UI Testing Best Practices: From Implementation to Automation
How Agile Test Automation Helps You Develop Better and Faster
Salesforce Test Cases: Knowing When to Test
DevOps Quality Assurance: Major Pitfalls and Challenges
11 Characteristics of Advanced Persistent Threats (APTs) That Set Them Apart
7 Key Compliance Regulations Relating to Data Storage
7 Ways Digital Transformation Consulting Revolutionizes Your Business
6 Top Cloud Security Trends
API Management Best Practices
Applying a Zero Trust Infrastructure in Kubernetes
Building a Data Pipeline Architecture Based on Best Practices Brings the Biggest Rewards
CI/CD Methodology vs. CI/CD Mentality: How to Meet Your Workflow Goals
DevOps to DevSecOps: How to Build Security into the Development Lifecycle
DevSecOps vs Agile: It’s Not Either/Or
How to Create a Digital Transformation Roadmap to Success
Infrastructure As Code: Overcome the Barriers to Effective Network Automation
Leveraging Compliance Automation Tools to Mitigate Risk
Moving Forward with These CI/CD Best Practices
Top 3 Data Compliance Challenges of Tomorrow and the Solutions You Need Today
Top 6 Cloud Security Management Policies and Procedures to Protect Your Business
What are the Benefits of Principle of Least Privilege (POLP) for My Organization?
You Can’t Measure What You Can’t See: Getting to know the 4 Metrics of Software Delivery Performance
How the Public Sector Can Continue to Accelerate Modernization
Building an Automated Test Framework to Streamline Deployments
How To Implement a Compliance Testing Methodology To Exceed Your Objectives
Cloud Security: Advantages and Disadvantages to Accessibility
Copado Collaborates with IBM to Accelerate Digital Transformation Projects on the Salesforce Platform
Continuous Quality: The missing link to DevOps maturity
Why Empowering Your Salesforce CoE is Essential for Maximizing ROI