Emerging Threats and Countermeasures

Responses.docx

Home >Information Systems homework help >Emerging Threats and Countermeasures

Response 1:

Top of Form

In general, if we ask any security maven or expert about their view on “security through obscurity” we would most probably receive some religious arguments, specifically from cryptographers claiming hiding information doesn’t ensure security. They strongly claim that any firm or industry trying to hide implementations, design is probably trying to just conceal flaws. Also, these arguments are widely published and broadcasted across various social media and other mediums by attackers as there is a solid advantage for them to catch security vulnerabilities if more data is exposed. Security through obscurity can be described in two scenarios firstly through long-term hiding of vulnerabilities which involves in hiding the security vulnerabilities for long time, which can be debated either way and second one is Long-term suppression of information where the operators deliberately suppress the basic or general information about the company or firm which prevents from being attacked. If the available public knowledge increase with time and reach a threshold point which is enough for an attacker to mount an exploit which results in security through obscurity scheme failure. A simple example for this which may be little relevant, earlier companies used to store username and password in a traditional database directly, which has later changed by encrypting with a private key. Still that has been exploited by attackers as they use rainbow tables attack which can still crack the above scenario. Now currently we are using salting mechanism where we add a random string to the upcoming password and hash it. So now if we go one step back if we have not exposed the way we were storing and hide the mechanism the company would have been under major attack at some point. So Security through obscurity is not recommended for long-term protection as a primary control, but it remains excellent complementary control in many cases in short term for various security problems in infrastructure. A simple example for this could be we don’t have to expose companies design patterns, architecture diagrams, configurations, codebase etc. Security through obscurity can be understood in the context of discretion. To protect some major infrastructure resources any firm can rely on discretion and to ensure discretion they have to rely on security through obscurity.

While coming to protecting national infrastructure security through obscurity has its own benefits a simple example would be during an steady state attack these principles lower the attack rate which helps the defense mechanism to find the attacker. Which means it serves as primary defense principle which is a major advantage. On the other hand there are some disadvantages of using security through obscurity which we have already discussed what will happen if we hide something for too long but I would like to bring a new point if the trusted entities which are managing the system gets corrupted in simple word if the narrowed down individual of a security team helps or performs attacks as they already know the flaws it would be very difficult to overcome that situation.

Response 2:

An impediment to adequate discretion is the poor comprehension and malevolent conception of security through obscurity. According to Amoroso (2011), most security experts believe that individuals who try to secrete a design, its implementation, or operational data are concealing flaws. STO (security through obscurity) is the dependence on secrecy in software development to reduce the chance of detecting and targeting a weakness. Security through obscurity is typically accomplished by developing secret codes, safeguarding them from unauthorized admission, and retaining the software’s proprietary. The approach is most efficient when combined with other measures since on its security through obscurity is obsolete (Rouse 2019).

Going by Amoroso (2011), security through obscurity is describable through long-term vulnerability concealment and suppressing information. Regarding hiding vulnerabilities, he argued that system operators should conceal the presence of some exploitable fissures as their fundamental. Long term methods of securing their systems rather than eliminating flaws. Basically, by exposing the secret, it's game over. Another example is the cryptography concept, whereby it’s sacrilegious to link the security of their system on the algorithm secrecy (TDK Technologies, 2019).

William (2012) suggested that security through obscurity is relevant in providing discretion using three security elements, namely logic, physical, and premises security. Logical security indulges in providing computer-based protection against communication and software-based vulnerabilities. On the other hand, physical security safeguards information systems that harbor data and individuals who operate, use and preserve the systems as well as enhance logical security by preventing physical intrusion or access.

A good scenario of where security through obscurity applies is the non-standard CAPTCHAs. Some of such forums bear arithmetic problems, text boxes, or trivia questions which limit spammers as most of them careless to customize their script for contemptable forums. Nonetheless, Michael and Sean (2013) postulated that security through obscurity isn’t always practical. They regarded a binary as an example citing that secrets therein do not forever remain secrets since some attackers are excellent.

Bottom of Form