A frequent topic of conversation amongst IT people and system administrators in particular is security through obscurity. Most experienced system administrators will tell you that there is no real security to be gained through obscurity. Is this true or have they failed to properly consider the whole story?

A common example of security through obscurity, at least on Unix/Linux based systems, is to run SSH on a port other than its default 22. So what is gained by doing that? Well, if your system doesn’t take any serious measures to prevent port scans it might gain you a few seconds of time before the alternate port is discovered, which is not really worth the effort. To use an analogy, it’s a bit like removing the lock from your front door and relocating somewhere else on your house. If you let potential intruders wonder allover you property it won’t be long before the lock is discovered.

Now let’s look at what there is to gain if the system, or the firewall in front of it, has decent anti-port scan measures in place. As an example, the firewall I has its port scan detector tripped when three different ports are tried from a single source address within a certain amount of time. Given that there are 65,536 possible port numbers the odds of an attacked finding the correct one are very low indeed.

A hopeful attacker will first try the default port. Unless it gets lucky and locates the correct port on the next two attempts then for all practical purposes it will appear to that source that my system is no longer on the Internet. Using the front door analogy, it’s somewhat similar to having armed guards and vicious watchdogs patrolling your property.

If the attacker uses a distributed port scan (scans from multiple source addresses) the odds are definitely better but unless we’re talking about several thousand sources the odds of finding the correct port during a single scan are still pretty low. It’s a bit like having multiple intruders on your property trying to dodge the guards and dogs while looking for the lock.

What does all this mean in the real world? Security through obscurity is of no real value on its own. However, when used as part of an overall toolkit that includes anti-port scan measures there can be quite a significant advantage. So the next time someone tells you security through obscurity is a waste of time maybe you should wonder about just what they have done for security, as it’s likely to be nowhere near enough.