3 ms·
Ehh the majority of companies practice security by obscurity as an extra layer. There's the idea in security that an attacker knowing your algorithm/practices
by arduinomancer 6y ago
Ehh the majority of companies practice security by obscurity as an extra layer.
There's the idea in security that an attacker knowing your algorithm/practices shouldn't mean anything yet you rarely see companies detail the security measures they take on internal systems because we know keeping this secret has no downside.
- austincheney 6y agoPopularity does not validate stupidity. Security policies at most companies are often generic and not secret. Reporting chains for emergency remediation and asset identification are secret because those identities are potential attack vectors. Information sensitivity of that nature means it must be protected from disclosure and not that it should otherwise be hidden. The key phrase for sensitivity management is: need to know.