The False Allure of "Security by Obscurity": A Game-Theoretic Approach

Abstract

"Security by obscurity," or the idea that hiding how a system works helps protect it from adversaries, has long been poorly regarded in the security community. Yet its intuitive appeal persists, and it has resurfaced repeatedly in industry practices and public debates over the years. The logic, on the one hand, is that open scrutiny of systems is the best way to find and respond to problems; and on the other hand, that too much openness can increase risk by giving adversaries a roadmap for attack. This isn't purely a technical question, but a human one: it's about how attackers and good-faith security researchers respond to openness in the real world. As such, security experts base their stance on decades of community experience; however, the field lacks empirical or theoretical foundations to back up these long-standing beliefs. We provide the first rigorous modeling of "security by obscurity," aiming to capture how rational actors will respond to openness or obscurity in fallible systems. We prove that in equilibrium under realistic model conditions, "obscured" systems are more likely to suffer successful attacks than "open" systems --- establishing theoretical support for the longstanding received wisdom.