This Infoworld column illustrates something I’ve talked about before, but have never given a name. I’ll start calling it the “Everyone is a security expert” syndrome. I’ve alluded to it in the following blog entries:

• News Flash: Security is an Architecture
• History Lost
• The Same Old Drum Beat

In the above-cited column, Roger A. Grimes, makes the declaration, “Security by obscurity: It works!” and states:

Almost every computer security “expert” alive repeats the mantra that security by obscurity is no security at all, despite overwhelming evidence to the contrary. I propose that it should be a valid part of any computer defense plan, and in fact, can be one of your best defenses.

Before writing angry hate mail to your new security columnist, let me explain further. First, I did’t say security by obscurity was the only defense technique someone should use. I didn’t even say it was real security, but I am saying that it should be an important part of most computer defense strategies.

I read that and shook my head in dismay. Not because he is wrong. But, because he thinks this is a new idea. Except that none—no not one—of the computer and network security experts I know would or have ever said that. It is an often misstated security axiom (I list as a “bogon” in my list of security axioms), that is more correctly stated, that depending or relying soley on obscurity for security is misguided and gives a sense of security that is false. I say this in a February 2001 Letter to the Editor of Information Security Magazine, wherein I say in part

…surely there is nothing wrong with security through obscurity. Keeping secret keys secret is an excellent example of this, and we count on it for much of the crypto-based security on the Internet. What many security professionals rail against is depending completely, totally and only on security through obscurity, and doing so forever.

And in a 2001 column I wrote for WatchGuard Technologies, I wrote, “Though ‘security through obscurity’ is unwise as a sole defense, there is absolutely nothing wrong with making it harder for an attacker to attack.”

Even in early 1994, in an early firewall paper with Marcus Ranum, A Network Perimeter With Secure External Access, we wrote, “Security through obscurity is counter-productive. Easy-to-understand measures are more likely to be sound, and are easier to administer.”

And Bruce Schneier, in his May 15, 2002 Crypto-Gram Newsletter, writes about “Secrecy, Security, and Obscurity.”

So, Mr. Grimes, welcome aboard, and thanks for helping the security community to get this important message out. But, I am concerned. Your by-line would lead one to believe that you are the new “Security Advisor” columnist. How come you are just getting this?