Software Architect's Handbook

Avoiding security by obscurity

Security by obscurity, also known as security through obscurity, is the belief that a software system is secure as long as internal details are kept hidden and vulnerabilities are not known or are difficult to detect.

Software architects should not promote or encourage security through obscurity because it is a practice we would like to avoid. While it can help to provide some level of security, it is a weak security control. If it is used, it should be used in conjunction with other, stronger security controls.