I have always been amused that folks who say "security through obscurity is stupid" are never willing to give me their passwords.
It's all about threat prioritization and defense in depth.
It's all about threat prioritization and defense in depth.
It's about obscuring the architecture of a system in order to protect it. And I agree this shouldn't be a tactic. It can be a byproduct of your disclosure strategy (i.e. AWS don't disclose how their products are built) but not a security mechanism (i.e. AWS don't meet all the certification standards BECAUSE they're not disclosing how their products are built). Just my 2 cents.