1444
CWE-656: Reliance on Security Through Obscurity
Weakness ID : 656
Structure : Simple
Abstraction : Class
Description
The product uses a protection mechanism whose strength depends heavily on its obscurity, such
that knowledge of its algorithms or key data is sufficient to defeat the mechanism.
Extended Description
This reliance on "security through obscurity" can produce resultant weaknesses if an attacker is
able to reverse engineer the inner workings of the mechanism. Note that obscurity can be one
small part of defense in depth, since it can create more work for an attacker; however, it is a
significant risk if used as the primary means of protection.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 693 Protection Mechanism Failure 1520
ChildOf 657 Violation of Secure Design Principles 1446
PeerOf 603 Use of Client-Side Authentication 1354
CanPrecede 259 Use of Hard-coded Password 623
CanPrecede 321 Use of Hard-coded Cryptographic Key 785
CanPrecede 472 External Control of Assumed-Immutable Web Parameter 1123
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1011 Authorize Actors 2425
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1006 Bad Coding Practices 2422
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Alternate Terms
Never Assuming your secrets are safe :
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Other
Other
The security mechanism can be bypassed easily.
Potential Mitigations
Phase: Architecture and Design
CWE Version 4.14
CWE-656: Reliance on Security Through Obscurity
CWE-656: Reliance on Security Through Obscurity