internal network, or to change things on hosts in my DMZ?
When considering the above questions, keep the following in mind: * “Security through obscurity” is no security at all. Unpublished protocols have been examined by bad guys and defeated. * Despite what the marketing representatives say, not every protocol or service is designed with security in mind. In fact, the number that are is very few. * Even in cases where security is a consideration, not all organizations have competent security staff. Among those who don’t, not all are willing to bring a competent consultant into the project. The end result is that otherwise-competent, well-intended developers can design insecure systems. * The less that a vendor is willing to tell you about how their system really works, the more likely it is that security (or other) problems exist. Only vendors with something to hide have a reason to hide their designs and implementations. 3.
