#NSBCS.138 - Security Through Scrutiny: Why Good Security Should Survive Inspection
Security through Scrutiny
Intuitively, obfuscating or restricting access to code as a security measure is a concept called Security through Obscurity. However, hiding code will only restrict access to seeing enough of it to replicate its code. They may be able to replicate its actions, however, the code will likely look incredibly different. In this way, ticking Private during the creation of a GitHub repository will keep it a secret and away from prying eyes.
This, however, does not keep it secure, an idea commonly associated with secrecy. Another common idea is that using open-source software is insecure and a security threat and, at first thought, it may seem that more eyes equal to more people and thereby more chances for a security flaw to be exploited.
With over 100,000 computers running on GendBuntu, an operating system based on Ubuntu, France’s National Gendarmerie has been ahead of the many EU countries who are now pledging to shift their government employees to using Linux over Microsoft Windows.
Their adoption of Linux came after Microsoft’s decision to end development for Windows XP, which would have forced them to retrain their staff on newer versions of Windows, leading to increased spending on training and licensing.
To some, this may seem dangerous, but on the other side of the same coin is the other idea, where more people looking at the code will also equal more people being able to point out flaws and remediate them.
Secrecy is not Security
An attacker’s aim is not to look at code for the purposes of replicating proprietary functionalities. Their aim is to understand a system by probing it to find avenues of attack. Secrecy may slow an attacker down by making their reconnaissance more difficult; however, it only slows them down.
Many of the standards used by computers all over the world for the purpose of encryption, to enable users to be able to have private conversations with their friends and families, are actually open standards. These standards aren’t strong because they’re hidden from people trying to snoop in on a conversation. They’re strong because they have provably withstood the scrutiny of many thousands of mathematicians and computer scientists trying to find flaws in their implementation.
A prime example of this is the family of cryptographic hashing functions called Secure Hash Algorithm (SHA). A secure hashing function should produce a unique output, called a digest and commonly denoted as a hash, for any unique input and be irreversible, making it incredibly useful when storing the passwords of users on an application. It is incredibly important that no two different inputs produce identical outputs, a way to think about it is two different passwords should not lead to the identical digests. The event where two inputs lead to identical digests is called a collision and is the goal of an attacker.
The SHA-1, which followed the original SHA standard, was published in 1995 and designed by the USA’s National Security Agency (NSA) for the public to see and analyse.
In this way, it allowed for the crowdsourcing of its analysis, consequently leading to theoretical and eventually practical methods to perform hash collisions. In 2017, Google and CWI Amsterdam demonstrated the first practical SHA-1 collision.
While this may seem like a good point against its openness, this actually demonstrated the value of public scrutiny. From 2007 to 2012, the National Institute of Standards and Technology held a public competition for the third iteration of SHA, called SHA-3. This algorithm was designed, not by the NSA or NIST, but by independent researchers. Keccak, designed in 2008 by Guido Bertoni, Joan Daemen, Michaël Peeters, and Gilles Van Assche, was submitted to NIST as a candidate for SHA-3 among 64 other entries.
SHA-3 is a prime example of how this openness to scrutiny ultimately led to stronger and more secure algorithms due to the rigorous testing, not only by NIST, but also by independent researchers who would’ve been incentivised to find flaws in each other’s algorithms.
How it all comes together
Security through Scrutiny, as opposed to Security through Obscurity, fosters stronger standards and raises the bar for security by encouraging systems to be tested against informed and capable adversaries rather than relying on secrecy as a defence.
Clear-box testing follows this same principle: giving trusted testers greater visibility into a system does not mean willingly exposing its flaws to attackers. Instead, it allows weaknesses to be identified and remediated under controlled conditions, before they can be discovered and exploited in the wild.
Don’t just trust your security. Test it.
NSB Cyber's Offensive Security team helps identify and validate vulnerabilities before attackers can exploit them, using controlled, real-world testing across networks, applications, cloud environments and more.
What we read this week
German State of Schleswig-Holstein Advances Digital Sovereignty Through Open-Source Migration - The German state of Schleswig-Holstein is progressing an ambitious programme to move its public administration away from Microsoft software toward open-source alternatives. Approximately 30,000 civil servants are transitioning from Microsoft Office to LibreOffice, with email shifting to Open-Xchange and Thunderbird, and collaborative document editing moving to Nextcloud. A Linux pilot is also under way. Digital minister Dirk Schrödter reports that Office licence numbers will be reduced by more than two-thirds in the near term, with the goal of eliminating nearly all Microsoft Office licences by 2029. The initiative is framed as a matter of digital sovereignty rather than purely cost savings, drawing parallels with Europe’s earlier energy dependence lessons. While some teething problems have been reported (including calls from judges to revert to Outlook), the project is being watched closely by other European administrations.
Schneier on the 2005 Cryptanalysis of SHA-1 and the Need for Hash Function Migration - In a February 2005 analysis, Bruce Schneier discussed the first practical collision attack against SHA-1 that was faster than brute force, developed by Chinese cryptographers. The attack reduced the complexity of finding collisions from the theoretical 2⁸⁰ operations to approximately 2⁶⁹. Schneier emphasised that while the result did not immediately break real-world systems, it signalled that SHA-1’s collision resistance was no longer adequate and that migration to stronger hash functions (such as the SHA-2 family) should begin. He noted the historical pattern that attacks improve over time and advocated for a formal competition to design a next-generation hash standard, similar to the AES process. The piece remains a clear illustration of how cryptographic primitives age and why proactive replacement is essential.
CISA, FBI and HHS Update Advisory on Medusa Ransomware Hitting Over 500 Critical Infrastructure Organisations - US agencies released an updated joint cybersecurity advisory on Medusa ransomware, confirming that the ransomware-as-a-service operation has impacted more than 500 victims across critical sectors including healthcare, defence, manufacturing, government, IT and financial services as of April 2026. The group uses an affiliate model, pays initial access brokers up to $1 million, exploits unpatched internet-facing vulnerabilities (sometimes within hours of disclosure), and employs double-extortion tactics. Healthcare remains a frequent target. Organisations should prioritise rapid patching, network segmentation, restriction of remote access services, and reporting of incidents to relevant authorities.
US Agencies Warn of AI-Generated Scripts Targeting Siemens S7 PLCs in Critical Infrastructure - NSA, CISA, FBI, Department of Energy and EPA issued a joint advisory describing an active threat in which attackers use AI-generated exploitation scripts to target internet-exposed Siemens S7 Series programmable logic controllers. Sectors at risk include critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities. Actors leverage open-source libraries and AI assistance to create tools that mimic legitimate monitoring software. Organisations should inventory affected PLCs, apply the latest firmware, remove internet exposure, strengthen authentication, and monitor for anomalous activity.
University of Texas at San Antonio Cyberattack Disrupts Student Systems Ahead of Term Start - The University of Texas at San Antonio took multiple IT systems offline following a cyberattack, affecting student registration, payments and other services days before the start of the fall semester. The incident forced delays to the academic calendar for thousands of students. Educational institutions should review incident response plans, maintain offline backups, and ensure rapid isolation capabilities for critical student-facing systems.