A system is said to utilize "security by obscurity" if its security model is purposely unpublished so as to make it harder to figure out how to break into it.
The problems with security by obscurity are:
- You can't get feedback from others outside your organization on potential security holes.
- Other people who have to rely on your system (usually your clients) can't verify that your system is really secure.
The benefit is that it does make a system significantly harder to break into.
See also MeatBall:SecurityByObscurity , but that page is not talking about what is usually meant by "security by obscurity".