Conventional wisdom says:
- Security through obscurity doesn’t work. You may hide your needle in a haystack, but it’s likely to come back and stick into you (or someone who will sue you) when you least want it to. Much better to lock your needle in a safe.
- You shouldn’t roll your own controls: whether crypto, or software, or architectures, or procedures. The wisdom of the crowd is great, and the vendor can afford better security expertise than your own project can, because the vendor can amortise the cost over a much broader base than you can ever manage.
And yet, when I want to protect an asset against a fairly run-of-the-mill set of threats, it’s very far from clear to me whether that asset will be safer if I protect it with COTS products or if I build my own, perhaps quirky and not necessarily wonderful, product.