I'm a little worried they are learning security by obscurity works.
Or security by not really being connected to everything works, but that second lesson isn't as bad.
Anyway. I need to find my white hat.
@futurebird - To back you up and add encouragement, I always teach folks that:
- *Relying on* security by obscurity is bad, but...
- Obscuring things can increase the "attacker's budget" and therefore help to lower risk.
(It's a similar discussion to the difference between "cover" and "concealment" in the military now that I think of it. Anyhow.)
And your second point of not being connected to everything absolutely lowers the attack surface thus lowering risk as well.
You've lead them to wonderful opportunities to discuss nuance in security and it's further wonderful that you are having these discussions with the students in the CS group!
That's awesome and so needed right now! Thank you!