Bruce Schneier linked back today to an excellent essay he wrote in 2002 outlining the definition of security by obscurity, and why systems that depend upon it are fragile.
One group of people knows how the cockpit door reinforcement was designed. Another group has programmed screening criteria into the reservation system software. Other groups designed the various equipment used to screen passengers. And yet another group knows how to get onto the tarmac and take a wrench to the aircraft. The system can be attacked through any of these ways. But there’s no obvious way to apply Kerckhoffs’ Principle to airline security: there are just too many secrets and there’s no way to compress them into a single “key.” This doesn’t mean that it’s impossible to secure an airline, only that it is more difficult. And that fragility is an inherent property of airline security.