BlogInfoSec.com

The New York Times recently ran a piece on airport security in which airport security is described as the “theater of the absurd.” It’s funny to watch certain terms and concepts play themselves out from a small community (infosec) to the larger pop culture. A few comments below the piece mention “security theater” but the term is not used in the larger article. It makes me wonder if “security theater”, “theater of the absurd” or simply “theater” will win as the dominate popular term for security measures taken that do not correct the root issue.

I happen to have strong feelings about the term “security theater.”

Personally I’m against the term “security theater.” Red tape makes changing the infrastructure at the root cause difficult. That’s the unfortunate reality. The intermediate steps are usually band-aids — especially when an immediate response is necessary — while the larger issue is being addressed at its core. These band-aids — temporary solutions — are what are usually designated as “security theater.” They do have a positive value: they comfort the end user for that situation. Temporary solutions should not replace long-term solutions that fix the root issue.

Time is the key factor between when something is a valid “security theater” and when it’s not. “Security Theater” should be shouted when the temporary measures become the permanent measures and the root cause has not been addressed. It should not be shouted when a band-aid solution is used as a response to an immediate problem. This leaves the possibility of an architectural design error. Bad design is not “theater”; it’s not pretending to correct an issue and skirting the root cause. Bad design is simply that: bad design. And, there may be many reason why such architectural design errors happen.

I was very happy when Schneier wrote In Praise of Security Theater:

Security is both a reality and a feeling. The reality of security is mathematical, based on the probability of different risks and the effectiveness of different countermeasures. We know the infant abduction rates and how well the bracelets reduce those rates. We also know the cost of the bracelets, and can thus calculate whether they’re a cost-effective security measure or not. But security is also a feeling, based on individual psychological reactions to both the risks and the countermeasures. And the two things are different: You can be secure even though you don’t feel secure, and you can feel secure even though you’re not really secure.

It’s only a waste if you consider the reality of security exclusively. There are times when people feel less secure than they actually are. In those cases — like with mothers and the threat of baby abduction — a palliative countermeasure that primarily increases the feeling of security is just what the doctor ordered.

Bookmark this post

•Sphere: Related Content•  Print

Related Articles:

• FUD Theater: MSNBC reports sporting events now possible terror targets
• FUD Theater: Microsoft, Vista, Vendors and the Media
• FUD Theater? Turkish Hackers drains 10,580 bank accounts
• Schneier Jumps on the FUD Theater Bandwagon
• FUD Theater: Is it freezing in that road house?