What is Security Theater
In my previous posts I’ve mentioned the term “Security Theater”. I stole this phrase from a former manager, mentor, and close friend Evan Curry, (check out his LinkedIn!), and it has resonated with me for years. To put it simply, Security Theater is the appearance of Security. It’s putting on a show, checking a box, taking actions to satisfy compliance without improving your security posture. In essence, it makes managers, directors, auditors, and execs feel good, but it’s often just a more generous representation of your organization’s security posture.
I want to level set before I keep going. I’m going to be bashing bureaucracy in this post. Please do not interpret this to mean that I think regulations, frameworks, audits, governing bodies, etc. are wastes of time or money, because I don’t. Cybersecurity frameworks are essential to proper governance and improved security posture. These frameworks take best practices into account and help security managers and others build out programs. I’m not bashing the theory of these things, I’m bashing the implementation of them.
What’s My Problem With Bureaucracy?
Again, don’t break out your torches and pitchforks. I’m a fan of frameworks and regulations (as much as anyone can be I guess) and they are important. It’s the implementation that’s the sticking point. At some point the meaning behind the checkboxes gets lost and subsequently, the actions lose their meaning.
For example, check out NIST SP 800-50 Rev.1 . This is a well written, in-depth guide on how to build a cybersecurity awareness program. 87 pages of how to successfully build a program that can achieve an increase in user awareness and a decrease in successful phishing attacks. Now look at the questionnaire on your last audit. I’m sure there is a question on there regarding security awareness training that probably reads something along the lines of “Does your organization conduct regular security awareness training?”.
87 pages of information distilled into one sentence feels unfair. Of course it’s impractical for auditors to ask other questions such as “Have you seen an improvement in your metrics from your security awareness testing?” or “Has user engagement improved? Are they reporting more messages as phishing?”. Auditors leave these unasked questions to the security managers, but the process slowly starts to give managers tunnel vision. It’s like taking a test that you already know the answers to, and slowly your security program is built to pass the test instead of demonstrating a workable understanding of the content.
It All Comes Down To Motivations
People’s actions come down to motivation. Security Theater persists because it serves the interests of everyone in the supply chain, not just your organization's actual security. Executives want to minimize liability and satisfy the board. A passed audit does that. Auditors want clean, defensible reports. Checklists do that. Security managers want budget, headcount, and job security. A certified program justifies all three. Nobody in that chain is acting in bad faith necessarily, they're just following their incentives which all point to the same place: the checklist.
“Men are moved by two levers only: fear and self-interest.” ― Napoleon Bonaparte
This is why it's worth stepping back and asking yourself what you actually want out of your program. Not what the auditor wants. Not what satisfies your CISO's quarterly report. What would make this program genuinely harder for an attacker to work around?
The Final Act
That’s the definition of Security Theater. A term I shamelessly stole and will continue to use for the rest of my career. It’s not evil, and it’s not pointless, but it can lead to lackluster security programs. Don’t fall for the premise that a passed audit means your program is top shelf. It is the yardstick we have to measure our programs and report them to executive leadership, but always remember that security programs are processes of continuous improvement.
Start small and pick a program that’s near and dear to your heart. This is your opportunity to take something that has been ignored and breathe some life into it and give it meaning and substance. Find something that excites you, or that you haven’t squeezed every bit of value out of, and reinvent it (Apologies for the prose, but this is one of my favorite parts of my job). Review your utilization of your products, I’m sure there’s some functionality that hasn’t been tapped yet. This starts to create opportunities to make top-down improvements by starting at the policy level and working down. Stop performing security. Start practicing it.