What is Security Theater?

Question

Security Theater, or Security Theatre in British English, has been mentioned in many posts on this site.

What does Security Theater mean?

What are some examples?

Is it the greatest threat to actual security?

Answer 1

One good example of security theater (which has now been taken down, probably due to the ridicule) is Wells Fargo's page which does nothing but state that it is establishing a secure connection, etc.

An even better example that is rife with many instances of security theater is United's PIN and Password FAQs:

• The section "Why can't I type my own security answers?" indicates that there is a pre-defined list of answers for the security questions. This results (as explained) from their narrow focus on the one threat that they think must be the most important: Keyloggers. Thus, they present a theater of restriction on security answers (that don't need the keyboard), which are insecure in the first place due to Social attacks.
• The section on marketing use of security questions indicates that the answers to the security questions are encrypted. This is complete security theater since, as mentioned above, the answers are pre-defined. What could you possibly be protecting by encrypting them?

As security blogger Bruce Schneier explains, security theater, or perceived security, is not necessarily a threat to real security if it is in place on top of real security (for instance, if all data at that Wells Fargo page is actually transmitted over a secure connection) instead of replacing real security (such as if they displayed that animation on a page with HTTP components). Security Theater can even be helpful at times, such as the RFID tags Schneier mentions, which don't do a lot to stop intelligent criminals, but do set people's minds at ease about a threat that was minimal to begin with.

However, if people begin to rely too much on a façade of security (without the real security underlying it), Security Theater can be worse than useless, because users will reveal private information or perform other trusted actions that can be disastrous in the wrong hands.

Answer 2

Security Theater is any process or mechanism which makes users, developers, managers, or other stakeholders perceive a system as "more secure" without actually providing significant protection against any real threat. (Or worse, the "security measure" may actually decrease security by opening the system up to new attacks.)

Notable examples include security seals on websites, overly complicated password complexity requirements, and disabling pasting on password fields.

Answer 3

Security theater is a procession that in some sense or another let’s a person think this increases security while it actually doesn’t (or at least not much).

An example might be the security checks at air ports that have not yet stopped terrorists but make people perceive flying as safe.

This isn’t a threat to security for itself; it can lead to reduced security that really helps (because, well, „one is already safe, why the hassle?“) though.