In 2009, security consultant and current chief technology officer of IBM Resilient Bruce Schneier wrote about the concept of security theater. “Security theater refers to security measures that make people feel more secure without doing anything to actually improve their security,” he wrote. At the time, there was a lot of fear about information security and a sense of urgency to stem the tide of cybercrime.

Since then, we have learned that fearmongering is counterproductive. Tactics such as creating ID checks and banning liquids and gels from carry-on luggage aren’t really effective. As each measure is put in place to try to protect the public, there are others created to defeat them. Often, these techniques just create more problems.

Setting the Scene

In an earlier article, however, Schneier explained that security theater can be effective under certain circumstances. On a visit to a newborn unit at a local hospital, for example, he noticed that the babies were wearing radio frequency identification (RFID) tags around their ankles. The tags triggered an alarm when a baby passed through the doors, which were equipped with sensors.

Now, the risk to infant abduction from a hospital ward is quite low — about 1 in 375,000 babies, if you average things over the past several decades — and far lower than infant deaths. But that isn’t really relevant. In this case,”RFID bracelets are a low-cost way to ensure that the parents are more relaxed when their baby was out of their sight,” he explained.

The benefits of using RFID technology — in this case, parents’ peace of mind — outweigh the relatively low cost.

Don’t Write Off Security Theater

Yes, the RFID tags are security theater, but they are necessary. “Most of the time security theater is a bad trade-off, because the costs far outweigh the benefits,” Schneier wrote. “But there are instances when a little bit of security theater makes sense.” The potential cost of a lawsuit if a baby is actually abducted, for example, could easily eclipse the cost of the RFID tag program.

The trick is to balance the need for security with its eventual implementation. This holds for IT implementations, too. Sometimes we need to consider both our feelings and the realities of enterprise security.

As Schneier put it, “Security theater is no substitute for security reality, but, used correctly, security theater can be a way of raising our feeling of security so that it more closely matches the reality of security. To write off security theater completely is to ignore the feeling of security.”

More from Risk Management

Back to basics: Better security in the AI era

4 min read - The rise of artificial intelligence (AI), large language models (LLM) and IoT solutions has created a new security landscape. From generative AI tools that can be taught to create malicious code to the exploitation of connected devices as a way for attackers to move laterally across networks, enterprise IT teams find themselves constantly running to catch up. According to the Google Cloud Cybersecurity Forecast 2024 report, companies should anticipate a surge in attacks powered by generative AI tools and LLMs…

Mapping attacks on generative AI to business impact

5 min read - In recent months, we’ve seen government and business leaders put an increased focus on securing AI models. If generative AI is the next big platform to transform the services and functions on which society as a whole depends, ensuring that technology is trusted and secure must be businesses’ top priority. While generative AI adoption is in its nascent stages, we must establish effective strategies to secure it from the onset. The IBM Institute for Business Value found that despite 64%…

Ermac malware: The other side of the code

6 min read - When the Cerberus code was leaked in late 2020, IBM Trusteer researchers projected that a new Cerberus mutation was just a matter of time. Multiple actors used the leaked Cerberus code but without significant changes to the malware. However, the MalwareHunterTeam discovered a new variant of Cerberus — known as Ermac (also known as Hook) — in late September of 2022.To better understand the new version of Cerberus, we can attempt to shed light on the behind-the-scenes operations of the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today