Measures that produce a visible feeling of safety without materially changing risk, because the audience is the point.
Schneier popularised the term in 2003 for security measures he judged to give reassurance or visibility without commensurate risk reduction, applying it extensively to post-9/11 airport screening. Whether any particular measure is theatre requires separate evidence about its security effect.
In practice
- The candidate test is whether the measure would stop an attacker who knew about it.
- A password policy requiring quarterly changes produces predictable passwords, and the visible rigour is the whole of the benefit.
- Further reading
- Wikipedia
- Subject
- Risk & Reliability
- Essay
- How much caution, and the jokes about its limits