4

In cybersecurity, we have a subject called "security theater" which means implementing a feature that only looks like a real security mechanism but doesn't do anything literally.

Is it against the law for, let say, a company to implement a layer of security which is indeed nothing but a theater (in both deliberately and indeliberately cases)?

It gives false confidence for the users of the system thinking their data are protected by the machine while it's not.

Improve this question
4
  • 8
    That's not what security through obscurity means. Security through obscurity is "it's unlikely an attacker would realize this." What you're talking about is security theater.
    – cpast
    May 5, 2020 at 1:09
  • It just needs some token port scanner or similar. Most security services are crappy so it is a low bar to meet. What you are saying is what most companies do.
    – user31975
    May 5, 2020 at 2:03
  • @cpast Yeah I think it's a security theater indeed 👍
    – Amirreza Nasiri
    May 5, 2020 at 9:47
  • How does this answer the question?
    – JBentley
    May 5, 2020 at 9:55

1 Answer 1

Reset to default
6

Given that obscurity is not security, the company potentially exposes itself to claims of:

  • Misrepresentation under consumer protection laws, or even fraud (things that you sell are not quite what you claim they are, and you know it)
  • Negligence (people rely on your goods/services to be secure as per your claim but you take this very lightly and they get burnt).
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.