The cursor blinks. It’s the only thing moving. A patient, rhythmic pulse of digital judgment on a field of white. You’ve been here before. The box demands your new password. Below it, the rules, a litany of cryptographic sins you must not commit. Must not be one of your previous 22 passwords. Must be at least 12 characters. Must contain an uppercase letter, a number, and a symbol. Cannot contain your username, your pet’s name, or any sequence of more than 2 repeating characters.
The blinking continues, a tiny, digital heartbeat counting down your sanity. You try one. Password does not meet complexity requirements. You try another, mashing the shift key with the fury of a betrayed lover. New password cannot be substantially similar to old password. Finally, you create a monster. A string of gibberish so profound, so utterly alien to the human mind, that you know in your bones you will never, ever remember it again. A fleeting sense of victory is immediately replaced by cold, practical dread. You grab the nearest Post-it note, scribble gZp!72#kF@b2 on it, and stick it to the bezel of your monitor.
gZp!72#kF@b2
Security Theater: The Blame Game
And there it is. The entire farce, condensed into a three-inch square of yellow paper. The system, in its infinite, algorithmic wisdom, has forced you to create a password so secure you can’t trust your own brain with it. The result isn’t security. The result is a brightly colored, publicly displayed security vulnerability. This isn’t a bug in the system. This is the system’s primary feature.
We call it security theater. A collection of rituals and procedures that provide the feeling of security while doing very little to achieve it. It’s the corporate equivalent of putting a flimsy lock on a screen door. It stops no determined adversary, but it allows the homeowner to say they took ‘reasonable precautions’.
This is the core of it all: liability transfer. The goal isn’t to protect the company’s data. Not really. The goal is to create a labyrinth of policies so convoluted that when the inevitable breach happens, the blame can be neatly and legally placed upon the employee who failed to follow rule #232, sub-section B. You didn’t change your password in the allotted 42 days. You wrote it down. You clicked the link. It’s your fault. The corporation is absolved. The insurance company is satisfied.
From Incompetence to Strategy
A strategy that treats employees not as the first line of defense, but as the primary internal threat to be managed and, ultimately, blamed.
The Clockmaker’s Delicate Touch
Consider my friend, Iris B. She’s a restorer of antique grandfather clocks. Her workshop smells of lemon oil and old brass. Her tools are delicate, specific, and have been in her family for generations. When she works on a 200-year-old movement, a symphony of gears and escapements, she doesn’t use a sledgehammer. She uses a tiny pair of tweezers to place a gear that’s smaller than a fingernail. She understands the system as a whole. She knows that a heavy-handed fix in one area will just create catastrophic failure in another. Pushing too hard on one lever will strip a gear somewhere else. The entire mechanism is an ecosystem of trust between its parts.
Corporate IT, in contrast, has been given a sledgehammer and told that every problem is a nail. Your password isn’t strong enough? Sledgehammer. You need access to a file? Sledgehammer. You need to log in from home? Two sledgehammers, and you have to answer a call on your phone to prove you’re the one holding them.
The Scalpel of Social Engineering
This approach fundamentally misunderstands the nature of modern threats. While we are busy inventing un-memorable passwords, the real danger is walking right through the front door disguised as a friendly email. Last week, Iris was working on a particularly ornate clock for a client overseas. An email arrived, supposedly from him. The grammar was a little off, the tone slightly too urgent. It spoke of a new payment method, requesting she look into a service for handling large sums with something called عملات جاكو to settle the final invoice of $22,772. Her password, a 14-character monstrosity, offered zero protection against this. Her human intuition, her understanding of context and her client’s normal behavior, was the entire security system. She deleted the email and called her client, who confirmed he’d sent no such thing.
This is where the trust erosion becomes so dangerous. By treating people like untrustworthy cogs, we train them to outsource their thinking to the system. We teach them to blindly click “accept” on endless pop-ups, to find the cleverest ways to circumvent security for the simple sake of getting their work done. I confess, for years I had a system. I’d use the same core password everywhere, but I’d add a different symbol and number combination at the end for each site. It passed the complexity checkers, but it was a house of cards. A breach on a single, unimportant forum could have compromised everything. I was performing security theater for myself, born from the frustration of having to manage 42 different, equally absurd password policies.
The most secure system is the one people will actually use.
That’s it. That’s the secret. The constant multi-factor authentication prompts that interrupt your workflow don’t make you more secure; they train you to approve any request that pops up on your phone just to make it go away. The password that expires every 42 days doesn’t protect the company; it ensures a predictable cadence of forgotten passwords and calls to the help desk, costing thousands in lost productivity.
Building on Trust, Not Blame
What would a system built on trust look like? It would focus on behavior and context, not on punishing rules. It would trust that a login from your corporate-issued laptop, on the company network, at 10:00 AM on a Tuesday is probably you. It would save its suspicion for a login attempt from a new device in a different country at 3:00 AM. It would educate its users on what a real phishing attempt looks like, empowering them to be the human firewall that Iris B. was. It would value clarity over complexity. It would understand that the goal is to make security so seamless that the easy way to do things is also the secure way to do things.
Contextual Behavior
Trusting known patterns, flagging anomalies.
Empowered Users
Education over punishment, human firewall.
Seamless Security
Easy way is the secure way, clarity wins.
But that doesn’t create the same paper trail. It doesn’t provide the same irrefutable proof for the lawyers that the company did everything it could, that the fault lies with the individual. The theater is not for the benefit of the audience. It’s for the producers. Until that changes, the Post-it notes will continue to bloom on our monitors, a silent, yellow protest against a system that has forgotten who it’s supposed to protect.