# Security Theater

> A defect in which visible security controls leave the real threat unreduced, or can be bypassed.

Record: `architecture:security-theater`
Kind: anti-pattern
Layer: [Enforcement Core](https://banes-lab.com/records/layer/enforcement-core.md)
Severity: discouraged
Scope: security_governance, model_governance
Canonical: https://banes-lab.com/ontology#architecture-security-theater

Listed in [Architecture principles](https://banes-lab.com/api/records/architecture.md), after [Read-Your-Writes Violation](https://banes-lab.com/records/architecture/read-your-writes-violation.md) and before [Authorization Scattering](https://banes-lab.com/records/architecture/authorization-scattering.md).

## Repair

- Refactored by: threat_model, server_side_enforcement, penetration_test, [policy_as_code](https://banes-lab.com/records/architecture/policy-as-code.md)
- Detected by: control_not_linked_to_threat, bypass_endpoint, client_only_security, audit_passes_but_attack_succeeds
- Violated by: Add visible security controls that do not reduce the actual threat model or can be bypassed by alternate paths.
- Measured by: controls not linked to a threat, bypass paths found
- Enforced by: threat-model review, penetration tests

## Severity

- [discouraged](https://banes-lab.com/records/vocabulary/severity-discouraged.md)

## Category

- [Anti-patterns](https://banes-lab.com/records/architecture-category/anti-patterns.md)

## Force

- [Model governance](https://banes-lab.com/records/force/model-governance.md)
- [Security governance](https://banes-lab.com/records/force/security-governance.md)

## Negated by

- [Threat Modeling](https://banes-lab.com/records/architecture/threat-modeling.md)

## Linked from

- [From intent to predicate](https://banes-lab.com/software-architecture/coverage/an-architecture-is-its-predicate-set.md)
- [Anti-patterns](https://banes-lab.com/ontology/principles/architecture-category-anti-patterns.md)
- [Security / Privacy / Compliance / Governance](https://banes-lab.com/ontology/principles/architecture-category-security-privacy-compliance-governance.md)
- [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lexicon-category-security-privacy-compliance.md)
- [Failure shapes](https://banes-lab.com/ontology/reasoning/the-failure-shapes.md)
- [Severity levels](https://banes-lab.com/ontology/schema/the-vocabulary-severity.md)
- [The forces](https://banes-lab.com/ontology/schema/the-forces.md)