Every security control binds someone. Walk your stack and ask, for each control, who actually feels it: whose day it makes longer, whose work it interrupts, whose behaviour it changes. For a surprising share of what runs under the name of security, the honest answer is the employees, the customers, and the engineers who follow the rules. The attacker is not on the list.
Enforcement needs someone who holds still
To enforce a rule you need a subject who is identifiable, reachable, and willing to obey. Legitimate users are all three: they are in the directory, on managed devices, and they comply, because their job depends on it. Attackers are none of the three. They are not in the identity provider, not on the endpoint agent, and rules are exactly the thing they have opted out of.
So a control programme under pressure drifts toward the population it can control. There is no malice in it, and each individual policy sounds defensible in the meeting that approves it. But the drift has a direction, because one side responds to friction with tickets and the other side does not respond at all. It routes around.
The pattern is older than IT. An institution that can no longer reach its actual problem starts regulating the people it can still reach, and the busywork looks like action. It is the corporate lasagna's move, run by a security team: the layer that cannot fix the system polices whoever still obeys it.
One side files tickets about the friction. The other side routes around it.
The catalogue
The shape repeats across the standard enterprise stack. Put any of these controls next to the attack it claims to stop and the same picture appears: the cost lands on people doing their jobs, and the attack path does not cross the control at all.
| Control | What the compliant pay | Where the attack actually goes |
|---|---|---|
| 90-day password rotation | Password7 becomes Password8; resets, lockouts, notes in drawers | a phished or breached credential that works today, well inside any rotation window |
| Blanket USB ban | no sanctioned way to move large files; personal cloud accounts appear within weeks | exfiltration leaves over HTTPS, like all other traffic |
| Pattern-matching DLP on mail | quarantined contracts, false positives, sales escalations | an encrypted archive, or the sanctioned file-sharing SaaS |
| Ever-growing proxy blocklists | developers cut off from docs and registries; allowlist tickets age for weeks | command-and-control fronted through the CDNs you cannot block |
| Bastion chains, VDI with clipboard disabled | admins retype what they cannot paste, hop three jump hosts to run one command | whoever reaches the session screen-scrapes it, or retypes from the screen they already see |
The last row shows how the pattern escalates. When a bastion does not stop intrusions, the answer is another bastion, and then a clipboard lock, and then screenshot blocking. Each layer is more work for the admin and no new obstacle for whoever already holds the session, who can read the screen and retype from it. The stack grows in the one direction that binds only the compliant.
The first row is the best documented. NIST withdrew the advice behind periodic rotation and composition rules in 2017: forced changes produce predictable increments, and the guidance now says to change a password on evidence of compromise, not on a calendar. The UK's NCSC said the same a year earlier, and Microsoft dropped password expiry from its Windows security baseline in 2019, calling it an obsolete mitigation. The policy survives anyway, in audit checklists and procurement questionnaires, because it is easy to enforce and easy to evidence. That combination should worry you, and the next section is about why.
Why the theatre wins
A control that binds the compliant generates evidence: rotations completed, mails quarantined, sites blocked, training modules passed. A control that sits on the attack path generates mostly silence, because its success is the thing that did not happen. Put both in front of a dashboard and the theatre control wins every review. It has numbers, and the numbers go up.
A control that binds the compliant produces dashboards. A control that binds the attacker produces silence.
This is the measurability problem applied to security: the system rewards what it can measure, and obedience is measurable in a way that absence of compromise is not. The audit loop completes the mechanism. An auditor asks for evidence that each control operates; the theatre control has a folder ready, so the theatre control is the one that survives the budget review. The same logic that keeps a human in the loop as a governance checkbox keeps the password policy in the baseline: it performs control, which is cheaper and more visible than exercising it.
The bill
Calling this theatre understates the damage, because the costs are not only the absence of protection. They compound in three ways:
- Friction. A daily cost to everyone who obeys, multiplied across the organisation, paid in resets, tickets, and waiting.
- Trust. People learn that security means obstacles, so they stop asking permission and start finding routes. Every route they open is unmanaged surface: the personal cloud account, the forwarded mailbox, the laptop that never joins the VPN. Shadow IT is rarely rebellion. It is the sanctioned path failing quietly.
- False coverage. The control's own numbers say it is working, so the gap it does not cover looks covered. The next control does not get funded, because this one already owns the line item.
The second cost deserves its own sentence, because it inverts the moral framing: the user who routes around a control is not the adversary. The route they were forced to open is the vulnerability, and the control built it.
Bind the path
The test is one question, asked early: who does this bind? Take the attack the control claims to stop and walk it step by step, as the attacker would. If the control never appears on that walk, it is not a control. It is a cost imposed on the people who were never the threat.
The fixes share a shape: they sit on the attack path instead of the user's path.
- Password rotation and composition rules become phishing-resistant MFA and breach-triggered resets: bind the credential's failure mode, not the user's memory.
- The USB ban becomes a provisioned transfer path plus monitoring at the exits: give the compliant a sanctioned way to move data, and monitor the exits the data actually leaves through.
- Mail-regex DLP becomes an egress allowlist and classification where the data lives: control where bytes may go, not which sentences look suspicious.
- Human blocklists become workload allowlists: a server has no business browsing, so bind the server tightly and leave people their browsing.
Notice the property the good controls share: the person doing legitimate work barely sees them, and the attack cannot proceed without meeting them. That is the exact inverse of the catalogue above, and it is the whole design goal.
Enforcement drifts toward whoever holds still. Budgets follow evidence, evidence comes from the obedient, and the drift is quiet right up until the incident that never touched a single control you could show an auditor. The discipline that resists it costs one question per control, asked before the rollout instead of after the breach. Bind the path, not the person.
Every security control binds someone, and for a surprising share of the standard stack, the honest answer is: the employees, not the attacker. Enforcement needs a subject who is identifiable, reachable, and obedient. Legitimate users are all three. Attackers are none, so weak control programmes drift toward regulating the people they can reach.
| Control | Compliant pay | Attack goes |
|---|---|---|
| 90-day rotation | Password7 to Password8, resets, lockouts | phished credential, valid today |
| USB ban | shadow cloud accounts | exfiltration over HTTPS |
| Mail-regex DLP | quarantined contracts | encrypted archive, sanctioned SaaS |
| Proxy blocklists | developers cut off from registries | C2 fronted through allowed CDNs |
| Bastion chains, no-paste VDI | admins retype what they can see | whoever holds the session screen-scrapes it |
NIST withdrew the rotation and composition advice in 2017, NCSC in 2016, Microsoft dropped expiry from its baseline in 2019. The policies survive because they are easy to enforce and easy to evidence.
Why theatre wins. A control that binds the compliant produces metrics: rotations done, mails blocked, trainings passed. A control on the attack path produces silence, because its success is the thing that did not happen. Dashboards and audits reward the first kind.
The costs compound:
- friction: a daily cost to everyone who obeys;
- trust: people stop asking and start routing around, and every workaround is unmanaged surface;
- false coverage: the control's numbers look healthy, so the real gap never gets funded.
The user who routes around a control is not the adversary. The route they were forced to open is the vulnerability.
The fix. Ask of every control: who does it bind? Walk the attack as the attacker; if the control is not on that walk, it is a cost imposed on the wrong people. Then move it onto the path: phishing-resistant MFA instead of rotation, a provisioned transfer path plus egress monitoring instead of a USB ban, egress allowlists instead of mail regexes, tight workload allowlists instead of human blocklists. Good controls are barely visible to legitimate work and unavoidable for the attack. Bind the path, not the person.
Sources
- NIST SP 800-63B, Digital Identity Guidelines (2017): verifiers should not require periodic password changes or composition rules; passwords change on evidence of compromise.
- NCSC (UK), "The problems with forcing regular password expiry" (2016): the case that scheduled expiry does more harm than good, from the UK's national authority.
- Microsoft, Windows security baseline for version 1903 (May 2019): password-expiration policies removed from the baseline as an obsolete mitigation of low value.
- Verizon Data Breach Investigations Report, recurring finding across years: stolen credentials and phishing sit at the top of breach actions, none of which a rotation calendar interrupts.
- The companion pieces: The case for egress allowlists, the canonical path-binding control; The corporate lasagna, the same drift inside the org chart; and Human in the loop is theater, on controls that perform instead of protect.