Actually, I think that the rapid blossoming of firewalls everywhere in the late 90s was the first big step toward security theatre that I noticed in my career,

Actually, I think that the rapid blossoming of firewalls everywhere in the late 90s was the first big step toward security theatre that I noticed in my career, and illustrate how we have a cultural problem. Blocking access according to port number is no substitute for lack of control and visibility over what services are spawned where.