This article expresses concern about the use of honeypots in the enterprise. I used to be in the same boat, and still basically believe that traditional honeypots can be time-consuming. But expanding on the capabilities slightly can lead to some interesting possibilities.

Honeyresponders (HR) respond to all scans with bogus information. As soon as a source zeroes on on the HR, it blocks the ip. The premise is that there is no reason for anyone to be accessing services on the HR (because by definition there are no functional ones) and so every source headed in that direction must have malice in mind.

Honeytokens deserve a lot more attention. Most often, they take the form of bogus data inserted into legitimate datastores. Anybody accessing the data should be reviewed to understand why. The hard part here is just keeping track of the records. This type of solution would be valuable for "insider threat" monitoring.

By the way, I think all security researchers and ISPs should be deploying honeypots to really ascertain what is going on on the 'Net.

This article illustrates a problem that is so symptomatic of our space, I want to scream. So, folks, what are we doing wrong? Somehow, this CEO thinks that installing encryption and fraud detection software after an incident is somehow adequate.

"'We are making certain what limited information is on [the laptops] is encrypted. We don't think there's any sensitive information on them. But we're acting in an abundance of caution with respect to those laptops,' BankRI President and CEO Merrill Sherman said."

How ludicrous is that? How come we never hear all of the other banks say "Since Bank of RI got their information stolen, we realize that it could just as likely happen to us, and so we are installing encryption and fraud detection software before we get hit."?

"I think this is unsporting of the New York Times," Lamo said Thursday.

Some telling paragraphs:

"Wexler said Baxter contacted the FBI after a tech support staffer told executives on June 13 that Dasari had duped him into helping copy the files onto discs. Asked if Baxter had made a criminal complaint against Dasari, Wexler said, "We are cooperating fully in an investigation of our former employee." Wexler said both the FBI and federal prosecutors are involved."

"Baxter representatives could not name a dollar amount in damages the company would suffer if the secret files were made available to Bayer or other competitors. Baxter's hemophilia treatment Recombinate brings in $1 billion a year in revenue, Wexler said, and competes directly with a Bayer product."

Most likely, the reason they can't 'place a value' on the data is that they want to squeeze as much juice as possible out of this fruit tree. One plausible method is to evaluate the data to determine whether it can make Bayer's product better or reduce the market share of the drug. Perhaps it is a percentage point off the top or some reduced lifetime of the drug itself - say if its patent expires and Bayer could bring a generic to market quicker with the data.

Plenty of talk about addressing terrorism can be applied to securing an enterprise. This article discusses how Game Theory (and "Beautiful Mind" subject John Nash's Equilibrium Theory) apply to terrorism.

Some choice quotes:

"'When one kind of attack becomes more difficult or expensive, terrorists substitute other, cheaper kinds,' says Prof. Sandler." [Professor Todd Sandler from USC]

"The best move is not to protect targets. If you secure Disneyland, terrorists may go after Sea World. The effective strategy is to reduce terrorists' resources: Go after training camps and arms caches, choke off financing, infiltrate networks."

"'Countries spend more and more, but don't necessarily become more secure,' says Prof. Sandler."

Some fascinating comments that address the neverending need to bolster security (or collectively do nothing and completely reorient our security approach). The final quote really nails the issue with cybersecurity as well.

Though it doesn't specifically address information security, this article about a reporter who played loose with the facts describes well the challenges security professionals face.

You probably need a subscription to view the article, so here are some choice quotes:

"Do we have a system designed to uncover venality? No, we don't, and you know something, I guess I am not unhappy with that," Mr. Sulzberger said. "I don't want us to become a police state where you suspect every employee of ripping off the company." [Note: Sulzberger is the Times publisher.]

And another:

The Times account avoided pinning blame on anyone but Mr. Blair, paraphrasing Mr. Sulzberger as saying, "there will be no newsroom search for scapegoats." Mr. Sulzberger said, "the person who did this is Jayson Blair." "Let's not begin to demonize our executives -- either the desk editors or the executive editor or, dare I say, the publisher."

And let's round it out with this one:

"This is not a Howell problem, this is not an Arthur Sulzberger problem -- this was a bad man doing bad things," Mr. Sulzberger said.

Obviously, I am no newspaper expert. But it would seem to me that fact checking is a pretty straightforward requirement for any newsroom, particularly of the Times' reputation. It is a 'perfect' response to 1) water down the need for controls; 2) treat the symptom and ignore the disease; then 3) deny any responsibility in building a weak control environment.

Perhaps it is no surprise that the Times was hacked last year (click here for one account of that incident).