" This approach would also help protect computer systems from unauthorized access by insiders as well, he says (3). In the spirit of "fight fire with fire," Rowe says that because computer hackers typically use deceptive practices (e.g., impersonation, viruses/worms, and denial of service attacks), it just makes good sense to turn the tables on the hackers by using honeypots and honeynets to collect the kinds of information required to do so. Citing examples from nature, Rowe points out that deception is a common defensive tactic, but it can also be used in a more offensive way by deceiving hackers into staying in the system as long as possible; in some cases, though, the author emphasizes that security considerations would require that the hacker simply be disconnected rather than tricked into staying in the system as long as possible. By keeping the system responses as realistic as possible during these episodes, Rowe suggests that computer security professionals will be in a better position to tie up the hacker's resources while as much information as possible can be collected about them. The author even provides an analysis of how to develop a fuzzy logic approach to determining the hacker's potential to believe in such realistic - but fake - system responses...

Rowe then offers several vignettes and examples to illustrate how these deceptive responses can be used to defeat unauthorized intrusions and use the data that is collected during the intrusion to develop even better protective approaches in the future (3).
Works Cited

Rowe, Neil C. "Designing Good Deceptions in Defense of Information Systems." Monterey CA: Cebrowski Institute, U.S. Naval Postgraduate School.

End Notes

1) This is perhaps the most interesting part of this analysis; by suggesting that security professionals take what hackers universally understand about computers and turn it against them, Rowe immediately succeeds in developing a high degree of interest in this essay.

2) Rowe says that "Honeypots are systems with no purpose except to encourage attacks so data can be collected, and honeynets are networks of honeypots."

3) The most interesting part of this essay is also the most disturbing. The fact that security analysts are devoting valuable resources to these initiatives rather than to developing superior access controls in the first place suggests that the task may not be "do-able," at least at the present time.