slightly related news article:

American National Standards Institute :: Internet Security Alliance and American National Standards Institute Announce New Collaboration for Improving Information Security
http://sev.prnewswire.com/computer-electronics/20060915/NYF02815092006-1.html

recent post mentioning some of the efficiency issues related to armoring transactions with strong authentication as opposed to perpetually having to hide all the information.
http://www.garlic.com/~lynn/aadsm25.htm#25
http://www.garlic.com/~lynn/aadsm25.htm#27

i.e. is information security oriented towards preventing bad things ... or is it oriented towards hiding information as the only mechanism for preventing bad things?

old long winded post on the thread between risk management and information security
http://www.garlic.com/~lynn/aepay3.htm#riskm

and of course earlier entries on naked payments:
https://financialcryptography.com/mt/archives/000745.html
https://financialcryptography.com/mt/archives/000744.html
https://financialcryptography.com/mt/archives/000749.html

older news article

Bank workers biggest ID theft threat
http://deseretnews.com/dn/view/0,1249,600145529,00.html

and old post: Study: ID theft usually an inside job
http://www.garlic.com/~lynn/aadsm17.htm#38

of course a lot of this predates current uptic in phishing ... where getting victim to divulge relatively trivial information like their account number ... can precipitate fraudulent transactions (again, another characteristic of naked transactions).

(long winded) post discussing catch22 for the pki domain name certification industry with regards to possible implications of DNSSEC deployment:
http://www.garlic.com/2006f.html#33