News Targets

Steve Gelsi

Forbes.com / 05.28.97, 12:00 AM ET ?

With more people turning to the Internet each day for news, you would think news sites would by now have perfected technology to protect against hackers. The Central Intelligence Agency's site has been vandalized, news organizations such as The New York Times' have been the victims of everything from the "ping of death," a nasty way to keep people off a site by flooding it with superflous requests, to unauthorized rewrites of its homepage. Appropriately enough, the site for the movie Hackers was mutilated by hackers who added mustaches to the faces of movie stars.

Despite the public embarrassments, industry insiders say web pages remain open to attack.

"A lot of people think they can just throw up a firewall [a type of security software] and then they're done," says former hacker Bruce Fancher, now president of Evolution Software in New York City's Silicon Alley. "Most systems administrators don't have the time to keep track of all the possible holes."

The good news is that greater security is possible, but it's not cheap. Top security consultants cost $100 to $200 per hour to identify vulnerabilities in web pages. Firewall software is also expensive--usually $10,000 and up, and, is in the words of one hacker in Forbes ASAP "crunchy on the outside, chewy on the inside." The best solution: Locate the site at a high-end ISP and let its experts monitor the server 24 hours a day. It may seem expensive at first, but it's still cheaper than doing the same thing in-house. Forrester Research, the Cambridge, Mass. think tank points out that a basic, 24-hour web site with a dedicated server, including security, costs about $42,000 from a better ISP, compared with self-cost of $100,000-plus for hardware and security staff. ISPs like UUNet are wary of denial-of-service attacks--the ping of death. Despite occasional attacks, the Interet thus far is less fraud-ridden than cell phones and long-distance services, says Forrester's director of network strategies, Carl Howe.

But that's little comfort for hacker-wary purveyors of news web sites. After all, it's the brand value of a news organization that helps it cut through the clutter in the increasingly competitive web news arena. And it's this brand value that hackers ultimately threaten. ?