How Small Business Can Fight Internet Hackers

(page 3 of 3)

Then Baranovsky's team had to take a backup of the company's data from the day before the attack and reload that on the server, recreating several days' worth of work. The company's Web site was offline for two hours. "The Web site is our storefront, and so it is like any other business when you close the doors during business hours," Baranovsky says. "You don't know what you have lost and whatever leads we may have had coming in." The other cost is credibility, Baranovsky says, in an era when customers and potential clients expect Web sites to be up 24/7.

Overly simple passwords and the lack of a data backup plan led to a damaging hack attack against Nolcha, a New York consulting firm with six employees and $800,000 in annual revenue. "It was nerve-racking and frightening. It was like I had no control," says Kerry Bannigan, Nolcha's CEO. Early this year, Bannigan says she was awakened in the middle of the night by the company's Web site manager. Hackers in Turkey had shut down her company's site and replaced it with their own insignia. Nolcha, which consults in the fashion industry, had extensive blogs and thousands of images from fashion shows and events on hundreds of pages. All of them were corrupted. Worse, Bannigan's outside Web programmer hadn't backed up her data. "It made things tough for the whole week, and for weeks after, letting the clients know we were all O.K.," she says. It took 48 hours to fix the technical problems and two weeks to reassure her clients.

Bannigan's Web programmer suspects an easily guessed password for the administrative panel on the site enabled the attack. Now Bannigan uses more complex passwords and changes them frequently. She makes sure her staff doesn't share them with anyone. And she's making regular backups.

It's also critical to keep in mind that Internet threats are evolving. In the coming years, PDAs and smartphones will become more common routes for attacks, experts say. Such attacks are already on the rise in Asia, says Vincent Weafer, vice-president of security response for Symantec. For entrepreneurs, that means never taking their eyes off the ball when it comes to Internet security. "As a business owner, we all wear 20 hats, and now I have to be the Web guy, too," Bannigan says.

Return to the BWSmallBiz December 2009/January 2010 Table of Contents

Quittner is a staff writer for BusinessWeek in New York.