Just today, I was asked for a recommendation in coming up with a name for a new forum - in a custom niche. I know this sounds easy, but it seems that every conceivable combination of English words has been taken, and is currently either active or parked. The registrar always suggests other combinations, but I’ve yet to find one in my queries that fits what I’m  searching for.

Maybe this is just one of my many pet peeves - but an astonishing number of domains are parked, especially with highly competitive keywords. Cracking that egg requires a sledge hammer the size of my SUV. I did find one this morning I really liked, but the sale price was over $6000.00. My budget is around $12

There are services where you can sell and purchase domain names - like SEDO, but then I’d miss the challenge and frustration, and sometimes the thrill of finding a name that is actually available.

Xen™ – is a virtual machine environment that supports execution of multiple guest operating systems with outstanding levels of performance and resource isolation. Xen is Open Source software, released under the terms of the GNU General Public License.

Servers with – quad core processors and GB’s of RAM are ideally suited to employ virtualization to present the illusion of many smaller virtual machines, each running a separate operating system.

Virtual machines – on one dedicated server are isolated from one another, allowing concurrent execution of multiple operating systems – without allowing the execution of one to adversely affect the performance of another partition.

XEN Hypervisor – is a layer of software running directly on the server’s hardware, replacing the operating system, which allows that server’s hardware to run multiple guest operating systems concurrently. It becomes the interface for all hardware requests such as CPU, I/O, and disk for the guest operating systems.

Server virtualization benefits

• dynamic fault tolerance against software failures (through rapid bootstrapping or rebooting)
• hardware fault tolerance (through migration of a virtual machine to different hardware)
• the ability to securely separate virtual operating systems
• the ability to support legacy software as well as new OS instances on the same computer

I remember when I first learned how to use print screen - to capture screen images. I thought to myself, “Wow, imagine the possibilities!” Technology has advanced so rapidly, it’s impossible for one person to keep pace with new developments and software, even with something as seemingly simple as screen capture programs.

Doing a Google search for “screen capture programs” just now returned over  – 37 million results. Some of the more highly recommended programs are:

SnagIt 10 by TechSmith® (free trial/$39.95)

Snagit gives you the tools you need to create engaging images for presentations, feedback, tutorials, and training documents.

The only con I saw was that it could only save video files in .AVI format.

FullShot 2012 by InBit. (free trial/$49.99+)

FullShot is a professional screen capture (print screen) application designed for any Windows user who needs an effortless, effective way to take screenshots of Windows screens. It’s perfect for capturing on-screen images you want to include in manuals, training handouts,presentations, marketing materials, and web pages.

Cons - This product doesn’t seem to offer the ability to capture video clips.

Jing and Jing Pro - by TechSmith® (free versus $14.95/year)

Jing Free - SWF Video | 5-Minutes of Screen Recording | Mark-Up Tools for Images | Screencast.com Free Account

What do I use? – the FREE version of Jing because it fits what I do for now. If you need to produce MPEG-4 videos, I highly recommend Jing Pro as it offers the best combination of features vs price.

Five nines or 99.999% relates to - the up time availability of data centers. Prospective clients look for uninterruptable uptime as a prerequisite to constitute reliability of a data center, but what is acceptable to one may be inadequate to another. Accordingly, this expectation of uptime relates to a demand for computer reliability. Data center infrastuctures include a variety of critical physical layer environmental sub-systems that must integrate cohesively. Among those are power and cooling. If a system is deemed ‘fault tolerant,” this means it can sustain a worst case, unplanned event and NOT disrupt the end user.

The Four Tiers of Data Centers

Tier 1

It has non-redundant capacity components and single non-redundant path distribution paths serving the site’s computer equipment.

Tier 2

A tier 2 data center has redundant capacity components and single non-redundant distribution paths serving the site’s computer equipment.

Tier 3

A tier 3 data center has redundant capacity components and multiple distribution paths serving the site’s computer equipment.

Tier 4

This is a fault tolerant data center with redundant capacity systems and multiple distribution paths simultaneously serving the site’s computer equipment.

A tier rating for an entire site is limited to the rating of the weakest subsystem that will impact their operations.

Hostirian is named Best VPS Host by Best Free Web Space because of the quality of service and the best virtual private server (VPS) technology they use. In this Hostirian review we will take a look at some of the best web hosting services they have to offer as well as a little about the Hostirian company, in an effort to help webmasters figure out if this is the best web hosting service for his/her needs. Hostirian was started in 2001 and is part of the River City Internet Group. Hostirian manages over 5,000 servers in a 30,000 square foot datacenter, making it possible for them to offer top of the line VPS hosting options. In addition to top of the line technology, Hostirian focuses on providing the very best web hosting customer support.

At Hostirian,  customers will have the option to contact customer service through their toll free 800 number, integrated ticket system, and live chat options for both pre and post sales service. These are just a couple of the elements that Best Free Web Space feels makes Hostirian one of the best web hosting services around. In addition, Hostirian offers several web hosting options to meet the needs of the most customers. Choose from shared web hosting, cloud hosting, a virtual private server, dedicated server and more. Having so many options makes it possible for many different websites to perform very well on the Hostirian web hosting service.

VPS hosting plans start as low as $4.95 per month and include 256 MB dedicated memory, 10 GB disk space, 100 GB monthly bandwidth and a 2.4 GHz Xeon processor. In addition to the Hostirian VPS Starter Package they have four other VPS plans to choose from, each offering additional dedicated memory, disk space, monthly bandwidth, and Xeon processors. For a webmaster that has an established website that is having performance issues, because of the available resources on a shared web hosting plan, moving to a VPS plan could be the perfect answer. A virtual private server uses a partition to provide each VPS account with dedicated allotments of resources as well as the ability to choose the operating system, reboot the server, or take advantage of other administrative rights that one would usually only have with a dedicated server.

The fact that Hostirian has more than 10 years of experience in the web hosting industry is a good indication that they provide a reliable web hosting service that is stable and secure. Hostirian reviews from actual customers tell about the reliable uptime and exceptional customer service they have enjoyed with Hostirian.  Whether you are new to the web hosting business and just need a basic shared web hosting plan or if you have been around for a while and are looking for a more specialized service like a managed server, disaster recovery, cloud hosting and more; Hostirian offers affordable, professional services to meet all your web hosting needs. Signing up with Hostirian is easy and secure. Visit the Hostirian website to learn more about the best VPS hosting options. Watch for Hostirian promos like the current 20% off new VPS hosting plans, when you “like” Hostirian on Facebook.

For any other questions about the Hostirian service, contact them by phone, email or live chat. The Hostirian support is available all the time and they take pride in providing every customer with the tools and service needed to build and maintain a successful website. Take a few minutes to read the hosting articles and  the frequently asked questions to learn more about the Hostirian web hosting service.

I read an article a few days ago describing in-depth comparisons – of the major search engines ability to recognize and combat phishing.  To my surprise, IE ranked much higher than Google, but since I’m always on Google, I thought I should research some third party tools to help secure my online travels.

The following four anti-phishing tools are presented for your review:

• AVG LinkScanner - AVG LinkScanner is a free must have for computer only running a traditional anti-virus program to prevent you from visiting bogus or infected web sites.
• TrendProtect - TrendProtect is a FREE browser plug-in that helps you avoid Web pages with unwanted content and hidden threats. TrendProtect rates the current page and pages listed in Google, MSN, and Yahoo search results. You can use the rating to decide if you want to visit or avoid a given Web page. To rate Web pages, TrendProtect refers to an extensive database that covers the following information for billions of Web pages:  Content category, Phishing scam detection, Site reputation and Page reputation.
• Norton Safe Web Lite – Norton Safe Web Lite provides a safer search experience by warning you of dangerous Web sites right in your search results, so you can search, browse, and shop online without worry. Norton Safe Web Lite is FREE to anyone who wants protection from unsafe Web sites and disreputable online merchants. It’s our way of giving back to the online community.
• BitDefender Anti-Phishing Free Edition - Committed To Stopping Cyber-criminals In Their Tracks! Whether you’re a current Bitdefender customer or not, our goal is that everyone remains safeguarded from cyber-criminals’ tactics. That’s why we offer free virus removal tools and other free antivirus products, to ensure that every journey online is a safe one!

First, RAID is not a backup solution – always employ disaster recovery options.

I field queries about – RAID 1 (mirror) software versus hardware solutions from time to time. Both have their advantages and disadvantages. Some say adding a hardware RAID controller introduces another point of failure, but the most popular reason by far to use software RAID is cost. If you do go with hardware RAID, make sure that card is compatible with your motherboard.

With BIOS (basic input output system) RAID – you may encounter a few quirks. Essentially, it’s a poor man’s version of software RAID. Motherboards do fail, so if yours gets fried, you’ll probably have to replace it with a similar board. Taking a mirrored drive to another system won’t work if that system can’t track the drive’s volumes.

Do you want – redundancy or performance? Most of us would prefer both. I think software and hardware RAID solutions work fine for redundancy, but hardware RAID holds the advantage in performance, especially if your server is database intensive.

There are other perks to – hardware RAID solutions as well, like notification of specific drive failures. Software RAID solutions typically have problems identifying bad drives, and normally do NOT support hot swaps. The most obvious drawback to software RAID is that it uses cycles from your CPU to manage the array, and while this isn’t quite so bad in RAID 1, it can significantly slow down your server in RAID solutions that involve striping with parity.

For those of you who use multiple operating system environments, hardware RAID is the way to go. If you set up RAID using a specific operating system, only that operating system can (normally) access that array.

Software boot volume limitations – since the operating system has to be running to enable the array, (obviously) the operating system cannot boot from the array.

My recommendation – do what makes sense for your pocketbook and priorities. Software RAID is definitely less expensive, but has performance drawbacks. Hardware RAID costs more, but is feature rich and generally worth the investment.

A KVM switch (keyboard, video, mouse switch) essentially allows  - a user(s) to access multiple CPUs from a single monitor, keyboard and mouse. KVM switches are found in virtually every data center, because let’s face it; having hundreds or thousands of monitors, keyboards or mice in a DC is unrealistic.

Integrated KVM switching systems provide administrators – KVM, console, and remote power control of thousands of servers, which results in space savings, improved server management, reduced heat issues – and the bottom line, cost savings.

Data Centers typically use enterprise wide solutions – geared to Network Operating Centers (NOC), which allows their engineers to remotely access servers.

If you rent colocation space for your businesses rack servers – most KVM will usually take up 1U of space, up to a 42 port solution.  When ordering, be sure to remember rack mount kits and interface cables.

All KVMs are NOT created equal – variances can be in audio support, client platforms, supported operating systems, interfaces, sharing, remote power management and 208 volt power capability.

What about security? Enterprise level KVMs offer administrators complete control of all the devices that are attached, allowing them to set permissions for all other users.  They can create individual user profiles and assign access privileges. One example of an access privilege would be the ability to define which servers a user could view and access. Some allow time-out features for inactive users.

It seems like I see a new web hosting review site daily - and most share a common theme – their top ten web hosting providers all look like affiliate links. By affiliate links, I mean the web hosting review site owners either make a commission every time a shopper clicks thru from one of their top ten sites, or purchases hosting from them.

Sadly, the majority of review sites actually have - NO verifiable reviews. Most of the reviews I read are either from shills or disgruntled clients, or are so old, they don’t pertain to a provider’s current operations.

From Wikipedia:

A shill or plant is a person who helps another person or organization to sell goods or services without disclosing that he or she has a close relationship with the seller. The shill pretends to have no association with the seller/group and gives onlookers the impression that he or she is an enthusiastic independent customer. The person or group that hires the shill is using crowd psychology, to encourage other onlookers or audience members (who are unaware of the set-up) to purchase the said goods or services.

For shoppers searching for the best web hosting provider - web hosting review sites may NOT be the best resource. A better option would be to visit any number of web hosting forums, like WebHostingTalk or HostingDiscussion. Reviews there are verified by moderators of their respective forums. One of the prerequisites is that you have to be hosted with a provider to post a review about them – verified by your URL. As well, members of these forums weigh in on the validity or merits of each review.

Google is still one of your best friends when it comes to doing research - on web hosting providers, combined with pre-sales chats with prospective hosts.

Didn’t your Mom tell you not to play with fire? Weak passwords put your personal identity or business data at risk of being compromised. How important is password security? A simple Google search for password security just now returned over 540 million results – that’s significant! I cannot overemphasize how important it is to use STRONG passwords.

Some guidelines

• Use at least eight characters, with mixed case letters (upper and lower case)
• Use a password that can be typed quickly (to prevent over the shoulder spying)
• Mix alpha numeric characters in a seemingly random manner.
• Change your password regularly.
• Do NOT use words that are included in any dictionary – even encrypted, these can be cracked in seconds!!
• Do NOT use dates
• Do NOT use information that can be easily obtained about you. This includes your nickname, your pet’s name, your hometown, etc.
• Do NOT use all numbers or all alphabet characters – mix them!
• Do NOT reveal your password to anyone!

There are any number of websites that help you understand - how vulnerable your passwords are – one of those is http://howsecureismypassword.net/ Simply enter your password and it will return how long it would take to crack it. Mine was six thousand years, but I could improve that by using a symbol instead of just letters and numbers.

Microsoft also has a password security strength checker - located at https://www.microsoft.com/security/pc-security/password-checker.aspx. Starting at a rating of STRONG, I had to add 10 symbols to raise that level of security to BEST. Going back to HowSecureIsMyPassword, when I typed in Microsoft’s BEST, here is the result I got - It would take a desktop PC about 523 sextillion years to crack your password. Works for me!

Burst versus swap discussions are normally – comparisons of OpenVZ versus Xen memory management. There are advantages and disadvantages to each, with burst associated with VZ and swap to Xen. Assuming everything else is equal, which would you consider is the better option – 1024MB guaranteed (SLM) or 768MB guaranteed (burstable to 2048MB)?

I just read of an experiment – pairing the two technologies under load conditions. The test involved an OpenVZ container (512MB dedicated RAM with 512MB burst) versus a XEN based VPS (768MB with swap). A basic Debian 5 64 bit OS was installed on each with LAMP, email and Jabber/XMPP. The total OpenVZ memory usage equaled 445MB versus XEN’s 296MB.

So what can we take away from this test? If you’re running Java or other applications that tend to allocate large amounts of virtual memory, OpenVZ containers (without burst) will have less guaranteed memory available. Enter burst .. OpenVZ needs an appropriate amount of burst (usually 1.5 to 2 times the guaranteed).

Beyond guaranteed to burst and swap – access latency on RAM (burst) is measured in nanoseconds whereas swap (HDD) is measured in milliseconds (much much slower). Swap is slow, so you want ample guaranteed (SLM) to handle your applications. Plus, your system cannot execute stuff out of swap. It has to be in active RAM to execute. With both burst and swap, you want just enough allocation to handle inactive data, keeping as much active data in guaranteed RAM as possible.

Overselling can be – an issue with OpenVZ, e.g., killing your application if it bursts beyond the guaranteed resource allocation, instead of simply slowing down as with a true dedicated server. The kernel of Virtuozzo cannot be modified as it’s based on an OS template. By contrast (using default settings), Xen doesn’t allow overselling, so a physical server with 16GB of RAM would be limited to 64 x 256MB virtual machines. Plus, XEN allows you to fully modify the kernel, so advanced users can compile and load their own modules, resulting in properly virtualized memory, IO and scheduler – that’s stable and predictable.

Bandwidth is defined as:

Measure of data flow rate in digital networks

From Wikipedia:

In website hosting, the term “bandwidth” is often incorrectly used to describe the amount of data transferred to or from the website or server within a prescribed period of time, for example, bandwidth consumption accumulated over a month measured in gigabytes per month. The more accurate phrase used for this meaning of a maximum amount of data transfer each month or given period is monthly data transfer.

On hosting packages - one of  the features always listed is monthly bandwidth allowed. There seems to be some confusion converting Mbps to GB or TB per month, so I’ve assembled a quick reference, based on a 30 day month.

There’s a lot of controversy in web hosting circles – on how to compete with bandwidth offers, with some providers offering unlimited bandwidth on their plans, although most restrict this to shared hosting only.

Unlike most, I suppose, when I see the term UNLIMITED - I always look for the fine print, very much the same way I view the term FREE. I’m like, I know there’s a catch, but now where to find out what it is.

And I’m not saying all Unlimited offers are bad – just that it normally pays huge dividends long term to know what to expect when your website gets popular, and starts pushing a ton of traffic. Some providers handle Unlimited very well, while others will boot you in heart beat for violating their Terms and Conditions (buried somewhere in there is a clause that explains how their Unlimited offer really isn’t Unlimited).

I ran across an advertisement this morning – for Unlimited bandwidth on a dedicated server, which is very rare. I won’t say who the provider is, but here is a quote from their website:

Naturally with unlimited traffic for more cost transparency

(note that there is no asterisk on traffic)

Under benefits, they show

Traffic                   Unlimited*

(now comes an asterisk – uh oh, have to read the fine print)

At the bottom of the page, in small print

*There are no charges for overage. We will permanently restrict the connection speed to 10 MBit/s if more than 10,000 GB/month are used (the basis for calculation is for outgoing traffic only. Incoming and internal traffic is not calculated). 100 MBit/s speed can be optionally restored by committing to pay 6,90 € (incl. VAT) per additional TB used. Please see here for information on how to proceed.

So what can we glean from this clause? First, that their servers are on a 100Mbps uplink port, which is an industry standard, but it also LIMITS your data transfer to that speed. And then there’s that opening sentence about no charges for overage – but wait, what overages? I thought this was unlimited.

On to 10,000GB/month or 10TB/month – that’s a lot of data transfer, but it isn’t “unlimited.” OK, so your site has pushed in excess of 10TB so far this month, and you got hit with a notice that your port speed is now “permanently” restricted to 10Mbps, or one tenth of what they could allow.

Option 1: If you expect a continuing excess of traffic limit, we offer for 6.90 € each additional GB of bandwidth to the permanent establishment to 100 Mbit / sec.

Notice the hyperlink here in their clause on how to proceed. Seems that permanent really isn’t permanent if you start paying, but wait – the clause says 6.90 per additional TB used, but when clicking through, Option 1 states 6.90 for each additional GB of bandwidth – that’s a HUGE difference. I can’t help but think one of those is a typo.

Again, I’m not saying Unlimited is necessarily bad – just that you need to calculate the risks associated with these offers by reading the fine print first. Whether or not a provider offers limits on bandwidth or offers unlimited is not a reflection of the quality of their respective services.

Revised Oct 21, 2011

Private versus Public Cloud Solutions
Let’s face it, there are BILLIONS of dollars invested in existing IT infrastructure. As more and more enterprise vendors step into the cloud arena, will business in general migrate to the public cloud or opt instead to keep much of their investment in legacy code and custom applications in-house via a private cloud?

The future of cloud computing is up in the air (pun intended)
At this point, we don’t really know how cloud technology is going to shake out. Even if cloud technology gets huge, there’s likely to be a split between private and public clouds for the foreseeable decade. I think as the industry matures, you’ll see commodity services migrate to the public cloud and mission-critical stuff linger in a private cloud.

OK, so what is cloud computing?
Essentially, cloud computing is simply another way of delivering computing resources to run websites and web applications. It allows clients to scale their operations, horizontally and vertically, based on the demands of their users, while ensuring that there are adequate resources to support their apps. You can think of it as technology services delivered on-demand.

Traditional web hosting services are offered in packages with set limits on disk space and data transfer, so as traffic fluctuates, data and transfer needs vary resulting in excess, unused capacity during lean times.

Who could benefit from Cloud Services?
Essentially, everyone could benefit from cloud technology. Businesses that experience seasonal spikes, especially eCommerce retailers, where 80+ percent of their business peaks during holiday seasons, are prime candidates for cloud services.Cloud computing offers those businesses enough services to meet their increased traffic demands, then the option to scale back after the holidays, aligning their operating costs with revenue.

Taking the lead from the BIG vendors
Nearly all of the BIG vendors, from Microsoft to HP and IBM to CISCO, are talking cloud, with most listing their top two priorities as virtualization and cloud computing (virtualization is a cloud enabler). Google and Amazon already host public clouds while vendors like EMC are promoting solutions that virtualize existing servers and storage (private cloud).

Types of private versus public cloud solutions
As the following graphic from Microsoft highlights, there are choices to both private and public cloud services. Of course, these are not all inclusive. In the following months, I’ll address different cloud scenarios, demystifying some of the confusion about what cloud services really offer

There are over 500 pages of articles - on Wikipedia related to DDoS attacks, and a quick Google search this morning returned 3 1/2 million results. So what are DDoS attacks and should you be concerned?

I found a great definition of DDoS at TechTarget.com:

A distributed denial-of-service (DDoS) attack is one in which a multitude of compromised systems attack a single target, thereby causing denial of service for users of the targeted system. The flood of incoming messages to the target system essentially forces it to shut down, thereby denying service to the system to legitimate users.

In a typical DDoS attack, a hacker (or, if you prefer, cracker) begins by exploiting a vulnerability in one computer system and making it the DDoS master. It is from the master system that the intruder identifies and communicates with other systems that can be compromised. The intruder loads cracking tools available on the Internet on multiple — sometimes thousands of — compromised systems. With a single command, the intruder instructs the controlled machines to launch one of many flood attacks against a specified target. The inundation of packets to the target causes a denial of service.

I’ve read tons of threads about DDoS attacks - on web hosting forums, but didn’t fully realize how destructive they could be, or how hard they are to mitigate. After reading through some articles like the ones below, I’ve come to realize that these attacks can, in fact, cripple a provider’s ability to deliver stable hosting solutions to not just businesses, large or small, but to the infrastructure of governments, as well.

DDoS Attacks On the Rise in 2011

The company’s semi-annual Web Hacking Incident Database (WHID) report found the attacks jumped 22 percent from the first half of 2010, overtaking methods such as SQL injections and cross-site scripting (XSS) attacks. DDoS attacks occupied 32% of attacks while SQL injection and XSS attacks took up 21% and 9% respectively.

Head of Russian Payment Processor held over DDoS-for-Hire plot

 One of the co-founders of ChronoPay (a Russian 3PP – 3rd Party Payment Processor) was arrested on the alleged connection between him and a hacker who was hired to run a distributed denial of service attacks against a business rival. Russian Pavel Vrublevsky who is also an owner in a company called RS-Promotion …

Malware in Recent Korean DDoS Attacks Destroys Systems

 There has been quite a bit of news recently about distributed denial of services (DDoS) attacks against a number of South Korean websites. About 40 sites– including the Presidential, National Intelligence Service, Foreign Ministry, Defense Ministry, and the National Assembly–were targeted over the weekend, beginning around …

WordPress.com DDoS Attacks Primarily From China

 After recovering from the largest Distributed Denial of Service attack in the service’s history (“multiple Gigabits per second and tens of millions of packets per second”) yesterday morning, blog host WordPress.com was attacked again very early this morning, finally stabilizing its …

There is a DDoS mitigation industry devoted to - fighting these attacks, and some companies are better than others. So how would you know which DDoS mitigation company is best suited to minimize your risks? Like every other industry, longevity speaks volumes – how long have they been in business? Some questions to ask:

• What’s their track record?
• How many attacks do they mitigate each month?
• What is their typical “time to mitigate?”
• How much bandwidth do they have dedicated to mitigating attacks? (DDoS attacks take up a LOT of bandwidth)
• How is their network globally distributed?
• Which tools and techniques do they employ to detect, analyze, and mitigate DDoS attacks?

In an earlier article entitled -  ”Are your applications secure?,” I talked about SQL injection threats. It’s a threat that refuses to simply go away.

Just this morning I stumbled upon a thread on a web hosting forum - about an OP (original poster) who had his shared account terminated by his web hosting provider for being hacked twice. He was clearly the victim of the hacks, but the host deemed the OP was responsible for keeping his sites safe, so that his sites would not affect other clients on their server.

The site in question was a WordPress site - with a couple of plug ins activated – nothing out of the ordinary. It was duly noted that WordPress sites attract a lot of hack attempts, and the more popular they are (lots of traffic), the more attempts. Obviously, the OP needs to find another web hosting provider, but his troubles are probably far from over. Should he install the same plug ins on his site at his new host, the hack will most likely reoccur. Why?

One of the plug ins the OP alluded to was - Penny Auction, on which a “hack advisory” was recently issued by ngenuity-is.com.

Recommended plug ins that help fight intrusion attempts:

Login LockDown - Login LockDown records the IP address and timestamp of every failed login attempt. If more than a certain number of attempts are detected within a short period of time from the same IP range, then the login function is disabled for all requests from that range. This helps to prevent brute force password discovery. Currently the plugin defaults to a 1 hour lock out of an IP block after 3 failed login attempts within 5 minutes. This can be modified via the Options panel. Admisitrators can release locked out IP ranges manually from the panel.

WordPress Firewall 2 - This is an updated version of the popular WordPress Firewall plugin, with fixes for all known bugs and a few new features!

This WordPress plugin investigates web requests with simple, WordPress-specific heuristics, to identify and stop the most obvious attacks. There are a few powerful, generic modules that do this; but they’re not always installed on web servers, and usually difficult to configure.

This plugin intelligently whitelists and blacklists pathological-looking phrases, based on which field they appear within, in a page request (unknown/numeric parameters vs. known post bodies, comment bodies, etc.). Its purpose is not to replace prompt and responsible upgrading, but rather to mitigate 0-day attacks and let bloggers sleep better at night.

WordPress Security Scan - checks your WordPress website/blog for security vulnerabilities and suggests corrective actions such as:

1. Passwords
2. File permissions
3. Database security
4. Version hiding
5. WordPress admin protection/security
6. Removes WP Generator META tag from core code

A compelling call to action is - the key ingredient in every marketing plan. In post card and email campaigns, you’re limited in scope to a very small space in which to reinforce interest and tip prospects over the edge to buy. So what makes for an effective call to action?

Location Location Location
When my wife and I were writing the business plan for our Salon, she told me our success depended heavily on location. In fact, she repeated location, location, location over and over. Why? In the hair styling industry, you need a constant flow of walk-in traffic to augment your existing clientele – if you want to maximize your growth. It’s not much different cross-industry.

You need to capture your prospects attention immediately
In an email broadcast, positioning your call to action above the scroll puts your message where? In the preview pane ! Lots of folks never scan beyond their preview panes. In a world dominated by immediate gratification, this compares to being in the top ten of search engine results. You need to capture your prospects attention immediately. How? Location ! You want them to be able to simply glance at the preview and click.

Multiple calls to action
Is just one call to action enough? Strategists reason by giving multiple calls to the same action, in different sections of your broadcast, you lend weight to the call. The first call to action may be intriguing, prompting your prospect to read further (benefits/solutions), followed by second call to action that puts them over the top – they’re convinced. If you change up the wording or offer different solutions in multiple calls to action, you risk confusing your viewers.

Words and Emotions
Sales are emotional transactions. Setting the right tone puts your prospect in a buying posture. Using power words that demonstrate force (in your face) and personality make a strong impact. You’re looking to prompt specific reactions from their point of view. And it isn’t just the words – it’s their perception of the words. What’s more appealing to you (on the same product) – 20% off or $150 off? My guess would be $150 off. Why? Because 20% is an unknown quantity – it sounds good, but requires some calculation. I understand $150 off immediately.

Text or Images?
The goal is to draw attention to your call to action. Extensive testing has shown that what works for some doesn’t work for everyone – and changing up between text and images works better than locking into one or the other. A word of caution when using images for your call to action – some readers may have images disabled, so always add ALT text attributes to your images.

Does size and color matter?
In testing, it’s been reported that bright colors outperform other colors, and orange, in particular, does very well. I’ve seen a lot of red calls to action, but subconsciously, red means STOP. A good test to determine if your call to action is the proper size and color is to stand about 10 feet away from your ad and see how easy it is to pick out.

My Recommendation to Increase Click Throughs
Wording is key. Instead of using Buy Now, Buy, Order, Order Now or any similar wording, change your call to action to ADD TO CART. Put it where it’s easily seen and your conversion rates will increase.

I just stumbled upon an article at wpmu.org - that addresses the hidden dangers of searching for free WordPress themes. With over 25 million users, WordPress dominates the blogging stratosphere. While most web hosting providers have some form of quick install for WordPress, most do not offer themes beyond the default – so where do you look for a theme that best matches your business culture, mission, services and products (safely)?

Their recommendation:

• Theme Shaper
• ThemeLab
• Theme Hybrid
• Arras Theme
• Smashing Magazine

If you want to test your theme for hidden encrypted or static info, this article does recommend some tools

• Manual base64 decode

Useful Plugins

• Theme Authenticity Checker
• Exploit Scanner
• Theme Check

High on my list is the perceived value of support – good web hosting providers have 24/7 knowledgeable technicians on hand, that are not only professional, but willing to go that extra 1% on every call to exceed their clients expectations. Level one techs don’t sit on issues they can’t solve – they bump them to Level 2 to resolve client’s issues as rapidly as possible. Bad web hosting providers tend to hire inexperienced techs that lack customer support skills (the ability to interact with clients), and solve their issues promptly and professionally.

Good providers have experience gained from years of providing – competitive, stable web hosting solutions. In this business, hosts that have been around 5+ years have proved sustainability, while most bad web hosting providers disappear within one to two years. If you’re investing in a viable business partnership, longevity is a huge indicator of stability. Bad web hosting providers are often run by “kiddie hosts” from their bedrooms or by college kids out of their dorm rooms. Don’t expect to see a brick and mortar address on their site, or even worse, expect a response to a service ticket while class is in session.

A good web hosting provider usually has thousands – or possibly millions of dollars, invested in infrastructure. Failing is NOT an option for them. On the other hand, many bad providers started their business on a shoestring, without a business plan or funds to sustain operations beyond a few months. Simply check out the threads on web hosting forums – there’s always distressed hosting providers there for sale.

A good provider manages their resources – with plans that balance services with actual costs, with the long term goal of retaining clientele, and minimizing churn. They understand their limits. They understand turning a profit. They understand ROI.  Bad providers offer services at ridiculously low prices, that fail to provide enough revenue to sustain (or grow) their operations.

A good host tells you like it is – they under promise and over deliver.  They won’t tell you anything you want to hear just to get you in the door. They provide well thought out solutions and NOT just packages. Bad providers lack transparency, often promising features that are limited by clauses buried in their Terms and Conditions.

Revised

Reseller web hosting – provides a relatively inexpensive solution for newcomers to the hosting industry who want to start their own web hosting company. In this scenario, it’s a type of hosting account in which the “account holder” purchases a reseller or master account on a shared web server, then sells sub-accounts to their clients. They are essentially middle-men or intermediaries reselling services (space and bandwidth) allocated to them by their host.

Reseller accounts are also used by people with multiple - websites (for their own use). The account holder can then adjust the amount of disk space and bandwidth allotted to each site and manage all of their sites via one control panel, such as cPanel, DirectAdmin, HSphere or Plesk.

Reseller web hosting accounts are generally marketed - in different package sizes, allowing the account holder to match their requirements, then upgrade or downgrade as needed.

Advantages of reseller hosting

The web host is responsible for server maintenance.

The account holder controls access to all sites (their sites and their client’s sites) via one control panel.

The account holder can earn revenue reselling web hosting services.

The account holder can assign and modify space and bandwidth to all sites on that account.

With certain plans, account holders can brand their services without the appearance of being a reseller. (No advertising by their upline)

Startup costs are lower across the board.

Disadvantages of reseller hosting

Moving from the current web host can be both inconvenient and costly, both to the account holder and their clients.

They are marginally more expensive than shared hosting plans.

Bandwidth

Data transfer includes all traffic that passes through a web hosting provider’s core routers, including FTP and email. Colocation packages normally include either 1Mbps or 5Mbps burstable connections, measured on the 95^th percentile. A 10Mbps connection relates to approximately 3.3 Terabytes of bandwidth monthly.

To determine estimated monthly bandwidth for your site, first determine the page size for each page of your website, then estimate how many daily pageviews you project for each. Simply multiply to estimate monthly bandwidth forecasted, allowing for some overhead.

Note: A two (2) minute video can easily consume 10MB of bandwidth. As little as 300 downloads per day of that one video can consume 90GB of bandwidth monthly.

 Rack Space

 1U = 1.75″ of Vertical Rack Space

 2U = 3.5″ of Vertical Rack Space

 3U = 5.25″ of Vertical Rack Space

 4U = 7.00″ of Vertical Rack Space.

IP Subnets

 /30…..4 IP’s – 2 useable

 /29…..8 IP’s – 6 useable

 /28…..16 IP’s

 /27…..32 IP’s

 /26…..64 IP’s

 /24…..256 IP’s

 /23…..512 IP’s

 /22…..1024 IP’s

 /21…..2048 IP’s

 /20…..4096 IP’s

 /19…..8192 IP’s

Always provide value - The psychology of selling transcends to the psychology of writing online content for revenue producing websites. Essentially, every prospect is searching for what’s important to them and their organization.

Whereas in person, you can tailor - your pitch to their personality traits, like number crunchers or socialites – online it’s impossible to know who has found your site. The common denominator is always VALUE to the end user.

Tell them what’s in it for them - Reaching across a broad spectrum of personality types means touching as many of their senses as possible; sound, taste, touch, sight and smell (or the perception of those). Rarely does selling on price alone work.

Ok, so we can’t taste a dedicated server or smell shared hosting - but wording can sway a prospect’s motivation. Conor Treacy gave a great example in a thread on Hosting Discussion – instead of, “we sell lawn mowers,” use “buy a mower that will make your neighbour @#*^ themselves with envy.” Be descriptive without going over the top, addressing the basics of how, who, why and what. Show how your solution has helped other businesses or organizations just like theirs. Tell them what’s in it for them.

Surfing the Internet poses some very real dangers - one of those being phishing. The sole purpose of phishing is an attempt by a criminal to trick you into revealing personal information, while appearing to be from a valid or legitimate source, such as your ISP, hosting provider, financial institution or consultant.

I recently took an online test to determine - my ability to recognize phishing emails or websites. I aced it, but I’ve been in this industry for some time. Countless individuals fall prey to phishing schemes everyday.

Identity theft is on the rise. Don’t be it’s next victim! Do NOT give out your usernames and passwords, financial information, PIN numbers, your mother’s maiden name,  Social Security number, birthday, pet’s name or any other personal information that may help identify you. This information is used by phishers in an attempt to steal accounts, money, credit card information or your identity.

Please be wary of any message that asks you for personal information.

Marketing is critically important - to jump-start any new business. Broad access to cutting edge technology has made it increasingly possible for start-ups to compete with established brick and mortar establishments.

Understanding your market - What niche do your competitors own? Would you fare better competing for that niche or creating your own? What will make you remember-able in your prospects eyes? What value could you add to entice them to go with your firm or organization?

Constantly refine your strategy - Once you’ve settled on your initial marketing strategy, tracking and measuring its success is essential. You can’t grow your business on a marginally successful strategy. Marketing strategies need to be refined, to eliminate what doesn’t work from what shows promise.

New businesses are created every day – that could use your products or service - Every new business has to procure products and services somewhere, and if not from you, certainly from your competitor. If you’re not reaching out to every newly registered business in your local community, you’re missing out on a huge sector of the market. And it’s so easy to find them. Every new business in the U.S. has to register with their respective Secretary of State. These registrations are farmed by local chambers of commerce and directory services. I’ve seen lists that sell for as low as fourteen cents per contact. In many cases, one new client from that list could pay for an entire campaign.

Once you’ve established your niche - tweak your approach and close techniques, identify what works and repeat that over and over and over and over. Persistence is key.

Is your in-house IT department prepared – for brown outs, black outs, personnel shortages, ISP issues, internal and external sabotage, equipment failures, new regulations (email retention) and a whole host of other issues?

Recently, an Internet forum with – thousands of members was hacked, and in the process the criminals deleted their backups, stole email and credit card information, then disseminated it across the Internet. Could this happen to your in-house network? Hackers are constantly on the prowl looking for openings to exploit internal networks as well. Is yours protected?

How would you as an owner know if your IT department was prepared? Do you have disaster recovery and business continuity plans in place? Are they routinely reviewed and updated? Do you strategize with your IT personnel, or do they basically run the show? If they said you needed to be PCI DSS compliant, would you know what they were talking about?

Managing IT for multiple departments requires some give and take - Is your IT department empowered to make smart decisions? Not all IT geeks are business savvy, so my question to you would be, “Do your departments talk to each other?” HR certainly has unique requirements, as do Sales, Customer Support and Admin. Do they operate in a vacuum or together as a cohesive unit? An appropriate amount of give and take between departments increases awareness of your business’s core focus and mission.

Of course not, but I read threads every day from businesses (on various Internet forums) that have lost their data - because their website violated the Terms of Services (TOS) of their host. Often their sites are taken down without notice. Some scenarios were because the client didn’t keep their security patches up-to-date, then were hacked. Others were because they were using a shared IP and that IP was blacklisted for spam violations – maybe not that specific IP – just in that range.

So are you prepared to lose your data? Seems like a ridiculous question, but many aren’t prepared because they have no plan beyond simply trusting that their web host will provide back ups if necessary. I write about disaster recovery more so than any other topic because of the severity related to losing mission critical data. More often than not, if you lose your data, you lose your business – or it’s severely impacted.

When selecting a web host, read their Terms of Service carefully – they’re there to protect the host and you, spelling out legal expectations. Regardless, use due diligence to formulate a disaster recovery and business continuity plan that includes routinely scheduled remote offsite backup. Prepare for a worst case scenario.

I relate this to car or health insurance. I hate to pay that bill each month, but I know it’s for my own protection. If you’re the owner or president of your company, you owe it to your clients and employees to secure your business. Stuff happens. It can and does happen to businesses just like yours everyday.

• Multiple hard drives in a RAID array fail simultaneously (defective lot). You thought RAID was your backup solution, but turns out – it wasn’t.
• Fire destroys your servers and DAT tape drive. You forgot to take that tape offsite last night.
• Web host locks access to your server because your bookkeeper didn’t pay the bill. I see lots of posts related to this where the recommendation generally is – be nice to the host and maybe they’ll let you have access to your data.

Bottom line - Set aside some time to review and update your disaster recovery and business continuity plan if you have one. If you don’t have one – keep your fingers crossed and hope that Murphys Law passes you by and hits that business down the street first.

Certainly it’s the long term goal of every business to - minimize customer churn. The expense to sign on new clients way exceeds the cost to retain and resell existing clients. Every interaction with your clients, from warehouse, sales and service, to the accounting department shares a responsibility to exceed your clients expectations, by going that extra one percent – everytime.

Fix the Client and Not Your Product or Service. When I was employed as a technician by Varityper, our titles were tech rep 1, tech rep 2 and so on. That was changed to Customer Engineer. When you troubleshoot a client’s problem, you’re not fixing their typesetter, printer, broadband connection, website or whatever your business provides – you’re fixing the client. And in doing so – you need to give at least the perception of value.

Providing Value - Can this be done on the fly? Sure, but not with great results. Good customer support reps go through extensive training for the sole purpose of maximizing the client’s perception of their business. They offer benefits and solutions. This pays off in reduced advertising cost, minimized churn, customer loyalty and “branding.”

Are you rememberable? Are you rememberable in your clients eyes? Do you ‘own’ your business niche? Or are your customers simply satisfied clients? A certain level of support is expected from every vendor. On your customer surveys, do you ask the question, “Have we exceeded your expectations?”

Set yourself apart from the masses - Customer support encompasses so much more than simply responding to a service ticket, fixing the issue and closing it out without explanation. I see so many entrepreneurs asking how to develop a niche that sets them apart from the masses. Of course, the offer is KING, but great customer support keeps you on your throne.

Run anti-spyware and anti-malware programs, and keep them up-to-date. I’ve installed Microsoft Security Essentials on all of my systems and it works great. Don’t mix anti-virus software on your system. This is a recipe for disaster. I had Malwarebytes and MSE on my Vista desktop and it constantly locked up. Once I removed MSE, no more lock ups.

Disable file indexing. Indexing extracts data from every file on your hard drive to create a searchable keyword index. The idea is sound – it allows you to search for words or phrases inside of documents, but it’s also VERY resource intensive.

Add additional memory. Memory executes in nanoseconds, while hard drives run in milliseconds, even at 15,000 rpm. Obviously, the more fast memory you have, the less often your system will have to access your slow hard drive. The same applies to CPU cache. A larger CPU cache adds another layer of speed to your system.

Not all systems use the same configuration of RAM modules. Check your motherboard manual or specs – find out the maximum RAM you can install and in what configuration.

Run a monthly disk cleanup. Temporary files can take up Gigabytes of space if allowed to accumulate over time – so schedule a monthly disk cleanup to delete these files. And even though a debate rages over rather to defragment large hard drives, in testing this has demonstrated performance boosts.

Streamline start up programs. Eliminate any programs you don’t really need from your start up routine.

Downsize programs via the Control Panel. Use the ADD/REMOVE Programs from within the control panel to delete programs you no longer need or use. Many of them run background processes that drain your systems resources. For example, if you’re using Windows Media 10 or 11, do you really need RealPlayer?

Perform Windows Updates regularly. Pay particular attention to critical and security updates.

Miscellaneous Stuff. Do you really need drivers for printers that are no longer attached to your desktop or on your network? Erase them. And do you really need 3000 fonts? Unless you’re a graphic artist, trim down the one’s you’ll never use.

Microsoft’s Malware Protection Center (Threat Research and Response) website - is a great resource for combating malware – the nasty stuff that lots of anti-virus programs miss. I stumbled across this site while reading, “Why malware networks are beating antivirus software,” by Ed Bott.

From Microsoft:

Take the following steps to help prevent infection on your computer:

• Enable a firewall on your computer.
• Get the latest computer updates for all your installed software.
• Use up-to-date antivirus software.
• Limit user privileges on the computer.
• Use caution when opening attachments and accepting file transfers.
• Use caution when clicking on links to webpages.
• Avoid downloading pirated software.
• Protect yourself against social engineering attacks.
• Use strong passwords.
• Enable a firewall on your computer
• Use a third-party firewall product or turn on the Microsoft Windows Internet Connection Firewall.

Get the latest computer updates - Updates help protect your computer from viruses, worms, and other threats as they are discovered. It is important to install updates for all the software that is installed in your computer. These are usually available from vendor websites.
You can use the Automatic Updates feature in Windows to automatically download future Microsoft security updates while your computer is on and connected to the Internet.

Use up-to-date antivirus software - Most antivirus software can detect and prevent infection by known malicious software.

Limit user privileges on the computer - Starting with Windows Vista and Windows 7, Microsoft introduced User Account Control (UAC), which, when enabled, allowed users to run with least user privileges. This scenario limits the possibility of attacks by malware and other threats that require administrative privileges to run. You can configure UAC in your computer to meet your preferences:

Use caution when opening attachments and accepting file transfers - Exercise caution with email and attachments received from unknown sources, or received unexpectedly from known sources. Use extreme caution when accepting file transfers from known or unknown sources.

• Use caution when clicking on links to web pages
• Exercise caution with links to web pages that you receive from unknown sources, especially if the links are to a webpage that you are not familiar with, unsure of the destination of, or suspicious of. Malicious software may be installed in your computer simply by visiting a webpage with harmful content.
• Avoid downloading pirated software
• Threats may also be bundled with software and files that are available for download on various torrent sites. Downloading “cracked” or “pirated” software from these sites carries not only the risk of being infected with malware, but is also illegal. For more information, see ‘The risks of obtaining and using pirated software‘.

Protect yourself from social engineering attacks - While attackers may attempt to exploit vulnerabilities in hardware or software to compromise a computer, they also attempt to exploit vulnerabilities in human behavior to do the same. When an attacker attempts to take advantage of human behavior to persuade the affected user to perform an action of the attacker’s choice, it is known as ‘social engineering’. Essentially, social engineering is an attack against the human interface of the targeted computer. For more information, see ‘What is social engineering?‘.

Use strong passwords - Attackers may try to gain access to your Windows account by guessing your password. It is therefore important that you use a strong password – one that cannot be easily guessed by an attacker. A strong password is one that has at least eight characters, and combines letters, numbers, and symbols.

A Virtual Private Server (VPS) – is the next logical step up from a shared platform. Its scalability in resources versus cost makes it a viable alternative to dedicated server hosting.

While Virtual Private Servers – offer the same complement of operating systems and software components expected from a dedicated server, they vary from shared in that each virtual private server is isolated from one another, allowing concurrent execution of multiple operating systems – without allowing the execution of one partition to adversely affect the performance of another partition. Instead of allowing the kernel or operating system of a VPS to interface directly with hardware components, virtualization software intercepts requests, queues them, and manages their interpretation.

A Virtual Private Server platform – is ideally suited for:

Low End

256MB Dedicated Memory
10GB Disk Space
100GB Monthly Transfer
1 X 2.40GHz Xeon Processor

• Stand Alone Services
  • Private Proxies
  • Small Email Server
  • VPN Endpoint
  • DNS Server
• Static Websites

Low to Mid Range

512MB Dedicated Memory
10GB Disk Space
100GB Monthly Transfer
1 X 2.40GHz Xeon Processor

• Small to Moderately Dynamic Sites
• Repositories
• FTP Servers
• Databases

Mid Range

1024MB Dedicated Memory
40GB Disk Space
500GB Monthly Transfer
2 X 2.40GHz Xeon Processors

• Dynamic Websites
• Entry Level Web Servers
• Busy Email Servers
• Remote Linux Desktops

Mid Range to High End

2048MB Dedicated Memory
80GB Disk Space
1000GB Monthly Transfer
3 X 2.40GHz Xeon Processors

• Large Dynamic Websites
• Hosting Multiple Sites
• Hosting Forums
• Hosting Complex Applications

High End (rivals most low end dedicated server packages)

3072MB Dedicated Memory
160GB Disk Space
2000GB Monthly Transfer
4 X 2.40GHz Xeon Processors

• Hosting Tons of Client Sites
• Hosting Large Forums
• Hosting eCommerce Sites
• Windows Terminal Services
• File Servers
• SharePoint and Extensive Database Applications

Total cost of ownership (TCO) – in Information Technology (IT) is the total cost of the staff and infrastructure to support your business. When crunching numbers to determine the TCO of your IT department, and how that fits into your day to day operations, disaster recovery and business continuity plans, take that one step further to compare those numbers versus colocating your servers in a data center.

Let’s say your business earns $5 million in annual revenues, with very aggressive plans to grow to $6 million. That extra $1 million will be the result of realized growth opportunities and a reduction in expenditures / streamlining your operations.

Most small businesses of this size employ – one or two technicians to manage their servers, desktops, laptops, switches, hubs, printers, phone systems, email, applications, backups, etc. Your annualized investment can easily exceed $300,000. Your business data needs to be communicated internally as well as externally, so the applications and hardware can’t be scaled back, although they may be optimized by upgrading to more efficient services.

This is the scenario thousands of small businesses find themselves in today - only with scaled back growth projections due to the credit crunch.  So how could these companies lower their Total Cost of Ownership by colocating their servers in a data center? What do data centers have that aren’t part of their existing IT infrastructure?

Servers colocated in a data center are – normally secured in a cage or rack, with regulated power, dedicated connectivity, layered security and on-site support services 24x7x365. Data centers typically have alarms monitored for fire, smoke and moisture, and power is backed up by a UPS and diesel fuel generator – greatly diminishing any loss of mission critical data due to fire, theft, vandalism or loss of power.

Virtual private servers (VPS) – have historically offered some middle ground between shared web hosting services and dedicated hosting services, both in control and cost, but recently the gap in cost between virtual and dedicated servers has diminished … making upgrades from shared to dedicated web hosting very attractive.

A virtual private server separates you from – other customers on a physical web server, running on a copy of its own operating system, but it shares CPU and RAM resources of the physical web server with other VPSs running on that server.

A dedicated server, on the other hand, is – a physical web server leased and controlled by the end client, without sharing physical CPU and RAM resources with other sites. Its very much like owning your own server, without the huge capital asset investment.

Most hosts offer a mix of unmanaged versus managed services for dedicated servers. Unmanaged plans typically offer the basics – the hardware, operating system, control panel and Internet connection.

In a VPS, a single physical server is partitioned – so that it appears as multiple servers. The physical server boots normally, then runs a program to boot each VPS within a virtualization environment.

There are two kinds of virtualizations – software and hardware based. Software based environments share the same kernel and require the main node’s resources. In a web hosting environment, quota incrementing and decrementing in real time is possible without restarting the node. In a hardware based virtualization, real hardware resources are partitioned, eliminating burst or real time quota modification. This lends to a (potentially) more secure environment.

With a dedicated server, you have – more flexibility and control. Dedicated servers have historically been the server of choice for complex business or high end eCommerce sites, but have recently become very popular substitutes for VPS servers and less complex solutions.

Dedicated servers housed in data centers offer – redundant power sources, HVAC sytems, state of the art security and advanced performance services.

The bottom line: Moving websites from a shared environment to either a VPS or dedicated server is a significant event. Its a major upgrade in the IT infrastructure supporting your business. Whereas the move from shared to dedicated was historically cost-prohibitive, and VPS offered some middle ground, technology has rapidly evolved to narrow that gap.

Upgrading should be based on more than cost

Upgrading your IT technology, in this case to VPS or dedicated is now a business decision based on more than cost. It’s based on resources you control that will map your business success for years or decades.

With the price gap narrowing, dedicated services are rapidly becoming the plan of choice for business savvy entreprenuers.

Reseller web hosting explained

Reseller web hosting commonly provides a relatively inexpensive solution for newcomers to the industry who want to start their own web hosting company, offering web hosting services. In this scenario it’s a type of hosting account in which the “account holder” purchases a reseller or master account on a shared web server, then sells sub-accounts to their clients. They are essentially middle-men or intermediaries reselling services (space and bandwidth) allocated to them by their host.

Reseller accounts are also used by people with multiple websites (for their own use). The account holder can then adjust the amount of disk space and bandwidth allotted to each site and manage all of their sites via one control panel, such as cPanel or DirectAdmin.

Reseller web hosting accounts are generally marketed in different package sizes, allowing the account holder to match their requirements, then upgrade or downgrade as needed.

Advantages of reseller hosting

The web host is responsible for server maintenance.

The account holder controls access to all sites (their sites and their client’s sites) via one control panel.

The account holder can earn revenue reselling web hosting services.

The account holder can assign and modify space and bandwidth to all sites on that account.

With certain plans, account holders can brand their services without the appearance of being a reseller.

Startup costs are lower across the board.

Disadvantages of reseller hosting

Moving from the current web host can be both inconvenient and costly, both to the account holder and their clients.

They are marginally more expensive than shared hosting plans.

Terms of Service vary widely by web hosts, so it’s extremely important to understand what services the account holder is contracting for.

Important questions to ask a potential web host provider

• Does your collocation provider offer personal tours of their datacenter(s)?
• Do they feature online (virtual) tours?
• How long have they been in business?
• What level of security do they employ?
• What is their uptime?
• Do they offer a Service Level Agreement?
• What are their Terms of Service?
• Do they have a money back guarantee?
• Do they offer managed services?
• Are their technicians not only knowledgeable, but courteous?
• Are they a one-stop-shop?
• Do they offer control panels, and which ones?
• Do they offer both Windows and Linux solutions?
• Do they charge setup fees?
• Do they offer BGP bandwidth?
• Do they offer cross-connects?
• Do they offer live chat support?
• Do they offer 24/7 phone support?
• Do they offer live event monitoring?
• Do they offer disaster recovery plans?
• Are their plans scalable?
• Will they customize a plan for you?
• Will they provide references?

I’m sure there are many many more questions – you may think of, but these are a great place to start. Finding the right provider with whom to entrust your data requires some forethought and research. Don’t over think the entire process. Search the Internet for positive / negative reviews, narrow down your list and then call each prospective vendor.

Gauge which provider best fits – your business model. How important and relevant are each of the above? Assign a value to each, total the numbers and compare vendors. Often, the correct match jumps of the page and hits you square in the forehead. Often the offer seems too good to be real – for instance, an offer of unlimited bandwidth on a VPS.

I would recommend assigning a heavier weight – to a disaster recovery plan. And also to their technical expertise, as it directly relates to the level of service you can expect to receive from them.

You’d be amazed how many hosts do NOT offer – phone support, or only during business hours. Uptime can be verified to some extent as there are sites that monitor hosts, but those do not necessarily monitor every router – so the numbers can be misleading. If your prospective host publicly lists anything less than 99.9% uptime, I’d recommend looking elsewhere. Downtime can cost thousands in lost revenue and disgruntled clients.

Do you recognize - their references? Are those references credible?

Even if your application doesn’t fit – a plan you see featured on their website, call and ask them if they’ll customize a plan for you. You may be pleasantly surprised.

Three years ago, a well known web host sent a message to its clients about a security breach on one of its employee accounts. They followed that with this thread in their forum.

This morning, we sent a notification to a group of our customers possibly affected by a compromised employee account’s access to our internal customer management portal. We will be sending an additional communication to all customers with information about the apparent security breach, but in the meantime we would like to answer any additional questions about the communication in this thread.

Please understand that we will not provide specifics information about the security breach due to the sensitive nature of the investigation, but we will do our best to provide as much detail as possible. As we assured in the note, based upon our security review of access logs, we do not believe any credit card information was compromised.

We strongly suggest you implement a security best-practices approach by immediately taking four steps to mitigate risk:

• 1. Change your xxxxx log-in passwords immediately and do so again every 60 days.
• 2. Change your server passwords and do so again every 60 days.
• 3. Be alert to any suspicious activity on your account.
• 4. If you suspect any unusual activity, please retain your access logs along with any other information and contact us as soon as possible.

This raised some questions – then that still apply today. What security measures do hosts normally implement (regarding their employees) to protect their clients? Are they allowed to bring in usb thumb drives (some are marketed very cleverly looking like wrist bands or writing utensils)? What about PDA’s? Could they place data on these devices and simply walk out the door with gigabytes of files? Could those files be broadcast on the Internet, or used as blackmail?

They mentioned implementing a security best practices approach. Regardless of your level of comfort with your current host, these four suggestions need to be implemented to minimize your risk. I can’t emphasize this enough - your data is your business. Lose your data and you risk losing your business!

What about inside your own business? The same applies to in-house servers and workstations. Most security breaches are by disgruntled employees. It’s amazing how many companies give administrative privileges to low level supervisors. Entire databases can be downloaded in minutes with thumb drives, then transported offsite.

What about security or IT audits? Financial institutions have very strict guidelines with respect to security, but what about the thousands of small to medium sized firms that comprise the majority of businesses – your local printer, clothing retailer, auto repair shop, electrical contractors, car dealerships? How at risk is their data – and your data as their consumer? It’s astonishing how many firms broadcast on unsecured Wifi networks. What’s more alarming is how easy it is to intercept and infiltrate their networks. How many times have we been alerted to intrusion theft of well known retailers, just in the past year?

Would an IT audit be worthwhile? Volumes of information has been written about IT audits and security. Do you trust your IT department to have fully provisioned and managed security? Most SMB owners have no clue how vulnerable their companies are without a 3rd party audit.

My recommendation – Dot your i’s and cross your t’s with disaster recovery and business continuity plans. If you receive a notice like our web hosts comrades, follow their advice. Do it as a matter of habit. Being habitually secure is far better than being victimized with no recourse.

Your accounting department has been complaining – about your network slowing to a crawl, but your sales reps are finally making cold calls – because they can’t surf the web or use email (Or they’re out on the golf course ).

What’s the problem? Could be a collision domain. Computer networks can be segmented physically as well as logically (Ethernet protocol), leading to circumstances where one single network device can send packets throughout a network segment forcing every other device to acknowledge those packets. Or it could be a group of Ethernet devices in a LAN running on CSMA/CD, connected via repeaters competing for network access. If two devices follow the exact procedure at the exact time, their transmissions will collide, and they will both become unusable. Simply put, a collision occurs when two or more network devices are trying to transmit packets at the exact same time.

As collisions increase on a network – the less efficient the network is. So how do you combat collision domain? Utilize switches and/or network bridges that filter and forward packets by their MAC address. A switch or network bridge will forward frames with addresses that are not in its domain, and will duplicate and broadcast frames to the devices inside its network.

Routers can filter, forward or drop packets – based on MAC addresses. Routers reduce collision domain by broadcasting to the LAN only packets that have addresses on that specific network. Routers are able to redirect packets not only by  IP or MAC addresses, but also by data type (email, graphics, plain text), function or port used (FTP, HTTP, SMTP, POP3) plus other variables and functions (acting like a firewall) in order to improve network performance.

Contrast your network to – data center networks that occupy entire buildings and house thousands of servers. They’re designed to host mission critical computer systems, with fully redundant subsystems and security zones. They contain routers and switches that transport traffic between those servers and the outside world. Redundancy of their Internet connection is usually provided via BGP bandwidth, blending multiple upstream providers.

Seems like more and more entrepreneurs are – tying their hand at web design, hosting and eCommerce. Obliviously, each demands its own expertise to be successful. The most misunderstood, globally, is eCommerce – at least from the threads I’ve read over the years. There’s a common theme between them that goes something like this, “I want to sell (a product or service) online. Please advise how to do this.”

I recently read an excellent response to this query, written by e-onlinedata, the nation’s fastest-growing and most trusted provider of online payment solutions and the largest reseller for Authorize.net payment gateway. It follows:

There are three vital components that make – online shopping possible: the shopping cart, payment gateway and payment processor. Each is critical to ensuring successful implementation of e-commerce functionality.

Shopping Cart

* The shopping cart acts quite literally as a virtual shopping basket. It holds the items customers select from a Web site until they are ready to proceed to the checkout stage, where their credit card information will be processed.
* Keeps track of items until they are purchased
* Automatically totals the amount of a customer’s order, including shipping and tax
* Allows shoppers to securely enter address and credit card information

Payment gateway

In order to accept credit cards through the Internet, a payment gateway is critical to transport the credit card information from the shopping cart to the payment processor once the consumer clicks the “Buy” button. In most cases, this transaction happens almost instantaneously. The payment gateway receives encrypted transactions from the merchant’s shopping cart. An encrypted transaction simply means that credit card numbers can’t be read by people who are not supposed to read those numbers. Authentication is provided, then the decrypted payment.

Payment Gateway Functionality

When information is transmitted for authorization, the payment gateway:

* Fulfills the same function as a point-of-sale (card swipe) terminal at a physical retail location.
* Takes information provided through a shopping cart and transmits it electronically and securely to a payment processor to be routed for authorization of payment.

Payment Processor

* The payment processor transmits a customer’s credit card information via the Internet to the merchant bank for authorization. It also sends data back to the merchant’s bank to approve payment or the transfer of funds. Specifically, a payment processor:
* Acts as a link from the merchant to the acquiring bank or merchant bank
* Receives information from the merchant through the payment gateway and packages the information for delivery to the acquirer, ensuring that all necessary transactional data is present and valid
* Later transmits information back from the acquirer for delivery to the merchant to settle the transaction

With the shopping cart, payment gateway and payment processor in place, merchants have all they need to offer convenient e-commerce solutions that deliver superior security and service.

With a little research, you can find the best merchant provider to accommodate your business needs.

WordPress sites are constantly scanned by cyber criminals - for security vulnerabilities. I suspect thousands of WordPress sites are managed from multiple locations – at work and from home. Wherever you manage your WordPress site, make sure that computer is free of spyware, malware, adware, viruses and Trojans. Next, ensure you’re running secure, stable versions of your applications. Keep your version of WordPress updated, as well as any plugins you may have added. NOTE – If you’re not actively using a plugin, it’s best to remove it completely from your site.

Addressing vulnerabilities in the network itself – A busy Internet cafe where you are sending passwords in clear text over an unencrypted wireless connection is NOT a trusted network and the same applies if you’re using an unsecure wireless router on your home network. I can’t even begin to tell you how many times I’ve run security audits on business wireless networks only to find multiple unauthorized users riding on their network.

Allowing write access on your file permissions – especially in a public environment, is also highly discouraged. If you are on a shared-server, the permissions of your wp-config.php should be 750. This ensures no other user will be able to read your database username and password.

I pay a lot of attention to affiliate marketers - because their livelihood depends on accurately analyzing and predicting market trends, then tweaking their marketing and SEO strategies to match. The problem with an awful lot of affiliate marketers is that they’re stuck in 2000-2004 strategies – that worked like clockwork then, but “Mom and Pop” e-commerce has transitioned over the last few years … becoming exceedingly difficult. Market share for small to medium sized companies on the Internet is shrinking, while the top 10% of web sites on the Internet continue to grab more audience, leaving scraps for the rest of us.

To complicate matters - the trend to mobile apps has caused an overall decrease in Internet use – with mobile content predicted to double within a year. This results in a smaller piece of a smaller pie for entrepreneurs just entering the Internet with e-commerce strategies – and dreams of working from home instead of fighting rush hour traffic to and from work.

I suspect an alarming number of Mom and Pop shops will – go under or at least by the wayside on the Internet – in as little as one to two years down the road – if they don’t transition with the industry. Let’s be honest here – how many of you understand how to market on Facebook or Twitter, or use any number of hundreds of social media platforms to advance your business – while the future of your business rides on the fence. Your competition isn’t sitting back waiting for you to fail – they’re accelerating the process by incorporating Internet strategies that work TODAY – pushing you further back in organic SERPS (search engine results pages).

My recommendation – follow the guidelines that the major search engines put out there – so you can succeed. Do split testing to determine what works from what doesn’t work, then repeat what works over and over and over. Be open to change.

One of my favorite quotes - “The whole is greater than the sum of its parts.” — by Aristotle, applies to business across the board. Typically, one or two individuals in an organization will be assigned to develop and follow up on Internet strategies, but I contend that each and every employee in businesses of every size, can add intrinsic value to their business (online). In a world that is trending toward peer-to-peer evaluation, each employee brings with them intellectual assets and their own sphere of influence. Encourage each of them to share what makes them special and your business special – on your corporate blog, industry forums, social media platforms – and the list goes on forever.

How would you like to reduce your advertising cost - on Google AdWords or Facebook, yet improve your click through rate (CTR)? Without going real deep into how and why this works, price per click or impression is a factor of a quality score – and that score is determined by how well your ad performs. Essentially the lower your click through rate, the lower your quality score and the higher your resulting cost per click or impression.

Combining poorly performing - keywords, keyword phrases or interests with those that perform well lowers your overall click through rate and also your quality score. It’s far better to create multiple separate campaigns with fewer keywords or interests, first to sort out what works from what doesn’t work and second, to create better performing keywords and interests campaigns to improve your click through rate, thus improving your quality score and reducing the resulting cost per click or impression. Sometimes this means reducing the keywords, keyword phrases or interests in your campaigns to as few as two or three top performers.

Often, a poorly performing – keyword, keyword phrase or interest is simply a bad match with its associated advertisement. You’ll never know this though if you lump sum all your keywords or interests into one campaign. In Facebook, it’s easy to create multiple similar campaigns and simply change out interests. Stop paying for interests that perform poorly and focus on those that do perform well. Click through will improve, quality score will improve and the corresponding cost of your campaigns will decrease.

I frequent quite a few forums and often stumble upon some threads that stand apart from the crowd – providing tips that I find lend real value to their members and guests. I read a thread this morning that resonated with me, and I’m sure, with others reading this. It was written by Juan Gonzalez, the CEO of  HostLeet.Com, LLC.

First of all, most people think they have to transfer their domain name over to a new host in order to have it hosted on their servers. This is NOT true… You can always leave your domain name with your current registrar or host, and simply change the nameservers to point to your NEW registrar/host.

Now, for those of you who DO wish to transfer your domain name away from your current registrar/host. You will need to make sure you follow these steps BEFORE starting the transfer process..

1. Have your domain’s EPP Code (Security Key) handy so you can provide it to your new registrar/host (this can be obtained from your current registrar/host). When you order a transfer, you will be asked for the domain’s EPP code. The transfer can NOT be initiated without this security key, so make sure you have access to it.

2. Unlock the domain. Make sure your domain name is UNLOCKED before you initiate a transfer. This can be done from your current registrar’s domain control panel. If your domain name is locked, the transfer will fail.

3. Don’t have WHOIS protection enabled. Make sure to DISABLE WHOIS protection on your domain name before initiating a transfer. This can be done from your current registrar’s domain control panel. If your domain name has WHOIS protection enabled, the transfer will fail.

4. Make sure the domain’s Administrative Contact Details or WHOIS Information (email, address, phone, ect..) MATCHES your own personal info with your new registrar/host. This can be changed from your current registrar’s domain control panel. If your domain name’s contact details DO NOT match with the new registrar/host, the transfer will fail.

Once you have initiated the transfer process, your new registrar/host will send a transfer request approval email to the email address listed in the WHOIS details for that domain (your email address). The request MUST be approved by the domain name holder/owner.

Once approved, your new registrar/host will then send the request to your current registrar/host so they release the domain name over. If your current registrar/host does NOT release the domain, it will NOT be transfered. Make sure you can contact your current registrar/host for assistance.

However, sometimes customers don’t know who their domain name registrar is, or their current host has vanished from the face of the earth without a trace.. Most of the time, you can do a simple WHOIS search on your domain name to find out who your registrar is. A good WHOIS search tool is “ http://www.domaintools.com/ “.

There are a number of entry level services under – the umbrella of webhosting – shared hosting, reseller programs, VPS, dedicated, collocation and cloud hosting. Each of these carries with it a level of capital investment necessary to substain operations until the business can support itself.

Determining financials starts with – a well researched and comprehensive business plan that takes into account operating expenses, industry trends, revenue expectations, forecasts and capital resources. Across the board, the financial investment compares favorably to brick and mortar start-ups. Instead of thousands of dollars to secure leases, business licenses, liability insurance, security systems and the like, webhosting ventures can be kickstarted with hundreds of dollars. That’s one reason we see so many underage webhosting providers – and that’s not necessarily all bad. The risk to the end client is certainly elevated though. A large number of webhost start-ups lack the financial resources to build out their business, instead trying to survive on initial sales. This is a risky business strategy, as webhosting is an extremely competitive industry, and initial sales may take weeks or months to develop.

Over the years, we’ve seen quite a few ISPs and webhosts fall – by the wayside. I can personally recall over 30 ISPs biting the dust just between 1999 and 2001.

I think if you’re a brick and mortar business, and you’re searching – for a host to entrust with your website and business data, you need to evaluate the risks of going cheap - buying into questionable plans versus going with a reputable firm with established clientele who can and will attest to their level of expertise and support. Managing expectations is huge in business. As a brick and mortar business owner myself, I want to know that my web host provider will be right there with me – two, three or five years down the road.

BGP is a mixed blend – of carriers that allows data center clients to take advantage of that center’s backbone connections to the Internet to reduce latency.

Technically, BGP is generally available across – all router platforms and relates to the forwarding process in a router. It’s based on standard routing protocols, such as Routing Information Protocol (RIP), RIPv2, Enhanced Interior Gateway Routing Protocol (EIGRP), Open Shortest Path First (OSPF), and Interior Gateway Routing Protocol (IGRP), or derived from statically configured routes and packet forwarding mechanisms. It’s automatically activated if the routing table has multiple paths to a destination.

Gaming applications should – always opt for BGP bandwidth to reduce latency.

Linux is distributed in - different flavors, and like cars, which flavor to use depends on the perception of the user. So what are the underlying reasons to select one versus another? On the surface, Ubuntu, Debian, Fedora, openSUSE, CentOS and others look pretty much the same.

All releases contain - more or less the same set of basic packages, and at the kernel level (with the same version installed), they’re all basically the same – Linux.

There are subtle differences - between distributions though, like variations in their file system hierarchy or layouts. Other variations differ in terms of system behavior, initialization procedures and anatomy of their scripts & names.

The differences are – generally very superficial and in the end, Linux is essentially nothing more than the kernel.

If you’re looking to use cPanel – then I’d recommend CentOS. I found an excellent tutorial this morning on Setting up CentOS, and this from CentOS.org:

CentOS is an Enterprise-class Linux Distribution – derived from sources freely provided to the public by a prominent North American Enterprise Linux vendor. CentOS conforms fully with the upstream vendors redistribution policy and aims to be 100% binary compatible. (CentOS mainly changes packages to remove upstream vendor branding and artwork.) CentOS is free.

Hostirian has been awarded as a top ranked web hosting company – for the year 2010/2011 by Web Hosting Search which provides reviews for some of the best business web hosting providers.

This award was the result of - a project Web Hosting Search started as part of their effort to create a listing of companies that perform excellently in the web hosting and web design industry for the year 2010-2011. Hostirian was nominated for the Best Web Service Provider category based on previous client’s feedback, which they got through a client survey that they initiated.

About Hostirian
Hostirian, a division of River City Internet Group (www.rcig.net) was founded to meet the needs of regional businesses seeking a local web hosting partner capable of providing state-of-the-art and cost-effective hosting facilities, superb customer service and assistance in marketing and managing their business’s web presence.

Hostirian offers shared and managed web hosting services to businesses operating mission critical, multi-functional websites. In addition, Hostirian offers web hosting services to a rapidly growing number of application service providers, enabling them to more efficiently deliver application services to their customers over the Internet.

Hostirian also offers value-added services, such as firewall management, stress testing and consulting services, including capacity and migration planning. Their services give the customer the option to use their own hardware and software or Hostirian can provide the hardware, software, network technology and systems management necessary.

Hostirian’s core focus is to offer their customers comprehensive outsourced website and application hosting solutions.

Learn more about Hostirian’s web hosting solutions at www.hostirian.com or call them at (800) 615-9349.

Once again, I’ve won the battle – combatting an onslaught of trojan horses, viruses and malware, but this time the fight dragged on for three days. The victim this time was my wife’s desktop, even though we had Malwarebytes, Microsoft Security Essentials and Safe Returner running – with up-to-date definitions.

The fight began when my wife clicked on – a Facebook link, which was then followed by Home Security 2011 security alerts popping up every few seconds that her desktop was compromised. She thought the alert was genuine and clicked on the tab to run a scan -  to remove the dozens of threats it said were infecting her computer (bad move).

So what was the cure? For over two days, I wasn’t sure there was a cure, as everything I tried to do failed. Malwarebytes wouldn’t run, nor would Microsoft Security Essential or Safe Returner. Ending processes didn’t work as they popped right back up as soon as I ended them.

I was unable to run any commands – like msconfig or regedit, or download any anti-malware programs from the Internet (which wasn’t working either). Safe mode didn’t work. Downloading new anti-malware programs to a thumb drive on my desktop, then attempting to install them on hers didn’t work either.

I finally found a tip on a Google search – that said entering a specific key code on manual registration would stop the pop ups. To my surprise, that worked – but the malware remained. After downloading and installing a program that temporarily ended malicious processes, I was able to run Malwarebytes in Safe Mode and remove a portion of the threats. From there, I rebooted and was able to remove more threats, but with each scan, more threats appeared and I was never was able to run Microsoft Security Essentials. I was able to access and search the Internet now though and went back to AVG, which I had used for years earlier.

Even with a new install of AVG 2011 – and successful scans, there still remained two trojan infections it did not remove, even after multiple scans. To my surprise, I left AVG 2011 run a full scan one last time overnight and awoke the next morning with no threats detected. From there, I deleted the existing Malwarebytes and MS Security Essentials programs, downloaded current versions, reinstalled them and ran both without problems.

Lesson learned - you need real time protection, especially if you frequent social networking sites. Keep your definitions current – one slip can cost you hours in recovery.

Are you confused when presented with which operating system to choose – when selecting a web hosting provider’s hosting packages? You’re not alone. And no, it doesn’t matter what operating system you have on your desktop or work station – they don’t have to match your hosting platform. You can be using Windows Vista on your desktop and Linux on your web server. So what are the key guidelines to select one versus the other?

On a shared web hosting platform – both operating systems are normally priced the same. If you’re leasing a dedicated server though, Linux is open source (free) and Windows is proprietary to Microsoft applications that require license fees. If you need services like Active Server Pages (ASP), MSSQL, MS Access, Visual Basic or remote desktop, these applications are Windows specific.

Are Linux servers more secure – I see this brought up quite often in comparisons and the answers are all over the board. Very simply, the answer is NO. Both operating systems can be locked down tight – what I generally see are providers that only offer Linux platforms stating that Linux is preferred.  Both support a wide range of software applications, languages and databases.

Control panels do vary by operating system platforms – with cPanel frequently offered for Linux versus Plesk for Windows. Of the two, cPanel is more popular, but both are comprehensive.  

There are different flavors of each operating system – with Linux; CentOS, Debian, Fedora, Ubuntu and others, and with Windows; 2008 Standard, Express, Enterprise, Web Edition and more.

My recommendation – is to match your specific requirements to the Operating System that best fits. If in doubt, call your prospective providers and discuss your concerns.

DDoS attacks can disrupt and shut down – even the largest of networks, as evidenced recently with attacks related to WikiLeaks. These distributed denial-of-service attacks normally consist of a large number of compromised systems flooding the resources of its targeted victim, thereby denying service to its legitimate users.

The target of DDoS attacks isn’t the only victim though - as all of the systems controlled in the attack suffer some degradation. Infected computers in a DDoS are called bots, which then become part of a larger botnet under the control of a cyber criminal.

The most common types of DDoS attacks center around – consumption, disruption or obstruction of bandwidth, disk space, processor time, routing information, physical network components and communications by either max’ing out resources or by triggering errors.

Some of the most common types of attacks are – ping floods, smurf attacks, syn floods, teardrop attacks, peer-to-peer attacks, brute force attacks, IRC floods and nukes.

It seems this question keeps popping up on forums across the Internet. Maybe this helps …

A virtual private server (VPS) – separates you from other customers on a physical web server, running on a copy of its own operating system, but it shares CPU and RAM resources of the physical web server with other VPSs running on that server.

A dedicated server – on the other hand, is a physical web server leased and controlled by the end client, without sharing physical CPU and RAM resources with other sites. Its very much like owning your own server, without the huge capital asset investment.

Most hosts offer – a mix of unmanaged versus managed services for dedicated servers. Unmanaged plans typically offer the basics – the hardware, operating system, control panel and Internet connection.

In a VPS - a single physical server is partitioned so that it appears as multiple servers. The physical server boots normally, then runs a program to boot each VPS within a virtualization environment.

With a dedicated server - you have more flexibility and control. Dedicated servers have historically been the server of choice for complex business or high end eCommerce sites, but have recently become very popular substitutes for VPS servers and less complex solutions.

Updated April 1 2011 – This is still HIGHLY relevant. See this story.

December 2009 – I just read an article this afternoon about the fastest growing security threat in the hosting industry. Apparently this threat has grown over a hundred fold in just the last year alone. What is it?

SQL Injection

Why have SQL injection attempts grown so dramatically? It was pointed out, and I agree, because the bad guys are using (very sophisticated) automated tools. More and more, we’re seeing attempts not only to be disruptive, rather to be focused on identity theft. Anyone remember Heartland Payment Systems and TJX?

Who is Susceptible?

Certainly, if you’re processing lots of credit cards, you need to guard against SQL injection, but even if you aren’t, this exploit needs to be addressed. I did a quick Google search for SQL injection prevention and stumbled upon an SQL Injection Cheat Sheet at http://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet. Since most SQL injection exploits are due to lax coding and poor application design practices, prevention measures like those outlined on this site can significantly minimize your risk of being compromised.

From Owasp.org

“SQL Injection flaws are introduced when software developers create dynamic database queries that include user supplied input. To avoid SQL injection flaws is simple. Developers need to either:
a) stop writing dynamic queries; and/or
b) prevent user supplied input which contains malicious SQL from affecting the logic of the executed query.”