To protect and serve

Paranoia can be a healthy trait when it comes to Web security. Most Web sites, including those at federal agencies and departments, are far more vulnerable than even most Webmasters believe.

Hackers recently compromised a system hosting thousands of "parked" domains that, instead of showing the usual "Under Construction" banner, featured an image of a mutilated rag doll along with a taunting message indicating that the site had been pirated.

It could happen to you. A recent study by Gartner Inc. predicted that 50 percent of all small to midsize enterprises would be hacked by 2003, with almost 60 percent of those not even knowing they had been hacked.

The increasing vulnerability can be attributed to a rise in hacking activity, but it is also caused by the ever-increasing complexity of Web sites today. Not so long ago, manual methods could be employed, such as looking at each piece of content and repairing it as needed. The complexity of today's Web sites — including numerous pages, images and associated features — make this manual method ineffective.

Fortunately, there is a solution: Lockstep Systems Inc.'s WebAgain Version 2.5. By acting as an intermediate server, the software ensures that content is staged and preserved before deployment on the Web site. At configurable intervals, the staging server will query the Web site and compare files for differences. Should one be found, the contents and/or files are captured and quarantined on the Lockstep server, and the original content is restored. The sofwware puts an entry in a log and sends a message to the administrator.

Although many products on the market today, such as Tripwire for Web Pages from Tripwire Inc. and Watchguard AppLock from Watchguard Technologies Inc., offer similar protection, only WebAgain is able to tout self-healing capabilities via content restoration without human intervention.

In addition to protecting against deliberate hacker attacks, the solution is a great way to eliminate the threat of accidental content corruption by well-meaning but perhaps technologically deficient employees. Moreover, it also serves as a wonderful audit trail for all changes made to the Web site. What makes it even better is that, should you decide to implement it, the only change in process is that you publish to the WebAgain server rather than directly to your Web server.

New features in this release include increased security via support for virtual private network tunnels and virtual directories, faster performance, a Japanese version and compliance with Microsoft Corp. Windows XP.

Installation and setup of the application was easy and straightforward. Upon completion of installation, the software immediately guided me to the Web site management wizard, where I quickly configured the solution to work with a simple Web site consisting of three main pages and six subpages. Within this interface, I defined the way the content would be transferred (FTP, shared folder, etc.), whether it would sit behind a firewall and the number of times the site would be tested.

By making adjustments such as simple price changes on static pages, replacing images and putting additional files on the Web server, I was able to create a nice test bed from which to operate. Because I had previously set the frequency of scans to 15 minutes, I needed to wait that amount of time to see whether my changes were recognized.

As expected, the solution caught my changes, informing me of each infraction via my selected method, e-mail. Should I have wanted, a Simple Network Management Protocol event could also have been generated and transmitted to an administrator.

During testing, I found very little to complain about. The only concern is that the server runs as a Windows NT service, making it less than ideal for agencies that are pure Unix shops.

Aside from that, I found WebAgain to be an excellent tool, and I highly recommend it. Its low price, ease of use and extra protection make it a must-have tool in any situation where content security is important to Webmasters.

Fielden is a freelance writer based in St. Paul, Minn. He can be reached at tfielden@attbi.com.