Second Life Working

Introduction to How Second Life Works

Few online social networking sites get as much attention as Second Life (SL), the three-dimensional virtual world where users, called residents, can preten­d to be whomever -- or whatever -- they want to be. Although it's an online environment, its influence reaches into the real world -- including a virtual economy that's dependent upon actual money. In reality, or perhaps virtual reality, Second Life is a complex environment filled with potential risks and rewards.

At its most basic level, Second Life is an online environment created by Linden Lab, a company based in San Francisco. Second Life is an online world in which residents create virtual representations of themselves, called avatars, and interact with other avatars, places or objects. Second Life isn't just a fancy chat room -- residents can do much more than communicate with one another. For one thing, they can contribute to the world around them, creating buildings, objects or even animations. Resident additions to the virtual world are called user-generated content, and this content is one of the factors that makes Second Life such a unique online environment. User-generated content also explains why Second Life is for adults only -- Linden Lab places few restrictions on residents, meaning that you can see some pretty raunchy creations while you're exploring the environment.


Membership Has Its Privileges
If you just want to explore Second Life, you can do it for free. A basic membership costs nothing and allows you to create an avatar and look around the world. If you want to buy land, you'll need to upgrade to a premium membership, which costs $9.95 a month. Concierge members are those who spend more than $125 a month on land-use fees. These users have access to an extensive support network.

In Second Life, residents can go to social gatherings, live concerts, press conferences and even college classes. They can do a lot of things you can do in real life -- buy land, shop for clothes and gadgets or just visit with friends. They can also do things that are impossible in the real world -- avatars can fly or teleport to almost any location. Some residents design short programs, called scripts, which give avatars or objects new abilities, including special animations or the ability to generate copies of other objects.

In many ways, Second Life is similar to Massively Multiplayer Online Role Playing Games (MMORPGs). Like an MMORPG, users represent themselves with a customizable, three-dimensional figure that acts like a computer-generated puppet. Users navigate through an online world, encountering strange landscapes and new people. Unlike MMORPGs, residents in Second Life aren't in a game, though there are games inside Second Life's virtual environment. They inhabit a virtual world free of pre-determined goals or tasks, just like the real world.

The Geography of Second Life

Second Life geography spans two worlds -- the real world and the virtual world. In the real world, Second Life exists on a collection of server host machines, called sims. These computers store all the information found within the virtual world. Each sim runs between 2 to 16 server processes, which simulate regions in Second Life. Every region is 256 m2 in the virtual world. Linden Lab calls the collection of networked sims the grid.

When a new resident logs on to Second Life, his or her avatar appears at "Orientation Island." Here, the resident participates in a tutorial, learning how to navigate through Second Life, communicate with other residents and how to use menus and commands. The resident also learns about the places he or she may venture. All regions have a rating of either PG or mature. Regions with the PG rating should be free of objectionable material, including violent or sexually explicit content. In mature areas, rules are less strict -- avatars might wear revealing clothing or nothing at all, and residents have few behavioral restrictions.

Regions also have safe and unsafe ratings. A safe rating means you can wander around without fear of attack from other avatars or objects (unless you encounter griefers, residents who harass other users). An unsafe region allows residents to simulate combat, either with other users or with objects programmed to attack avatars. Unsafe regions let residents create their own version of an MMORPG, or simply satisfy the visceral thrill of getting into a fight.

Other geographic spaces in Second Life include the mainland, estates, islands and parcels. Linden Lab owns and oversees the mainland, a continent inside Second Life. An estate is a privately owned collection of regions with a unifying theme and code of conduct determined by the estate's owner -- there are estates in Second Life that simulate towns in the old West or medieval Europe. Islands are pretty much what they sound like: Small, independent land masses, usually under the control of a private owner or company. Parcels are very small units of land measuring 4 m2.

Premium membership residents can buy or rent land from Linden Lab or other residents. Land gives residents a place to build and store their virtual possessions, but it's not a necessity -- many residents wander through Second Life without ever owning land. If the resident buys land on the mainland, he or she answers directly to Linden Lab. If the resident rents land on another resident's estate, he or she will have to comply with that resident's rules and conditions. In turn, the estate owner has to pay Linden Lab for the land he or she owns.

Land owners can set their property as public access or private invitation only. They can also designate their land as a PG or mature area. If they own land on the mainland, they can create whatever decorations, landscaping or buildings they like. Because of this, neighborhoods on Second Life's mainland tend to be a hodgepodge of clashing styles. Estate owners can be more restrictive, requiring residents to comply with their aesthetics.

Second Life Avatars

New Second Life users select their avatars from generic male and female templates (residents and their avatars don't necessarily share the same gender). Although a resident could use an unmodified template, everyone else would know that he or she was a newb -- a new user who doesn't know how things work. Most residents customize their avatars a little before leaving Orientation Island.

One important factor in avatar customization is the inventory. The inventory holds hair, skin, objects, animations and body parts and has an infinite capacity. A user can open his or her inventory and choose to put on or remove items, like clothing or hairstyles. Residents can add to an avatar's inventory at any time, creating a practically limitless number of avatar customization options.
They can change their avatars' appearance as often as they like. Nothing in Second Life is permanent -- if a user decides his or her avatar should evolve from a hulking brute to
an emaciated goth kid, he or she can make the changes at any time.

A resident can also right click his or her mouse on the avatar, which pulls up a pie-shaped menu. One of the menu choices is appearance, which allows a user to adjust the way his or her avatar looks. For example, if the user wants to modify the avatar's hairstyle, he or she might use the tool's slide bars to make the hairstyle longer or shorter. Even with this level of control, the user can only adjust what is already there. If he or she wanted a completely new hairstyle, the user would have to either design it or buy it from another resident.

Some residents create special skin textures for avatars ranging from realistic skin and hair to fantasy-inspired scales or feathers. Users can find dozens of residents who sell and trade clothing, skin and even body parts in Second Life. Savvy residents can customize their avatars by creating their own clothes and skins in a graphics program and importing the file into Second Life.

Avatar customization is just one way residents can tweak their Second Life experiences. Users can also build objects within Second Life using simple in-world tools and menus. By creating and linking together basic prim structures, users can create more complex objects. They can also use the Linden Scripting Language, a programming language similar to Java, to give objects specific properties. For example, a skilled user could create a puppy dog that follows him or her everywhere. Residents make objects for different reasons -- some do it to bolster the theme of a particular area or avatar design, others build objects just for fun.

Residents can even build houses and other buildings. Some use programs like AutoCAD to design their structures before importing them into Second Life. Others purchase building designs from other residents. Buildings can be extremely realistic or defy real-world physics.

Second Life's capacity for customization is extensive. The world inside Second Life doesn't just foster user-generated content, it depends upon it. By encouraging user innovation and participation, Second Life has created a loyal community of enthusiastic residents.

Walking and Talking in Second Life

Second Life's controls can be a little intimidating for new users. Its interface includes several menus, buttons and keyboard shortcuts. Many users find the learning curve too steep and quickly give up -- only about 10 percent of all users who make accounts ever bother to return after their first visit.

Avatars can get around Second Life by walking, flying or teleporting to their destination. Residents make their avatars walk around by using the arrow keys. Pushing the up arrow key makes the avatar walk forward, for example. Moving the mouse changes the position of the avatar's head, making it look around.

At the bottom of the resident's screen are several buttons, including the fly button. Clicking on this button will launch the resident's avatar into the air, allowing him or her to fly around like Superman. Flying lets avatars navigate over water or avoid other obstacles they might encounter on the ground.

Teleporting is the fastest method of travel in Second Life. Residents can teleport their avatars by opening up the map function. A window appears with the Map of Second Life, and the resident simply double-clicks on a destination to teleport there. Some locations may have restrictions, such as an island reserved for private use by another resident. In these cases, the avatar teleports as close to the location as possible without violating access restrictions. Without permission, the avatar can't enter restricted areas -- the resident would have to ask the area's owner for an invitation.

Residents can also choose a few different ways to communicate with other users. They can opt to use the Voice feature, which allows residents with microphones to talk to one another live. Residents can also use a chat box, which opens a window in which users can type messages. Chat box conversations are broadcast to everyone in the immediate area, so for more private conversations, residents can instant message another user.

Pie-shaped menus include options that allow residents to interact with other users or objects. Right clicking on objects pulls up the menu, displaying a list of things the resident can do. Another way you can interact is to use gestures. Gestures are animations that can convey a mood or simulate an action. Second Life includes a tool that lets you design your own gestures, or you can get them by buying them or trading with another resident.

Second Life's Tech Specs

As of October 2007, Second Life uses the Havok 1 physics engine. This software simulates real physics within a virtual environment. The physics engine determines how avatars and objects behave within the virtual world, including collision detection (the engine tells the software when two items are touching and how each should react), vehicle dynamics and what animations look like.

The more sophisticated the physics engine, the more realistic simulations using it will be. Linden Lab announced that it is upgrading Second Life to the Havok 4 physics engine. Games that use the Havok 4 engine include Halo 2 and Halo 3, BioShock, Medal of Honor Heroes and Full Spectrum Warrior. As of October 2007, the Havok 4 Second Life engine was still in the beta testing stage.

Textures
­­Residents can apply textures to the surface of objects. A texture is just an image file designed to give a surface a particular look. Examples of textures include wood grain, brick patterns and metallic finishes. Many residents create textures in graphics programs like Photoshop or Paint Pro and then import the files into Second Life.

Residents can hear and view streaming audio and video inside Second Life. Second Life supports audio in MPEG and Ogg Vorbis formats. Streaming video requires the user to install Quicktime. Residents can choose to display video on specific surfaces in the land they own. To do this, they designate the surface's texture as a media surface. If any other surface within that resident's land has the same texture, it will also display the streaming video. Since this can cause confusion, residents should make sure the surface they choose has a unique texture within their land.

A Virtual Hollywood
Second Life is becoming a popular engine for machinima projects. Machinima films are movies that use a pre-existing computer environments and engines. Filmmakers can create avatars in Second Life and use them like digital puppets to create stories, then upload the films to Web pages like machinima.com. Some traditional shows have featured action in Second Life as well, including an episode of "The Office" and a plotline in "CSI: New York."

Second Life requires a fairly hefty setup on the user's end. It's compatible both with PCs and Mac computers. Technical requirements for the PC include:

* A Cable or DSL connection
* Windows 2000, XP or Vista operating system (Linden Lab recommends XP or Vista)
* An 800 MHz Pentium III processor or better (at least 1.5 GHz recommended)
* 512 MB of computer memory (1 GB recommended)
* An nVidia GeForce 2, ATI Radeon 8500 or Intel 945GM graphics card or better

The Mac requirements include the cable or DSL connection, the same amount of computer memory and graphics card requirements as the PC, and:

* Mac OS X 10.3.9 or better
* 1 GHz G4 or better processor

Creating Things in Second Life

Absolutely every object, building and flying car you see in Second Life was created by a Resident. The basics of object creation are easy, but it takes a lot of practice and some serious scripting capabilities to make the really impressive stuff. Fortunately, there's a designated place in Second Life for you to practice these skills: the sandbox. The sandbox is a public space where residents practice building different objects.

You can open the object creation tool three ways:

* Click the "build" button at the bottom of the screen
* Right-click on the ground or any empty space and choose "create" from the options wheel
* Press cmd-4 (ctrl-4 on Mac)

When you open the object creation tool, the default window is "create," indicated by a magic wand symbol. At the top of the window is a list of the 15 prims -- basic shapes like cubes, cones and tubes -- available to Second Life users. A seasoned builder knows how to stretch, cut, link and multiply these prims to create everything from a hotel to a Ferrari.

Here are some of the basic building options:

* Create an object by choosing a prim shape and clicking on the ground or any open space.
* In the "edit" window, you can move, rotate, stretch or change the texture of the object. (The default texture is wood.)
* Use the "object" tab in the edit window to enter precise measurements, rotation angles and more advanced features like tapering and twisting.
* In the "texture" tab, you can choose from existing textures in your Inventory and edit their color and shading.
* You can link objects together by selecting multiple shapes and pressing ctrl-L.
* Copy objects by simply selecting an object, holding down the Shift key and dragging the object.
* Check the "use grid" box in the edit menu to see helpful on-screen rulers as you stretch, move and rotate your objects.

With just these simple tools and key controls, you can make almost any stationary object in Second Life. But if you want to bring your creations to life -- give them movement and interactivity -- you'll have to learn the Linden Scripting Language (LSL). LSL is most similar to the C programming language. There are many Web sites and online tutorials for learning basic and advanced LSL scripts. You can even find a few at the Second Life forums.

To attach a script to a Second Life object, click on the "scripts" tab in the edit menu and click "new script." Within the script editor is a pull-down menu with dozens of common scripting commands. Although, without a basic understanding of LSL, you can't just piece together a working script with those commands.

One of the cool things about Second Life is that you retain intellectual property rights for every object you create in-world. With those rights, you can choose to allow other people to edit your objects or not. You can also assign a price tag to an object and sell it on the Second Life marketplace.

Second Life Population and Rules

Linden Lab listed the population of Second Life at more than 10,500,000 residents as of October 2007. That figure sounds impressive, but it's important to keep a couple of mitigating factors in mind. First, Linden Lab allows users to create more than one account, so some of the 10,500,000 residents are duplicates. Second, the virtual world has a high churn rate, meaning most visitors only log on once and then abandon the program. Some observers mark the churn rate as high as 90 percent, meaning only 10 percent of all the people who visit Second Life will come back after the first visit.

Second Life publishes Economy stats, which include the number of residents who have logged in to the program over the past week, two weeks, month and two months. In October 2007, just fewer than 1,000,000 residents logged in.

According to Second Life's Web page, 60 percent of residents are men. User age ranges from 18 to 85. Residents who use Second Life come from all different backgrounds, from corporate executives to college students.

One unifying trait all residents share is that by creating an account in Second Life they agree to obey Linden Lab's terms of service (TOS). Linden Lab designed the TOS to help protect itself and honest residents from malicious users. Users should read the TOS carefully, particularly if they want to participate in Second Life's economy. The TOS makes it clear that Linden Lab has the right to wipe out a user's inventory, including any in-game currency he or she might have. The company also makes it clear that users can't hold Linden Lab responsible for incidents that delete user information.

Along with the Terms of Service, Linden Lab requires all users to follow the Community Standards. Community Standards lists six kinds of behavior, called the Big Six, which could result in a users' suspension or banishment from Second Life if he or she violates them. They are:

1. Intolerance: Using derogatory language or images relating to a resident's gender, race, ethnicity, religion or sexual orientation
2. Harassment: Stalking another avatar, participating in cyberbullying, using intimidating words or actions or presenting unwelcome sexual advances toward another avatar
3. Assault: Committing an act of violence against another avatar in a Safe area
4. Disclosure: Revealing personal information about another resident
5. Indecency: Inappropriate behavior in PG-rated areas, including running around nude or shouting obscenities
6. Disturbing the Peace: Engaging in behavior that is meant to disrupt other residents' experiences in the virtual world. This can include making repetitive, distracting noises or filling a space with so many objects that the area suffers lag as a result.

Linden Lab has employees in Second Life who can respond to situations, but the company mainly relies on users to report misbehaving residents. For most first offenders, Linden Lab will issue a warning. However, for repeat offenders, Linden Lab may suspend or revoke the user's membership. Offenders could lose all their items and money in the game, and as the Terms of Service make clear, Linden Lab would not have to refund their money.

Not for the Kids
Linden Lab designed Second Life to be an adults-only online community -- all residents must be 18 or older, though there is a separate virtual world called Teen Second Life for users between the ages of 13 and 17. Traditionally, residents could create accounts in Second Life without submitting to an age verification process. In May 2007, Linden Lab announced that SL would soon roll out an age verification system to ensure that all residents meet the minimum age requirement.


Teen Second Life

Because Second Life places age restrictions on its residents, teenagers can't participate in the virtual world. It's not that Second Life is exclusive -- it's that Linden Lab wants to protect teens from the sometimes bawdy content that residents stumble across. But there's a separate virtual world altogether for users between the ages of 13 and 17: Teen Second Life.

Teen Second Life shares nearly all of the same features as regular Second Life. A basic account is free, but a premium account allows you to buy land. Teens can customize their avatars, build an endless variety of objects, and buy and sell in Linden dollars. They can also chat and send in-world instant messages, just like the older residents.

Safety is obviously a big priority whenever a teen community is concerned. Linden Lab staffs the teen world with liaisons who are there to help teens find their way around and to keep an eye out for potential problems. Here are some of Linden Lab's safety tips for Teen Second Life:

* Never reveal real-world personal information to anyone
* Never agree to meet someone in the real world
* Keep passwords a secret
* Log off immediately if you feel uncomfortable or harassed at any time
* Report any strange or inappropriate behavior by going to the "help" menu and clicking "report abuse"
* Share your Second Life experience with your parents

The virtual world of Teen Second Life is tiny compared to regular Second Life. According to Linden Lab statistics, Teen grid avatars make up less than one percent of active Second Life users. Teen Second Life receives heavy competition from similar teen virtual worlds like Virtual MTV and Habbo. But no matter the returning rates of these young residents, they at least have a virtual world outlet provided by the Teen Second Life community.

Second Life Economy

Premium Service

When residents upgrade to premium memberships, they receive a lump sum of Linden Dollars and a weekly stipend. In the fall of 2007, the lump sum was $1,000 Linden, while the stipend was $300 Linden per week. Residents can spend money on land, clothing, textures, accessories, objects or even scripts for objects.

­Second Life's economy is based off a unit of currency called the Linden Dollar. Linden Dollars are virtual money, but that doesn't mean they're worthless. Residents can go to a currency exchange service to convert U.S. dollars into Linden currency, and vice versa. The official exchange service is called LindeX. The exchange rate fluctuates, just like real currencies. In October 2007, the exchange rate was about 267 Linden Dollars for every U.S. dollar. Most transactions within the game world use Linden Dollars.

Second Life's economic model is one of the main reasons Second Life gets a lot of attention. Some people find it strange that someone would spend real money for a virtual house or shirt. It's even more difficult to believe that some people are making a living off of buying and selling items in Second Life. Some are concerned that the U.S. government will explore ways to tax in-game transactions.

Resident Ailin Graef not only makes a living off of Second Life but also became the first person to become a real millionaire through transactions in Second Life. Graef made her fortune by dealing in real estate, becoming what some residents call a land baron. She bought land in Second Life from Linden Lab, developed it using creative and stylish themes, then rented or sold the land back to other residents.

ot all purchases use Linden Dollars -- land sales and auctions usually require real cash. If you want to buy your own island in Second Life, for example, you'll need to throw down $1,675. This will buy a 65,356 m2 island (an entire region). For this fee, you get to choose the island's terrain and location.

Own enough land and you'll have to pay Linden Lab a monthly fee to use it. Your land use fee pays for renting space on a server. The monthly premium membership fee entitles a resident to 512 m2 of land at no additional charge. As a user purchases more land, the land use fee increases.

As of October 2007, the land use fee ranged from $5 per month for ownership of up to 512 m2 of additional land to $195 per month for up to 65,356 m2 of land. Second Life calls residents who spend at least $125 per month on land use fees -- meaning they own at least 32,768 m2 -- concierge members. Linden Lab bases the land use fee off the maximum amount of land a resident owns during each 30-day billing cycle. Concierge members have access to a special team of Linden Lab customer relations employees who help resolve issues.

Second Life and the Real World

Some people believe that the future of the Internet is in three-dimensional virtual worlds like Second Life, where users will navigate through creative landscapes in search of information and entertainment. As a result, some organizations have jumped into Second Life with hopes that they can get in on the ground floor before the community's popularity explodes. More than 100 companies and organizations have an online presence in Second Life. Many own islands and host events like press conferences or concerts. Others use Second Life to promote charitable organizations or political philosophies. Some companies create a space in Second Life with no clear strategy on what to do with it, which usually backfires -- no one wants to go to a location that's just a big advertisement.

Other companies try to avoid that mistake. Coca-Cola, for example, held a competition in which residents submitted designs for a virtual vending machine. The winner of the competition will star in a video about designing a Second Life object. By creating interactive content, Coke avoided the pitfall of jumping into Second Life without contributing to the world's content.

Other companies use similar strategies. Reebok let users design shoes for their avatars, then order a custom-made copy of the shoes for themselves to wear in real life [source: New York Times]. Starwood Hotels used Second Life to test building and room designs, taking suggestions from residents and incorporating them into real building plans [source: Business Week]. Some companies have even used Second Life as a recruitment tool, seeking out residents who are particularly adept at creating user-generated content.

While companies continue to experiment with an online presence in Second Life, a few Internet security experts caution that the virtual world isn't the safest environment in which to conduct business. They point out that griefers can find ways to listen in on confidential conversations or sabotage a company's Second Life location. Most companies only use Second Life as a marketing tool rather than for remote meetings. Some companies are creating virtual environments of their own in order to avoid the security dangers in Second Life.

Some colleges even have a presence in Second Life, holding classes and studying human psychology and sociology in the virtual world. In 2006, Harvard University held a class called CyberOne: Law in the Court of Public Opinion. It was open to the general public of Second Life, where residents could view lectures and participate in discussions [source: Harvard]. Other colleges have experimented with holding classes in the virtual world with varying degrees of success.

Second Life might seem strange and foreign to those of us who are only used to the real world but to residents, it's an important community that's just as valid as any physical environment. Still, whether Second Life marks the future of the Internet or just a passing fad remains to be seen.

Could a single hacker crash a country's network?

You know you're living in the new millennium when one of the Obama administration's newest positions is nicknamed the "cyberczar." In May 2009, President Obama formally announced his plans to appoint a national cybersecurity adviser, charged with protecting computer networks in the United States -- which Obama referred to as "strategic national assets" -- from hacking and spying.



Cybersecurity isn't a new topic making the rounds in Washington. In 2007, the Commission on Cybersecurity for the 44th President, within the Center for Strategic and International Studies, was tasked with examining public policy and issues surrounding cybersecurity and developing recommendations for its improvement. According to the commission's executive summary, the vulnerability of computer networks has become a national security problem.

Computer hacking has evolved from a casual tech sport into a full-blown nefarious industry. With vast amounts of personal information floating around on the Internet, people are constantly at risk for identity theft and the ripple effect of stolen money. For instance, in 2008, the FBI reported $264.6 million lost due to Internet fraud [source: Internet Crime Complaint Center]. The federal government has even more at stake than bank account numbers and birth dates, though. In addition to the appointment of the cyberczar, the Department of Defense plans to establish a U.S. Cyber Command Center to combat the tide of online threats against its networks and classified government data.

The recent series of cyber-attacks on July 4, 2009, highlighted why we need online safeguards. That weekend, government and public Web sites in the United States and South Korea were assaulted with denial-of-service attacks (DoS), which are essentially virus programs that flood sites with traffic and temporarily disable them. North Korea, which isn't even known for having high-tech hacking capabilities, was suspected as the perpetrator [source: Olsen]. While the North Korea allegation hasn't been confirmed, the hackers targeted at least nine U.S. sites, including the White House, Treasury Department and National Security Agency (which is, incidentally, where the future U.S. Cyber Command Center is slated to be stationed). In South Korea, the DoS attacks clogged more than 20 sites.


Estonia's Hack Attack

Cyber-Armageddon has yet to commence, but hackers are waging small skirmishes -- like what took place on July 4, 2009, against the United States and South Korea -- and their skills only continue to mature. Some of the most talented hackers these days live in Russia and former Soviet states [source: Poulsen]. That criminal tech tidbit is interesting, given the political situation surrounding the virtual collapse of Estonia's nationwide network in 2007.

In March 2009, a 22-year-old Russian named Konstantin Goloskokov admitted to rallying a group of pro-Kremlin friends to launch a series of cyber-attacks against Estonian Web sites two years prior. Rioting broke out in Estonia in the spring of 2007 after government workers relocated a commemorative World War II statue of a Soviet soldier. Russian loyalists took offense to the statue incident, which they perceived as a direct snub to the former Soviet Union's contributions to the war [source: Lowe]. As the fighting in streets calmed, a second wave of aggression cropped up in cyberspace. According to Goloskokov, he and a group of friends directed enormous streams of data to Estonian government, bank and media Web sites, effectively crippling the nation's Internet access off and on from April 26 to May 18, 2007.

The Estonian virtual invasion consisted of distributed denial-of-service attacks (DDoS). With DDoS attacks, hackers use other people's computers, sometimes halfway across the globe, to wreak virtual havoc. To launch DDoS attacks, hackers first access other people's computers through zombie applications, malicious software that overrides security measures or creates an entry point. Once hackers gain control over so-called zombie computers, they can network them together to form cyber-armies, or botnets. The Estonian attack relied on vast botnets to send the coordinated crash-inducing data to the Web servers.

Just how much damage did that small group of hackers carry out? According to a New York Times article reporting on the events, the hackers rained down a data load equivalent to downloading the entire Windows XP operating system every six seconds for 10 hours [source: Landler and Markoff]. Hannabank, Estonia's largest bank and one of the prime targets of the attack, lost around $1 million over the course of the attacks, and Parliament members couldn't access e-mail for four days .

Goloskokov, the cyber-attack mastermind, claimed the siege was a form of civil disobedience, rather than criminal behavior. Whatever the intent, the incident demonstrated the tremendous power that a remote group of hackers can wield. Especially considering that Estonia is one of the most wired nations on the globe, the implications for what could happen to larger and arguably less sophisticated networks in, say, the United States seem rather grave. In 2000, the Estonian government adopted Internet access as a basic human right. But as hackers hone their skills, the Baltic nation may have to fight to defend it.

Is cyberwar coming?

Listen up, soldier! Not every battle takes place over rugged terrain, on the open sea or even in the air. These days, you'll find some of the fiercest fighting going on between computer networks. Rather than using bullets and bombs, the warriors in these confrontations use bits and bytes. But don't think that digital weaponry doesn't result in real world consequences. Nothing could be further from the truth.

Consider all the different systems in the United States connected to the Internet:

* Emergency services
* Financial markets and bank systems
* Power grids
* Water and fuel pipelines
* Weapons systems
* Communication networks



That's just the beginning. Think about all the services and systems that we depend upon to keep society running smoothly. Most of them run on computer networks. Even if the network administrators segregate their computers from the rest of the Internet, they could be vulnerable to a cyber attack.

Cyber warfare is a serious concern. Unlike traditional warfare, which requires massive amounts of resources such as personnel, weapons and equipment, cyber warfare only needs someone with the right knowledge and computer equipment to wreak havoc. The enemy could be anywhere -- even within the victim nation's own borders. A powerful attack might only require half a dozen hackers using standard laptop computers.

Another frightening aspect of cyber warfare is that a cyber attack can come as part of a coordinated assault on a nation or it could just be a malicious hacker's idea of a joke. By the time a target figures out the nature of the attack, it may be too late. No matter what the motive, cyber attacks can cause billions of dollars in damages. And many nations are woefully unprepared to deal with cyber attacks. With that in mind, the question isn't will there be a cyberwar -- the question is when will there be one?

Some people might argue that the cyberwar is already here. In fact, based on attacks perpetrated daily against the United States and other nations, the first real cyberwar began back in the late 1990s.

Cyberwars Around the World

Although the Internet has been around for a few decades, it's still a relatively young technology. It's also an extremely useful technology. Governments, corporations and ordinary citizens adopted Internet technology very quickly. Before long, entire industries and government services became dependent upon the Internet to function. The problem is that on the whole, the Internet and the systems connected to it aren't very secure. There are many ways to exploit vulnerabilities and infiltrate systems. Internet security hasn't been able to keep up with adoption and use.

Wargames
The Eligible Receiver experiment employed what is known in the security industry as a red team attack. Red teams are groups of people who are on your side, but behave as if they were a true opponent in order to test your defenses. They can employ all of the strategies a real adversary might use in an attack.

Some people recognized the inherently dangerous nature of the Internet fairly early on. In 1997, the Department of Defense commissioned an experiment codenamed Eligible Receiver. While most of the details regarding Eligible Receiver remain classified, the main purpose of the exercise was to see if a group of hackers using readily-available computers and software could infiltrate the Pentagon's computer systems. The results were sobering -- according to John Hamre, the deputy secretary of defense at the time, it took three days before anyone at the Pentagon became aware that the computer systems were under attack.

The team of hackers gained control of Pentagon and national military command systems. A real attack could have caused the computer systems to shut down. Even more discomforting was the thought that the attackers could access and steal information.


In fact, it seems that a real adversary managed to do just that only a year later. In an attack that the U.S. government called Moonlight Maze, someone managed to penetrate multiple computer systems at the Pentagon, NASA and other facilities and access classified information. U.S. officials discovered the probing attacks by accident in 2000 after going unnoticed for two years. The pilfered data included strategic maps, troop assignments and positions and other sensitive info. Government agents were able to trace the attacks back to Russia, but it's impossible to say if that was their true origin.

The United States isn't always on the defense in cyber warfare. The U.S. has used cyber warfare strategies against Iraq and Afghanistan. During the Kosovo war, the U.S. used computer-based attacks to compromise the Serbian air defense systems. The attacks distorted the images the systems generated, giving Serbian forces incorrect information during the air campaign. Security agents are also working to infiltrate terrorist cells and monitor them remotely.

Recently, cyber warfare played a role in the conflict between Russia and Georgia. Hackers attacked Georgian Web servers with a series of distributed denial of service attacks (DDoS). Essentially, a DDoS involves sending millions of pulses called pings to a Web server. The server becomes overwhelmed trying to respond to the pings and eventually slows or even crashes. The identity of the attackers is still unknown -- it could have been anyone from Russian agents to mafia hackers to someone who wasn't even involved with the conflict.

The list doesn't stop there. Some suspect that North Korea has used cyber attacks on South Korea. There are rumors that China uses cyber attacks against Taiwan. The terrorist organization Al Qaeda has even declared a cyber jihad on the U.S. In many cases, proving one nation is actively using cyber attacks on another is impossible.

What does a cyberwar look like? In the next section, we'll take a closer look at some of the strategies cyber warriors use.

Cyberwar Battle Strategies

While there are many different cyberwar scenarios we could look into, in general you can break down the strategies into two major categories. Let's take a look at each one in detail.



SCADA Systems
Water and fuel systems often use system controls and data acquisition (SCADA) control systems. That's because SCADA systems can automate many tasks by taking cyber commands and converting them into real world actions like opening a valve in a fuel line or shutting off a power grid. But most SCADA systems run on the same software -- mainly Microsoft products -- that happen to have well-known vulnerabilities.

The first major strategy is the Pearl Harbor attack, named after the surprise attack on the naval base at Pearl Harbor, Hawaii, in 1941. This kind of attack involves a massive cyber assault on major computer systems. Hackers would first infiltrate these systems and then sabotage them. They might shut down part or all of a nation's power grid or attack water and fuel lines.

Another approach is to use computer viruses to do the dirty work. Viruses like Code Red, Slammer and Nimda spread rapidly across the Internet. Code Red directed infected computers to attack the White House Web site. These viruses caused billions of dollars worth of damage as companies and governments had to repair computer systems affected by the viruses. Viruses offer hackers a low-risk/high-reward attack because it can be difficult to track down the programmers who unleash them.

Pearl Harbor attacks can be frightening all on their own, but some security experts worry that enemies could coordinate a cyber attack with a physical assault. Imagine your city's power supply winking out in an instant, and within moments you hear the sound of explosions going off in the distance. Such an attack could not only cause a lot of damage, it would be a powerful psychological tactic. Some experts worry that terrorist organizations like Al Qaeda are working on plans that follow this strategy.

­The other method of attack is much more subtle but just as dangerous. Instead of committing a massive cyber assault, the enemy would infiltrate computer systems and just watch and wait. This strategy involves spying and r­econnaissance. The key is to avoid detection and gather as much information as possible. The enemy could use that information to target weak points in the victim nation's infrastructure.

A hacker who has managed to infiltrate a system can also sabotage that system in a more gradual way that avoids detection. By tweaking lines of code in subtle ways, the hacker can make systems less accurate and less reliable over months or even years. This long-term strategy might eventually lead to the system becoming completely unreliable or unresponsive. This method takes longer to implement than a Pearl Harbor attack but it's also more difficult to detect and prevent or repair.

A hidden hacker could even insert computer viruses into an infiltrated system. Not all viruses attack instantaneously. Some hackers build in triggers that they can activate with a manual command. Others use time-activated triggers that will release a virus on a certain date.

Cyberwar Defenses


­Because cyber warfare is so different from traditional warfare, you can't rely on the same rules you'd use in a physical conflict. With the right techniques, a hacker can make an attack practically untraceable. It's not hard for a skilled hacker to create an entire army of zombie computers -- machines infected with a program that allows the hacker to control the computer remotely. A person owning one of these infected computers might not be aware of the intrusion at all. If a computer system comes under attack from an army of zombie computers, it might not be possible to find the hacker ultimately responsible.

Part of preparing for a cyber attack is to educate citizens around the world. The importance of computer security can't be overstated. A combination of the right antivirus software and a careful approach to Internet activities can help prevent hackers from gathering the resources they need to mount an offense in the first place.

Security experts like Richard Clark, former cyber security advisor to the United States, say that part of the responsibility falls on software companies. He has said that software companies often rush products to market without putting them through a rigorous quality control phase. In particular, he criticized Microsoft for its practices. Since then, Microsoft claims it spends more time and resources making sure its products have strong security features .



Why release products that aren't secure? The issue isn't as clear-cut as we might like. There's an economic tradeoff when companies take more time to look into security issues before releasing a product. The longer the production cycle, the more money the company has to spend. That puts software companies in a difficult position. Should they increase the price of their products, which can hurt the consumer? Should they keep the price the same and absorb the added development costs, which hurts their investors? Should they cut costs elsewhere by lowering salaries, which hurts their workforce? The reality is that an increased focus on security will result in an impact on the bottom line of the business. If companies feel the risk of a security breach is low, it's possible that they'll ignore the possibility entirely.

Another thing to consider is that private companies own most of the Internet's infrastructure. Unless the government implements regulations, it's up to these private companies to ensure the safety of their networks. Even experts like Richard Clark have said that regulation is not the right decision -- he argues that it inhibits innovation and lowers the bar for security across all industries.

Most industries and governments employ security experts who monitor their respective computer systems constantly. They are responsible for detecting probes and intrusions and reacting to them. Security experts like John Arquilla, an associate professor at the Naval Postgraduate School, and John Hamre, CEO and president of the Center for Strategic and International Studies, have said that a Pearl Harbor attack would probably not cause widespread destruction, in part because we've learned to detect and respond to attacks quickly [source: Frontline]. While an attack might still be successful, they say that the recovery period would be relatively short. Governments and companies should still try to seal any security holes they might have, but it's not likely that a massive attack could cripple major systems for a significant period of time. Other experts are less certain -- they caution that a well-organized assault could take us by surprise and hit enough systems to cause widespread economic damage.

While it might not be obvious to us in our every day life, there's no doubt that cyber warfare is going on right now between nations and factions around the world. So is cyberwar coming? It may already be underway.

How Creating an Online Business Works

Introduction to How Creating an Online Business Works

What does it take to put together a nice and effective e-commerce Web site? Is it a lot of money? Sometimes. Is it a lot of skill? Many times. Is it a lot common sense and lot of patience? Always! Creating your online business can be a long and arduous process, or it can be done relatively easily. Just read all of the Web-hosting ads and it sounds like your site will be up and taking order before you can say "huh?"



There are many ways you can get your site developed and selling. Here we're going to focus on making it happen. We'll cover some of your options as far as the simplified tools you can use, the more complicated programs that can be used, as well as farming it out to the pros, and some of the other issues that you have to settle like your Web host and making your customers feel secure giving you their credit card numbers.

Tools of the (e)Trade

Depending on your site's purpose in life, you may need few or many tools in order to make your online business venture work. First, ask yourself these questions:

1.Are you going to design your site yourself?
If so, you'll need:

#experience and /or training in Web design (unless you go with the template or wizard-based tools that many all-inclusive services offer)

#a good computer with plenty of RAM (128 Mb and up) and hard drive space (6 GB minimum)

#web design software -- either WYSIWYG (what you see is what you get) or a text editor (if you know html)

#a scanner or digital camera -- for product or service photos

## image editing software

# illustration software to create graphics

# FTP software for uploading files to your Web site

2.Are you going to sell products from your site?
If so, you'll need:

#a merchant account -- or some way to accept payments.

#shopping cart software -- or some other way for shoppers to enter and keep up with their orders .

#secure servers if you're accepting credit card payment or other personal payment information online .

#software (or other process) to keep track of inventory and orders.

3.Do you have a large number of products or services that need listing on your Web site?
If so, you'll need:

#a database of product names, descriptions, pricing, and photos .

#a system for establishing product numbers .

#a system for inventory management .

#technical know-how in incorporating the database into your Web site.

4.Does your product or service require sound, video or animations?
If so, you'll need:

#equipment to capture video and/or audio .

#software for editing your video and/or audio clips.

#software (and training) to create animations .

#a broad-band Internet connection (helpful, but not absolutely necessary).

#or, a resource to whom you can farm these out .

Regardless of how you answered the above questions, you'll need a computer with a good Internet connection for e-mailing and maintaining your site.

E-Commerce Tools: Merchant Accounts


Since e-commerce is usually at the heart of an online business, let's go into some more detail about the tools required to make it happen. Basically, if you want to sell products and collect payment electronically, you're going to have to have:

#a merchant account -- an account that lets you collect payment via credit card .

#software to collect information -- shopping cart programs .

#software to process the transaction and send information to all of the involved parties (your bank, their bank, etc.).

#a secure server -- SSL (secure socket layer) will encrypt the data and send it to a secure server where it can't be intercepted by a third party.

Merchant Accounts

A Merchant Account allows you to accept and process credit card payments either manually by "swiping" or "keying in" a card number, or through your Web site. There are many charges associated with accepting credit cards including:

#a "discount rate" -- usually a 1-4 percent charge based on the sale amount (although online rates can be much higher).

#a transaction charge -- a $.20-$.40 charge per transaction .

#a monthly minimum charge -- a flat rate that is charged if the minimum is not met .

#a "statement fee" -- a monthly fee charged regardless of the amount of charges in a month .

## setup fees.

# application fees .

#batch header fees -- fees that are charged for a batch of transactions, usually every time a terminal is closed out. Some systems automatically "batch out" at the end of the day and you may be charged whether you had any transactions or not!

#and... there are also a few fees for special circumstances.

If you don't plan on accepting credit cards then you don't have to worry about a merchant account. On one hand, with the increase in credit card fraud you may be saving yourself a lot of headaches by not accepting credit cards. On the other hand, some statistics say that you will be turning away 80 percent of your sales by not accepting credit cards. It really comes down to what you're selling and how you're delivering it. If it is a service that must be delivered then you may do just as well (and save money) by invoicing and requesting payment by check, wire transfer, or money order. If you're selling products directly on-line then you probably need to go the merchant account route.

If you have had problems getting a merchant account, you can also try going through an Independent Sales Organization (ISO) for electronic funds processing. These firms usually provide many options for transactions both electronically and in-person. Concord EFS is one vendor, but many others exist.

E-Commerce Tools: Manually Processing Cards

If you already have a brick and mortar business that accepts credit cards then you can simply take the credit card information and process the card manually using your existing merchant account. No special account is necessary for Web transactions.

Processing cards manually gives you the added advantage of being able to hold the card information and charge the customer when their purchase actually ships. Remember that if a product is not able to be shipped within 30 days of the order you must notify the customer of the delay. Most people don't like to be charged for something they haven't received yet and automated card processing on your Web site will do just that. The card is processed and funds are transferred within hours or a few days rather than when the order ships.

E-Commerce Tools: Electronic Payment Options

There are also other alternatives like Paypal and Propay that let you set up accounts to accept payment from customers without having to have a merchant account. There are still charges and limitations, but these may also fit your needs and are worth investigating.

One thing to keep in mind too is that in order to accept American Express or Discover you have to go directly through them.

Electronic checks can also be accepted with the right printing software and validation programs. Your customers would input their checking account and other identification information and you would print the check on blank check stock and deposit it as you would a written check Yes, this is legal. According to Uniform Commercial Code, Title 3, a customer can authorize you to endorse a check on their behalf. You'll also need to authorize the check using national databases that look for bad payment histories, bad checks, stolen checks, etc. Vendors usually offer features that will help you collect for non-sufficient fund (NSF) checks as well. PayByCheck offers these features, as well as several other vendors.

E-Commerce Tools: Shopping Cart Software

Let's assume you now have your merchant account -- or alternative method of processing payments. Now you have to have a way to let your Web shoppers select the products they want, preview the sale amounts, delete items they change their minds about, enter in their payment and shipping information, and then cancel the order completely. (OK, hopefully they won't do that last part.) Having a good shopping cart interface is very important for a good e-commerce-enabled Web site. The easier and more intuitive you make it for your shoppers the more sales and the more repeat business you can have.

So how do you get that cute little shopping cart icon and "order me" button on your site? Well, you could pull out the Cold Fusion books and set aside a few months to code it yourself, or you could leave that fantasy world and get an off-the-shelf shopping cart program. I highly recommend the second option for several reasons. First of all, unless you're a programmer (or have good friends who are) it's going to cost quite a bit more, in terms of your time being money and all, to put together the code to do the job. Second, there are so many good programs out there now that have been proven and debugged over time that it just makes more sense. And third, you can get a lot of features for not a lot of money. Now don't get the idea that we're affiliated with any of these off-the-shelf companies-- we're not. I just recognize a time saver that's worth the money when I see it!

So what features do they have and what do you look for? Ready-to-go shopping cart programs usually offer simple template- or wizard-based tools to set up the ordering functions the way you want them. Most will also give you enough creative license to make the ordering pages have the same "look" and "feel" as the rest of your site, and then all it takes is cutting and pasting the generated code into your own html pages. Also look for:

* SSL (secure socket layer) capabilities
* interactivity with online authorization services
* shipping calculators -- some also offer real-time shipping links
* business administration tools for managing the sales cycle
* management tools to manage your store
* merchandising features that let you cross-sell more products
* inventory tracking functions
* product maintenance and categorizing tools
* order reviewing and confirmation tools
* sales tax calculators
* capabilities for selecting various product options
* e-mail order notifications
* help functions
* search functions
* discount functions
* frequent-shopper-point functions
* price variation capabilities based on product option choices
* database importers for the programs you are using to set up your product databases (e.g.. Microsoft Excel, Access, or even ASCII formats)

You may also find products that offer:

* web-based administration tools that will allow you to administer changes from anywhere
* tools to set up shopper groups to allow you to run specials for select customers
* vendor maintenance tools if you distribute products from different vendors
* editing capabilities for their pre-set templates

Here are some things to remember:

* Watch for products or services that take the shopper away from your site.
* Check out the support services and user documentation.
* Visit some sites that are currently using the product and test them out. (Talk to the store owners if possible.)
* If you are designing and building your own Web site, also check on development components for programs like Microsoft FrontPage or Macromedia Dreamweaver, or whatever program you are using to build your site. (Having these specific components makes integrating the shopping cart code with your site much easier.)
* Check on system requirements and platform compatibility -- if your site is being designed on a Macintosh system then it might help to have the shopping cart software compatible.
* Check out the payment services the program is compatible with such as Authorize.net, Cybercash, SurePay, etc.

So as you can see, there are many features to look at and compare so know your needs before you tackle it. Some programs out there to look at include: BugMall, PDG Software, and SoftCart by Mercantec (actually more of a full-site development tool).

E-Commerce Tools: Using Third-Party Vendors

Another is option is to use a vendor who includes everything you need to get your online business started. This is certainly a more painless way to go than designing and developing everything yourself and then hoping all of the elements will work together happily.

There are some reputable companies that offer these types of services, and many will include not only the Web site design, shopping cart software and merchant account, but also they will register your domain name(s) and host your site for you. Others provide templates and wizards that let you build your site yourself without having to know HTML coding. They include integrated shopping cart software that ties in with an included merchant account.

If you decide to go this route, keep these things in mind:

* watch out for hidden fees
* make sure you've read and understand all of the terms
* make sure you don't have limitations to how you design your site.
* check on importable file formats (like Microsoft Excel spreadsheets for product databases)
* compare different vendors!

Some vendors include:

* Wells Fargo
* Web Site Source
* Speedy Web
* Web Intellects

When comparing vendors, go to some of their clients' sites and see how the shopping cart interface works. Go through the ordering process and see if you like the way it looks and feels. Be sure to visit several stores from each vendor to make sure you're getting a good representation of the features.

Look at the variations of site layout and decide if the ideas you have for your site will work. You typically don't have the flexibility in design with templates and wizards that you have when you design your site the old fashioned way! There may also be limitations in size, database capabilities, etc. Take your list of site functions to the proposed vendor and see if they can accommodate your needs.

Security Issues

Making your visitors feel comfortable enough at your site to give you their credit card number may take some work and planning on your part, but will be infinitely worth the effort. Not only will the appearance and professional design of your site have an impact, but also the security features you build into it. More Web shoppers are wise to the ways of the Internet and know the things they should look for in a site before they enter their financial and personal information.

For instance, they know to look for the lock symbol at the bottom of the screen to signify that their information is being transmitted to a secure server. They also know that the more recognizable trusted names they see on your site the better. Look at one of the larger well-known and trusted retailers such as L.L. Bean or Land's End and see how their site security is put together and displayed. Let's look at some of the things you can do to create that trust in your site visitors.


Digital Security Certificates

Shoppers often look for a trusted third party (TTP) to approve your site and your methods. Companies like VeriSign can provide your site with a digital security certificate that authorizes that you are who you say you are. This helps visitors to your site have the confidence to become buyers and will often make a big difference in your perceived credibility. VeriSign also offers a program called WebTrust that was developed by the American Institute of Certified Public Accountants (AICP) and the Canadian Institute of Chartered Accountants (CICA). This program also provides you with a seal to display on your site if you meet the criteria which includes an evaluation of business, accounting, and transaction practices, as well as protection of consumer information. The VeriSign site states that, "more than 75% of online users have had a favorable impression of the WebTrust seal and that almost half of them report that seeing the seal would make them more likely to conduct an online transaction."

Another security watchdog organization is Trust-e. Trust-e sets policies for the use of personal information, as well as the protection of consumers. There are four Trust-e seal programs:

* Privacy Seal Program -- Companies who display the general Trust-e logo have agreed to abide by special rules concerning the use of personal information.
* Trust-e's E-Health Seal Program -- If your site is health-related you should also investigate this program. It certifies that the site displaying the seal complies with specific principles concerning privacy, quality and best practices.
* EU Safe Harbor Program -- This is a program designed for companies who do business in Europe and wish to comply with the Safe Harbor Privacy Framework put together by the U.S. Department of Commerce.
* Children's Privacy Seal Program -- This program is compliant with the Children's Online Privacy Protection Act (COPPA) and has been approved by the FTC as an authorized COPPA safe harbor.

These TTPs control the use of their logos through various embedded links. For instance, the Trust-e site has a notice for people who landed on the site as a result of clicking on the trust-e logo while on a shopping site. The notice says that if they have arrived there through that method then they may have visited a fraudulent site and to click another link to report it.

Encryption and Secure Servers

Using SSL (Secure Socket Layer), an encryption protocol, along with a digital certificate, provides protection for sensitive data during its transmission to your secure server. This encryption requires two keys. One is a public key which is used to encrypt the data through your customer's browser, and the other is a private key which decrypts the data and is held only by you (or those you authorize). By using a digital certificate provider (like VeriSign), the holder of the decryption key is validated as the correct owner and can then use the data as they need.

In this system, each player has access only to the information they need. The TTP (in this case, VeriSign) assures the shopper, through use of the digital certificate, that the Web site is indeed who they say they are, and the shopper can buy with the knowledge and comfort that they aren't being scammed.

BBB Online Seals

Once you have been in business for one year, you can apply for the Better Business Bureau Online's Reliability seal program. To get into the program and display the seal you must:

* join your local BBB
* agree to abide by their standards including those for truth in advertising
* provide the BBB with information about your company
* have a satisfactory complaint record with the BBB
* respond promptly to all consumer complaints
* and agree to any consumer-requested dispute resolution.

Keep in mind that the BBB doesn't endorse companies, so don't add any text to your site saying you're BBB endorsed. They simply require that their participants have satisfactory complaint records.


Privacy Policies

You must have a privacy policy and a usage policy for your site. These policies will state how you intend to use the personal information from product orders and other information you collect about your site visitors. This is a very important step to take and should not be taken lightly. When you write the policy make sure you follow it to the letter. Not doing so may put you in violation of the FTC Act. You can read the transcripts of a public workshop put on by the the FTC about the use of consumer data at the FTC Web site. There is also a lot of other good information there. You might also visit some well-known commerce sites and see how they've done their privacy statements. If you get a seal from one of the TTP groups listed in the previous section then you'll have to also follow their specifications.

Display the link to your Privacy Policy in a conspicuous spot on your home page and your ordering pages. Make the language easy to understand and clearly state how the information will be used. It is generally recommended to give the consumer the option of not sharing their personal information (assuming you're planning on sharing the data with others). If you are sharing the information, state with whom you will be sharing it.

Include a statement about how you use cookies. Many people are still not clear about how cookies work and are not comfortable with idea. (You may also want to set up your system to not rely on cookies since many people have them disabled in their browsers.)

Merchant Security

Okay, so we've talked about how to make your customers feel more secure, but what about you? What about your liability? What about your losses!? Statistics from credit card companies say that 75 percent of online retailers are liable for the full amount of any credit card fraud they encounter, while 90 percent of consumers are reimbursed for fraud. When you don't have a face-to-face transaction where all three parties (the actual card being the third party) are present then you have the potential for problems. And to make matters even worse, there are now software programs (illegal ones) that can generate an unlimited number of mathematically valid credit card numbers. But haven't mail order retailers been facing this problem all along? How do they protect themselves? There are some ways you can keep your credit card fraud to minimum. Here are a few of the best ones:

* Work under the assumption that you will at some point face credit card fraud -- that keeps your defenses up
* Use Address Verification Service -- This at least works for products that must be shipped within the U.S. It provides no protection for downloadable products such as software or books. (Authorizer and NetVerify are examples.)
* Consider not allowing different "ship to" addresses -- Thieves can always provide you with the correct billing address and then request a different shipping address. By not allowing a different shipping address you could cut back some of your fraudulent charges. Or, you can always perform additional checks on these addresses. (Make sure you get a phone number for the ship-to address.)
* Get a faxed copy of the credit card and signature when in doubt.
* Watch out for large orders of high priced items that are asked to be shipped quickly. If it doesn't match your typical order, call the customer and verify the order and payment information.
* Don't process any order you can't verify by phone.
* Watch out for customers who give you an e-mail address from a free e-mail service like Yahoo or Hotmail. Those are an often used by thieves to help hide identities because any identification information can be submitted in order to get the e-mail address. Require a true ISP-based e-mail address.
* If the customer is - or appears to be - a business, check the Web address (Often the last part of the e-mail address is the Web address. Just add a www. to check it out.) If the Web site doesn't match up with the information you were given then don't fill the order until you can verify further.
* Code your form handler to collect the IP address of the computer sending the order. You can trace it back to the ISP and let them know about the fraudulent activity.
* Watch out for orders that originate, or are to be shipped out of the country. There has been particular fraudulent activity in the Eastern European countries.

Visit the AntiFraud Web site for more ways to protect yourself, as well as a list of free e-mail address providers. You should probably also set aside a sum of money for credit card fraud. Talk to your accountant about what a reasonable amount might be.

Build Your Own Web Site: Easy Way

Building and designing your Web site can be fairly simple, or very complicated. It all depends on the tools you use and the functions you need on your site. If your site doesn't require a lot of interactive features or complicated graphics, you may be just as well-off using one of the template- or wizard-based design tools that are available for sale, or offered free by many Web hosts. You can find more information about this type of software at these sites:

* KnowledgeStorm: Online databases for IT solutions
* Miva Merchant

Other links to storefront software are listed in our Links section under Shopping Cart Software.

If you go this route, make sure you get software specifically for designing a storefront so you'll have shopping cart and commerce tools available. It may also make sense for you to set up your site initially using this type of software, and then as your business grows, redesign the site with a program that has more features and gives you more flexibility (or have your site redesigned professionally). That way you are taking a little less of a gamble with your time and money.

Build Your Own Web Site: Harder Way

If you're up to the challenge, designing your site using a traditional Web authoring software program can give you a lot more control over the look and feel and even the functionality. You can add a lot of things like rollovers and simple animations using these programs. But -- and this is a pretty big but -- it takes time, skill, and a little creative talent. If you've never worked with HTML or Web pages and don't really understand how they work then it's going to take you quite a bit of time to get a good site up and running. If time isn't an issue then you may be fine.

It will definitely be worth the effort to get some training in either HTML or a specific WYSIWYG Web editor program. You should at the very least get a how-to book like Sams-Net "Teach Yourself HTML in a Week" by Laura Lemay, or one of Peach Pit Press's "Real World" books that get down to the nitty-gritty of how to use a specific program.

Build Your Own Web Site: Digital Images and Graphics

Don't forget about graphics. Because specific graphics are something you're going to need regardless of the type of program you use to set up your site, I'll go into a little bit more detail here than in the rest of the site design sections.

There is a lot of canned clip art out there, but many times it looks the part -- like canned clip art. Visitors that see the same graphic on several sites don't go away with the best of impressions about any of the sites! If you can, create some of your own graphic icons and images using a good illustration program like Adobe Illustrator or Corel Draw. (Go to ZDNet or computer-oriented Web site for current reviews and prices of web-graphics software packages.) With an illustration program you can create vector images. These, as opposed to bitmap images are editable, scalable and usually small in file size.

A raster or bitmap image, like those you would get when you scan art or a photo, can be edited, but you need an image editing program like Adobe Photoshop. With this type of program you can change individual pixels or add filters or special effects to layers of the image to get the effect you want. The size, however, cannot be increased very much without loss of image quality and a big increase in file size.

Another option is to purchase some higher quality clip art. Sites like PhotoDisc and Artville have high quality photo images and artwork that aren't always that expensive, particularly for the low resolution (72 dpi) images you would need for your Web site. There are also several sites on the Web that offer free art and images. Our Links page can take you to some of those sites.


Build Your Own Web Site: Creating Your Own Images and Illustrations

If you're selling products on your Web site you're probably going to need photos of them. Most people don't like to buy something sight unseen. If you're distributing products for a manufacturer, the manufacturer may be able to send you prints, electronic files, or they may just direct you to their Web site to download the files yourself. If you are selling your own home-made Widgets and Widget accessories, however, you're going to need to get photos of those items in a format you can put on your Web site.

[INSIDER TIP 1: Use .JPG format for photos and .GIF format for illustrations or line art.]

You have three of options for getting digital images of your products, you, your cat, or whatever you want on the site. You can either buy a good digital camera (no, don't try to use the digital web-cam that you got free from your ISP to use for video chats on the web), or you can take photos with your regular camera and scan the prints using a flatbed scanner. You can get a decent scanner for less than $200 and most come with some kind of image editing software. Good digital cameras are still pretty expensive -- more like $400 and up. They do save time, however, and the image quality has improved substantially. Your third option is to use your traditional film camera and send them to a processor who will also give you digital copies on either diskette or CD. (If there is a chance that you will also want to use the photos in print for your brochures then ask for higher resolution images on CD. The files you get on a diskette or download from a photo Web site probably won't be high enough resolution for print.)

[INSIDER TIP 2: Scan images for the Web at 72 dots per inch (dpi). That is the resolution of most monitors, and higher resolution scans will make no difference in the appearance of the image on screen. If you plan on using the image in print, however, scan at 200-300 dpi or higher depending on the printer or output device.]

Remember, graphics files are usually pretty big files. In order to have them on your site without making your site a big bloated elephant, you'll need to make sure you optimize your graphics before you load them. (Some canned clip art may already be optimized.) Optimizing removes some of the unnecessary pixels and colors and makes the graphic file smaller. You may give up a little bit of the quality but there is usually a good middle ground where the graphic still looks good but its file size is significantly smaller. Some programs will show you a few variations and let you choose the version that you like. Many programs also show you the estimated download time at different connection speeds. NetMechanic offers GifBot a free service/tool that will optimize your graphics for use on your Web site.

Another thing to remember is to size and crop your images or clip art in your illustration program before you put them on your Web page. A lot of WYSIWYG Web authoring software will let you resize or crop images within the program, but the image size as far as kilobytes remains the same. In other words, all of the image data is still there you just can't see it. This means the graphic file is larger than it needs to be. Crop out any unnecessary information before you place the image on the Web page.

[INSIDER TIP 3: You don't want your total page size to be larger than about 50k. That's not very big, but your visitors will thank you for it.]

Build Your Own Site: Making Pre-Set Templates Your Own

This part of your site design gets a little trickier. Most of the WYSIWYG Web authoring programs come with templates that you can edit to suit your needs. It's a good way to introduce yourself to Web design -- by using someone else's! It can also produce some professional-looking results.

One way to personalize your site while still using a template is to create your own top and side navigation banners. By using the same dimensions of the template's navigation graphics, you can make sure yours still fit and don't throw off the rest of the page.

You can also change the color palette of the site. Matching the color of your logo and creating new graphics in the same style as your logo will help pull the site together and give it a more consistent look and feel. But what is look and feel? It's the overall impression you get when you look at something. Does it make you think of old money? Something trendy? The flower-power generation? That sort of thing. The feelings and images you think of when you visit the site. The impressions you have of the type of company.


Some Design Tips

* White space is your friend. Just like in printed brochures, your Web site will look much better with a good balance of graphics, text and white space. Use the white space to better define and draw attention to your site's navigation system. Not only will your site look better, it will also load faster. One of your goals in designing your site is to make the experience a good one for your visitors. If you site is slower to load than molasses in Alaska then your potential customers will become someone else's potential customers! Not everyone has broad band Internet access -- in fact a pretty small percentage do (currently about 30% for 2001 according to Media Metrix) -- so keep your pages fast and lean.

* Who you are and what you do. It should be immediately obvious on your home page what your company does, and what the visitors can find on your site. Your navigation structure is critical. Don't make your visitors have to think about how they might find something -- make it blatantly obvious. In fact, some say you should never have anyone more than one click away from being able to purchase something (assuming, of course, you're selling products on your site).

* Give them what they need. Don't make your site too text-heavy. Keep it short, bulleted and to the point. People visiting your site won't read long passages of text ("pot, meet the kettle" -- I know, but our site has a different purpose!). It's true, but -- and this is another pretty big but -- you have to provide enough information for them to make a decision right then, or else you chance losing the sale to a site that does.

For instance, if you're selling relatively complicated products that have a lot of specifications to compare, make it easy on your shoppers. Include links to all of the relative information they might need. The "Links" to more information are very important. Browsers (and I mean the shoppers not their Web software) don't want to wait on slow loading pages that are full of every scrap of information you have about a product. They want to see the general product description and be able to click a link to go to the meat of the subject.

The same goes for product photos. Keep thumbnail size photos on the primary product description page, but have them linked to a larger image so if the shopper wants to see the fine crafted detail of the piece then they can click and see it in all its glory.

Another helpful addition that may keep shoppers on your site as opposed to your competitor's, can be tables that compare specs from your products with those of competing products so you can show how your products are better and have more features. Or, if you have a lot of similar products that vary in certain areas, create a table comparing your own products. You can also include interactive tools that compare products the shopper has selected from your own product line by clicking a check box next to the item, and then clicking on a "compare" button. A table then comes up that compares those items side by side.

* The good, the bad, and the ugly. A good site can look great, a bad site can look great, and an ugly site can still be great. No matter how nice your site looks, if it's difficult to navigate, or if you don't know exactly what the site is about when you go there then you're still missing the boat -- and tossing a lot of money off the pier while your watching it sail away! The first thing you have to think about is the site's purpose and function -- not the cool graphics, or the colors, or the flash animations. In fact, those sites who start with a fancy animation that makes dial-up visitors bang their heads on their monitors while they wait for it to load really stomp on my last good nerve. (Yes, I still "dial-up.") Always -- let me stress this -- ALWAYS have a very obvious "SKIP THIS INTRO" button that people can click to get past your animation.

Another unnecessary step many sites force their visitors to take is having a lead-in to their home page. There will be a page with the company logo on it and an "ENTER SITE HERE" button. Why? I don't know, but they get on my nerves too. Don't do it. Take your visitors directly to what they want to see -- your content. (Remember, many of them are surfing on company time and they have to speedy about it if they don't want to get caught!)

The layout of your pages, which you hopefully have already drawn out and labeled, will help you (or your designer) determine the best design for your site. It's hard to come up with a design if you don't already have an idea of the number of category pages, types of site functions, etc. So, as I've mentioned in other sessions of this workshop, plan it out FIRST so your site has a better chance of being both good AND aesthetically pleasing.

* Real live people, or at least an address. Make sure visitors to your site can find you in the real world when they need to. Even if your business is only a 'cyber' business you should still have a physical address or PO box, and a phone number where someone can contact you if they have a question. Not only will it give those who are leery of online purchasing a way to still place an order, it will also give them a higher comfort level that your business is legitimate.

* Finally, if you want people to visit your site, jump ahead to our "Promotion" workshop and read about optimizing your pages for search engines. It's much easier to incorporate the information search engines look for into your pages as you design them rather than having to go back after the fact and add the information in.

Web Design Firms

So maybe after reading all of this you've decided your best bet is to hire a professional Web design firm to do it for you. One word of warning -- it's not cheap! If you know your business site is going to HAVE to HAVE some heavy hitting database-driven interactive functions then you are probably making a wise choice -- just don't say I didn't warn you.

So, get your quotes, pick yourself up off the floor, brush yourself off, and get to work. Yes, hiring someone else to do it still requires a lot of work and planning from YOU. You're going to have to provide them with words, images of your products, the purpose and outline of what you need, and a lot of direction. Many design firms do offer assistance in planning and pointers in what works and doesn't, but you still have to be very involved -- at least if you want to get what you want.

Web Hosting: What Does a Host Do?

When you think of a host you may think of a smiling man or woman greeting you at the door and handing you a cool beverage. Or, you may think of a body that supports another parasitic one. Your relationship with your Web site host is kind of a symbiotic combination of the two. You depend on them and they depend on you -- and it can be good, or it can be bad. The thing to remember as you plan and build your online business, is that your Web host is a very important part of it. Bad customer service and support when problems arise (which they probably will at some point) can cost you a lot of money in lost sales and bad first impressions for the visitors arriving at your site while the problem persists. So make sure you get all of the facts about the host you choose for your business.

A Web host leases space for your Web files on their server, which has a direct connection to the Internet. You can either choose a Virtual Web Host who will allow you to use your own domain name, or a Non-Virtual Web Host who will give you a subdomain name that uses their primary domain name. For example, with a non-virtual Web host, your Web address might be http://www.earthlink.com/~yourname/yourwebfiles.html. There are some non-virtual Web hosts, however, that will let you use your own primary domain name, so be sure to ask.

The good thing about non-virtual Web hosting is that it is usually free. Many times the ISP who provides you with your Internet connection and e-mail address will also give you 5-10 MB of free space for a Web site along with a handful of simple tools for creating a Web site and uploading your files. While this might be great for your family or personal Web site, you probably don't want to use it for a business.

Some of the downside issues with non-virtual Web hosts are that the tools and capabilities are usually limited. Many of these hosts limit the types of CGI scripts you can use to their own pre-installed scripts for things like guest books, processing e-mail forms, etc. In other words, you may not be able to have an e-commerce site on a non-virtual site. You may also have to have advertisements on your site that you may not want. And finally, your Web address will not be easy for your customers to remember, and won't make your business appear to be very stable or legitimate.

Virtual Web hosting will typically provide a faster and more reliable connection, better management tools, support for higher level functions, and will range in price from about $10-$50 and on up for more complicated sites.

It is also possible to host your own site although, unless you know how to do it and have a good dedicated connection to the Internet, I don't recommend it for a new online business venture.

Web Hosting: What to Look for in a Host

Remember all of the site planning I mentioned in Planning the Party? Well, pull it back out when you start trying to decide on a host. Make a list of all the things your site will do and then list new functions you want to add in the future. (Plan as far out as five years even!) When you start talking to hosts you'll need to tell them the features your site will need.

Start by going to some of the Web host review sites listed on our Links page and see which ones look like likely candidates. Many of these sites will allow you to enter your requirements and compare host packages or even automatically request quotes from several vendors.

Compare the various features included in their packages. Most should provide account holders with:

* site statistics about how many visitors came to their site and which pages they visited, as well as how long they stayed on the site
* FTP software for uploading your Web files to their server
* e-mail accounts and possibly auto-responders that can simplify response needs like a "thank you -- your order is being processed" e-mail when someone orders a product from your site
* e-commerce tools like easily customized product order forms
* regular site backups
* secure socket layer (SSL) capabilities and other security measures for e-commerce
* an account control panel that lets you do administration functions for your site from your browser (this is relatively new)

There are other features hosts offer so it is important to investigate your options. You might also talk to other online business owners and see what their host experiences have been like. See what tools they use and what tools their hosts have provided. Ask them how many problems they've had with their host and anything else you can think of to help you put a list of prospective host candidates together. Get as many recommendations as you can.

Web Hosting: Screening Potential Hosts

* Once you have list of potential candidates for hosting your new business venture, ask for a quote for hosting your site. Provide them with the list of your site's needs that you prepared above, give them a reasonable amount of time to respond, and then see what you get back.

* If they don't respond to your request by the deadline you've given them then take them off the list. Use that as an indicator of what future dealings with them might be like and move on to the other candidates.

* Ask the host these specific questions regarding their service:
1. Are there any setup fees?
2. Do they offer design or programming services if you should need them and what are the costs?
3. How much free support can you get?
4. When is there a fee for support?
5. How do you go about canceling your account, and is there a fee involved?
6. What tools and software do they offer?
7. What is their uptime guarantee and how do they compensate you for lost time? (You can have your site uptime monitored by Alertsite, or NetMechanic.)
8. How much data transfer (or bandwidth) do they offer?
9. What is their backup method and schedule?
10. How much space can your site use?
11. What are their upgrade policies if your site grows?

Beware of hosts offering unlimited data transfers and unlimited site storage. Those things cost them money and they're gambling that your site (and others) won't use as much as you think, but when your usage increases you may be stuck with additional charges.

* Ask them for a list of clients for you to contact as references. Then CONTACT them. The host's simple good-will act of providing you with a reference list doesn't always mean the clients will have all favorable comments about them. (Although many probably will or they would have been screened out by the host in the first place!)

* When you call the references ask them:

1. about the downtime they've experienced and how closely it matches what the host has said is average
2. about how well they've been reimbursed for this downtime.
3. about how well the host has been about customer support and service
4. and anything else you can think of!

* Test out their customer support by dropping them an e-mail and seeing how long it takes them to respond. Or, call them at random times and see how helpful and accessible they are.

So, the main thing here is to do your homework. Do a test drive if you can. Then just make the best decision you can based on what you know about your hosting candidates. If you do get into a bad host relationship all it can cost you is time, money, and a little bit of aggravation.