Flickr Photo: kallebooImagine this scenario: Your organization provides services and support to area residents during times of crisis. When, say, an earthquake hits, it's your time to shine. You work overtime making sure people have food, shelter, and emotional support. This spike in work also means a spike in donations; during times of crisis, your organization brings in up to 50% of its yearly budget.

Only this time, your site has been hijacked and all those donations are going straight into a hacker's coffers.

Ridiculous? Not as ridiculous as you might think. Many nonprofits have trouble believing that their site could be targeted by hackers. Unless you're one of the big guys with a well-known brand, this is true to some degree. But nefarious technologies keep evolving, making it ever easier for bad folks to launch various exploits and profit by hijacking smaller organizations.

The case in point is the most recent security kerfluffle. The story is long on technical terms, short on narrative, so let me try to summarize the problem for you:

On July 8, super-smart guy and security expert Dan Kaminsky publicized a vulnerability in most Domain Name Servers. You can read Dan's remarkably understandable full explanation, but suffice it to say that the bad guys have learned a new way to direct traffic from your site to wherever they want.

If yours is the organization in our example, the hacker takes control of your domain name and drives people not to YOUR website during the crisis, but to a dummy site set up to look like yours. Your donors probably won't notice the difference, and their "donations" will head, well, who knows where.

That's an elaborate example, but a hacker can do far simpler, but equally hurtful things: your visitors could be redirected to offensive content or asked for personal information that may make them vulnerable to identity theft.

Once a hacker has control of where your visitors go, any number of bad things can happen.

So how do you protect yourself? It's a little complicated:

• Usually, it's your Internet Service Provider handling DNS routing. Ask them if they've applied a patch to their servers and routers.
  
• Check your domain name server for vulnerability. The checker on the right hand side of Dan's blog is really handy.
• If you suspect any vulnerability -- and maybe just do it anyway -- check out services like OpenDNS.com. You should secure your computer and your network router at a minimum. Webmonkey has a nice set of instructions for you.
• Help spread the word. The sooner every DNS system has been patched, the sooner the skulkers have to turn elsewhere.