The entire screed by Brother MacDowell reads like something out of any of several books by "Dilbert" cartoonist Scott Adams. For good reason.

This is not so much a rail preservation problem as a general people-management and administrative problem. It occurs to me that there are probably several books, from the farcical to the serious, at one's local library that covers such personnel issues in business management, and even the farcical ones have their uses.

A slightly different kind of computer website problem that could affect any organization:

About a month ago I was at a family gathering. A cousin's husband is a principal in a civil engineering firm that has a website. I commented about one of the news items on the site -- and I was told that it was about a year out-of-date.

Well, the story went that they had an outside firm (person?) maintain the website. Then the outside firm disappeared. And it turns out that the engineering firm did not have any log-in/password information for the website. Comment was that they were going to completely re-doing the site this year.

On the whole issues of websites, online presences, trust, and passwords/keys to same:

Wrong priority. The Sony hack isn't the one to be worried about. It's Home Depot and Target. Your rogue webmaster won't bankrupt your organization, but a PCI-DSS problem will 80% of the time.

It's a new threat for small businesses because hackers got efficient. Historically the industry was lazy about security because it's inconvenient, and merchants resist it, and the losses were bearable. Then "hack and crack" kits have been packaged to be easy for low-skill "script kiddies", and mafias have gotten good at cashing out stolen CC#'s. So now the industry is frantic to deal with it, and coming down hard on noncompliant merchants.

It's so scary I would stop taking credit cards, and do it Right Now, temporarily until you can install new systems that are intrinsically protected (and they are available now).

A good Content Management System (CMS) eliminates the need to inappropriately share the host server or website usernames and passwords.

If someone you don't know well comes to you and wants to write articles, you can give them a CMS account with just author privileges. They can't edit content other than their own contribution, and they can't publish the content to the public website. In a similar way, someone can be an editor, without having the final say on what and when something is published.

You can also be fine grained on subject matter. For example you could give the head of the motive power department publish privileges for just the motive power section of the website.

As a person becomes more experienced and earns your trust, you can elevate privileges appropriately.

It's important to remember that security isn't just about keeping the wrong people out, you also have to make sure that everyone has just the privileges they need to do their job, no more and no less.

-Mark

Wouldn't Paypal be plenty secure? It has the advantage that you never personally hold the customer accounts, and hopefully they are up on security.

For small organizations, I would recommend that they purchase the domain name separately and have it's own password, all held in house, especially if you have an outside person creating/managing your web page. For those who don't know, the internet is navigated nearly exclusively by IP numbers. the DNS sever converts the name we like to use... like www.google.com or www.rypn.org, to a IP number. Having control of the DNS server means you can switch your webpage at any time. For instance. say your web host gets hijacked to a porn site. You can quickly change the DNS server and point your visitors to a backup copy or a holding page instead. Or if your webmaster evaporates, and updates become impossible, you can switch to a new host as soon as you have one.

Buy the DNS name for as long a term as possible and find a way to remember to renew it before it expires! There are people who snatch up expired DNS names and hold them for ransom.

Also, build your web site locally and maintain copies of it. All my web sites are duplicated fully on three computers, and updates can be uploaded to the server from any one of them. However, for an organization (e.g., museum, restoration project, etc.) it would be good to go the extra step and have a second person who could upload updates, manage the hosting account, renew the domain name, etc. etc. Be sure to have at least two current contacts (e.g., a technical contact and an administrative contact) in the domain record.

Last 3 posts, advice is dead on solid.
I'm peeling off a new subject on the credit card stuff.