Although online retailing, or e-commerce, is still growing, some are concerned that either the bubble is about to burst and the economy-online and physical alike-may enter a recessionary period, or that security holes will yet prove to be the Achilles' heel of an Internet-based economy.

These two aren't necessarily alternatives, and are certainly not mutually exclusive. Consider, in fact, that one--the recession--could actually prove to be the solution to most security problems. Think of the advantages of a stiff economic downturn:

Online merchants would have a wealth of suddenly unemployed developers and site administrators at their disposal.

Those who still had jobs would realize they were pretty lucky and should be a little more intelligent and conscientious about details like security and site integrity.

Shoppers would hold on to their money a bit more carefully, and get mighty ticked off if anything threatened it.

If you're currently a Webmaster for one of those online vendors, don't worry: With time and effort, you may obtain a new career as a COBOL programmer at a stable accounting firm with solid health benefits and a reasonable pension.

The first three reasons shouldn't really make you laugh. Although none is the first outcome of an economic downturn, each is a possible effect that would ultimately provide some (reasonably-priced) extra developer talent in the hands of online businesses that really need to invest in their site security. Incomplete security measures were at the heart of the mid-February flurry of distributed denial of service (DDOS) attacks, and every other Web site hack. Few sites are hacked because of pure genius and effort on the part of the hacker; usually, it's haste and carelessness on the part of site developers.

You can chuckle at the fourth reason…but only for a moment. The point is that what now appears to be a permanent sea change in business processes and consumer habits could still turn out to be the contemporary version of citizens-band radio, a fad that burned like wildfire but didn't last. I don't think the Internet is likely to be a flash in the pan; there are obviously significant distinctions (most notably, a strong financial component) between C.B. radio and online commerce. But it would also be arrogant and dangerous to assume that such a young phenomenon has already reached a self-sustaining critical mass. After all, we have a lot at stake, don't we?

Despite overall economic self-confidence, consumer trust in Internet retailers seems to be eroding. DDOS attacks got a lot of headline attention--and so did the windy pronouncements of impending action from the U.S. Justice Department. Still, one gets the impression that the average Internet user understands better than the Feds that a DDOS attack is a real inconvenience, but not a threat to their checkbook or privacy.

Genuine threats have already posed themselves this year, unfortunately. If Amazon.com shoppers felt irritation at the loss of a few shopping hours, anyone who has ever ordered from CD Universe was shaken by the theft and public posting of thousands--maybe hundreds of thousands--of credit card numbers by a hacker calling himself Maxus.

Thanks to the power of Secure Sockets Layer encryption for HTTP traffic, e-commerce defied the predictions of early skeptics who predicted that consumers would never trust the Internet enough to type their credit card numbers and other sensitive financial information in a Web form. That hard-won user confidence could be shattered, as people suddenly realize that information is vulnerable to theft when it is being transmitted, and that every online retail site is a vault storing a high concentration of private records. Imagine the level of concern among people who suddenly feel that the vault door was accidentally left wide open.

If consumers are to continue to patronize Internet retailers, confidence levels must be maintained. If more intrusions occur that directly threaten personal property or privacy, the e-tailing industry may face shoppers fleeing the Net faster than they would evacuate a mall during a bomb threat.

Will there be more intrusions? There is virtually no doubt that Maxus will inspire copycats, even though CD Universe did not pay his $100,000 blackmail demand. Maxus and his associates may have made some money from the cards--he published thousands of card numbers on the site listed above, resulting mostly in the cost and inconvenience of thousands of card cancellations. But regardless of profit, hackers are famous for embracing the idea that imitation is the sincerest form of flattery. The Maxus hack was a thrilling renegade coup; there is no doubt in my mind that hundreds of hackers are trying to repeat it.

Nonetheless, it is the responsibility of the people running a site, not government or law enforcement, to protect it. Customers understand this as well: In the aftermath of the Maxus attack, newsgroups were filled with shopper comments like the following: "Who is the real criminal--a hacker who does this kind of thing or a company who allows its data to be kept in such an unsecure environment that it falls prey to this kind of thing? If I put my money in a bank and found out the next day that someone just waltzed in and took it out of the vault then waltzed out the door, I'd be looking to file a lawsuit against the bank--not the person who took the money."

Or, more ominously, this one: "The only way to protect yourself from this is to never enter your credit card number at a Web site." Does anyone hear the sound of panic?

Now, there are some cynical participants in the online economy who willingly acknowledge that old-school profitability (i.e., sales less costs) matters far less to them than the instant paper wealth generated through initial public offerings and skyrocketing stock. But the bulls of Wall Street are nothing if not herd animals, led only by perceived trends. As long as they see the number of online consumers increasing, they will invest in any dot-com with nearly blind abandon. The sword cuts both ways, though: As soon as those consumer demographics turn downward--especially if accompanied by a justifying factor like a security threat--those investment dollars will dry up even more quickly.

There is no doubt that we live in a special time; the opportunity to effect a dramatic change in the way companies do business, and the way people buy and sell, is real. That change also provides personal opportunities that developers could not have hoped for just a few years ago. Yet there is also a genuine danger that the bubble could still burst, and it would be a true shame if an avoidable lack of security had something to do with that. Site owners and developers may have to choose whether they want to go the extra mile to ensure that security is top-notch…or whether they would rather get those old COBOL manuals out.

Contributing Editor Joe Rudich joe@rudich.com is a network administrator with the St. Paul Companies in St. Paul, Minn.