Choosing A Hosting Provider April 10, 2008
Posted by paragonhost in Business Development, E-Mail, Hosting News, Internet, Internet Protection, ParagonHost, ecommerce.Tags: content, hosting, manages services, ParagonHost, paragonhost.com, protection, spam, web hosting, world class internet services
add a comment
Choosing A Hosting Provider
Customer Care (Support) Services
It is important to understand the level of Customer Care and Support services that will be available to you as a customer. What type of account team or support staff do they provide and what level of certification and expertise do they have? Are they available to help you with any problems 24×7x365 and what type of response time will they commit to for issues?
Review the company’s online resource for support to make sure they are user friendly and useful. Do they make it easy to contact them via phone, email and web submission? Consider testing out their responsiveness and level of expertise by submitting an issue to see how well they respond to your inquiry and if they can address your questions.
Make sure to select a provider that focuses on customer care as a primary objective. Their technical staff should monitor and maintain your site’s performance round the clock and automatically address any problems or performance issues as soon as they arise.
Uptime Guarantees
What level of uptime guarantee does the company provide? It should be as close to 100% as possible and if its not you should be concerned about their ability to maintain their service levels. Inquire as to the actual uptime levels for the past six months and what their worst/longest outage was during that timeframe. It’s important to remember that when your site is down, its lost productivity and revenues for your business so make sure you select a company that is passionate about sustaining its service level.
Be sure to get specific guaranteed commitments on network uptime, elapsed time for hardware replacement and elapsed time for on site data restoration. Additionally, in the event of an outage will they provide a credit to the monthly fees and determine the approach taken to determine the credit received based on the severity of the outage.
Bandwidth and Storage
Many hosting providers today offer generous amounts of disk space. However, depending on the usage of your site, the space requirements may be significantly greater than that which is provided. Carefully review the size of your existing site, plans for how you will evolve it over the coming months/years to determine what level of storage you require. If you require backend databases make sure to take into account growth over time of the database as well as space required for database backups.
Most providers now give bandwidth allocations of 200 Gb/month or more, which is more than adequate for most small businesses. Make sure to consider your site and how it’s used to ensure this is a sufficient level. If you offer a multitude of downloads or large collections of images/photos, then your bandwidth requirements will be much higher than that of a mostly text based web site.
Having high speed access is an essential to having a responsive site. Hosting providers offer connectivity to the internet through T1, T3, and, less frequently, OC (Optical Carrier) lines. T1 and T3 lines offer data transfer rates of 1.5 and 43 Mpbs (megabits per second) respectively and OC3 lines offer 155Mbps. The provider should offer a minimum of two OC-3 (311Mbps) lines for connectivity with sufficient bandwidth available for each server being hosted. This bandwidth should also preferably be connected to high speed internet backbone. The connection point to the internet should also be redundant to avoid outages if one of the lines to the internet is lost.
Shared vs. Dedicated Hosting
In a shared hosting environment, your site is placed on a server that also provides hosting for a number of other businesses. You have your own space, domain, etc, but other people are also using the resources of that server for their sites. There is no risk of your pages showing up on the other businesses site, or vice versa as each site has its own unique set of folders, logins, and so forth.
Besides the fact that shared hosting costs considerably less, the important consideration for most people is that the hosting company support staff administers the server. If there is a problem with the server, they have to fix it, not you. When the operating system or other system software needs to be upgraded, they do it. All you worry about is your own site and the pages contained on it.
For a large number of small businesses, shared hosting is more than adequate. In a shared hosting environment, there is no need for you to have technical knowledge of Windows or Unix server administration. That’s not your core business so why would you want to take that on? In some cases however, there may be specific reasons why someone needs to administer their own server. These usually involve people who have specialized requirements. In that case, a dedicated server would be the option of choice. In a dedicated server environment, you have full control over everything; you configure the server the way you want it. It’s almost as if the server were in your home or place of business, except that you are administering it remotely.
Security
The security of your environment, both physically and digitally, is very important. Determine what type of facility the provider has and how is it secured to ensure only appropriate people have access to your site? How do they control and manage the access such that as staff changes occur they can ensure you site is not at risk by previous employers of the provider?
What type of firewall systems are employed to keep intruders out of the network? How is data snooping prevented? What steps are talking to ensure a denial of service attack can not be employed against the facility or your site?
It takes many layers of Internet security, from password protection to firewall barriers to protect your site from determined hackers. Make sure the hosting provider you choose has enough security measures in place to ensure that your data is completely protected.
Server Platforms Offered
Does the hosting provider offer multiple platforms to selection from (e.g. Windows and Linux) on the latest and greatest equipment? Although it’s possible to host a web site on the CPU of an average personal computer, responsive web sites require high speed SCSI disk drives, lots of memory (ideally memory correcting RAM) and fast microprocessors. Reliable providers host their sites on equipment built to withstand that constant bombardment of web traffic. Inquire as to the hardware used by the provider and the robustness of its configuration to ensure high-availability. Ask about the certifications of the support staff and engineers with regards to the platforms leveraged.
Server and Device Administrations
What level of access and control will you have over the site? Can you directly access the site and if so over what means? Do they provide FTP access, a web-based administration console, remote control, etc? Make sure that you have the level of control you feel necessary to control your site and manage your companies public image. You need to be able to access the site in a manner that enables you to effectively manage it.
Reporting
What type of reporting capabilities are offered by the provider? It’s important to have good reporting analysis tools to watch how many people visit your site, where they are coming from and where they go on your site. In addition, it’s also nice to be able to track/audit updates to the site, when they were made and by whom such that if there is ever a issue you can determine who was the last person to modify the site.
Backups
Backup processes and procedures are critical in the event there is ever a disaster at the provider’s site. Make sure that the site is backed up at least once a day and more frequently if needed based on your specific business requirements. The backups should be kept at an offsite facility such that they are available in the event the primary facility is destroyed. If you leverage databases with your site, make sure the provider is capable of backing up the database and has the skills and a appropriate backup agent that can handle that type of database. What is the time required to restore a site from a previously taken backup? It’s important to understand how long you will be down in the event of hardware or other problem that requires your site be recovered from a backup.
Customer Base
It’s important to judge a hosting provider by the company they keep. Review their website and look for customer testimonials and reference. Ask in detail about the types of companies they serve and make sure you are a good fit for their business. Is your company comparable to their typical customer or are you too big/small for them? Ask for references of business that are similar in size to your business and preferably located in the same geographical area. Follow up with those references to confirm the service level they have received to date from the provider.
Additional Services
And finally, some other services to consider that may be of importance to your business.
- Does the provider offer fully managed email services on the email platform that you leverage?
- Do they provide 3-rd party plugin software for discussion forums or blogging?
- Do they provide eCommerce capabilities such as a shopping cart and merchant accounts?
- Do they provide Secure Socket Layer (SSL) certificates for secure transactions?
- Do they offer Internet Marketing services to help you optimize your site so it is found by search engines?
Remove and Uninstall or Disable ModSecurity (mod_security) March 18, 2008
Posted by paragonhost in Collaboration, Hosting News, Internet, Internet Protection, Linux, Network 101, ParagonHost, cPanel, ecommerce, form-mail.Tags: buttons brokent, format, graphics, htaccess, lw forum, mod security, modsecurity, phpfox, phpfox.com, phpsns.com, spaw editor
add a comment
If ModSecurity is Turned On via your Web Server , then build a .htaccess file and place it in the root of the folder running the script that may be having issues.
Issues such as Web Scripts and Broken Graphics also any script that use’s the Spaw Editor will break the format of the editor button layout, this is due to Mod_Security in effect.
Building a .htaccess file and / or adding the noted commands below will resolve. this.
ModSecurity is an open source embeddable web application firewall, or intrusion detection and prevention engine for web applications. ModSecurity provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring and real-time analysis with no changes to existing infrastructure, by operating as an Apache Web server module mod_security or standalone, and thus increase web application security. However, misconfigured or overly strict rule sets, ModSecurity may cause your website to return various errors such as HTTP 403 Forbidden error or access denied error, login problems, or HTTP 412 Precondition Failed error, or HTTP 406 Not Acceptable error and other false positive symptoms.
To make matter worse, the configuration of ModSecurity rules and filters have to be done manually. Although there are free predefined certified rule set which can be used with ModSecurity out of the box, however the rule sets may be not suitable for each and every environment and may interfere with the operation of websites or blogs, and customizing and modifying the rules may be too sophisticated or complicated for some users. And for some websites that hosted on shared hosting service, the mod_security may be enable by default without options. So in this case, the best solution or workaround for mod security related issues is to disable mod_security filtering and rules.
If you’re using Apache web server (which mostly do), mod_security can be disabled by adding a specific in .htaccess file. Locate the .htaccess file in Apache web root directory (public_html or /var/www/ or others), if it does not exist, create a new file named .htaccess, and add in the following code:
SecFilterEngine Off
SecFilterScanPOST Off
The above entries in the .htaccess will disable the ModSecurity (mod_security) module for the domain.
Uninstallation of ModSecurity (mod_security) from Apache module
The easiest way to remove and uninstall mod_security is to comment out or delete the related mod_security entries from httpd.conf Apache configuration file. The lines that should be removed include:
AddModule mod_security.c
LoadModule security_module modules/mod_security.so
Include “/usr/local/apache/conf/modsec.conf” This line may be different depending on what variant of Linux or Unix you used and the installation location
Save the httpd.conf and restart the Apache. ModSecurity will not be loaded and as if uninstalled.
If you’re using WebHost Manager (WHM), uninstallation is even simpler. Just scroll to cPanel section, and click on Addon Modules. Then scroll to module named modsecurity. It should be checked Install and Keep Updated currently. Just click on Uninstall to remove the mod security feature from Apache web server.
PCI Compliance: Acquirers and ISOs December 28, 2007
Posted by paragonhost in Hosting News, Internet, Internet Protection, ModernBill, Network 101, PCI Compliance, ParagonAuthorize, ecommerce.Tags: Acquirers, Compliance, ControlScan, Credit Card Fraud, eOnlineData, HackerSafe, ID Theft, Identity Theft, Interent eCommerce, ISO, Master Card, Merchant Services, online merchants, Paragon Authorize, ParagonAuthorize, PCI, ScanAlert, Security Focus, Visa
add a comment
For liability concerns, an acquirer should not directly advocate any one ASV or QSA to their merchants, however it is acceptable for the acquirer to tell the merchants what third party company or companies that they have strategic partnerships with.
“Try to seek a partner who you can rely on to assist with your PCI Compliance program, ControlScan offers a number of solutions for merchants, ISOs and acquirers and currently partners with one of the largest acquirers in the United States,” said Stanton.
As well, the PCI Security Council has a list of approved ASVs and QSAs. Visa and MasterCard also offer their own lists on each Web site.
“Acquirers and ISOs should establish a relationship with a trusted, association-approved PCI assessor, and develop a program for all their merchants to establish compliance, and ensure periodic testing so that compliance remains intact moving forward,” wrote Gray.
A model relationshipThird Party ASVControlScan, Inc. is an Atlanta, Ga.-based, PCI Security Standards Council–approved third party vendor (ASV), providing vulnerability scan and assessments, compliance assistance and network security. Their clients include Fortune 500 and billion dollar corporations such as: Travelers Insurance and PBS.The company offers a turnkey, no-software-needed approach to PCI compliance, and its security certificates assist in meeting the criteria for mandates in Europe, Japan, Canada, ISO and the USA, not only for PCI compliance but also for Sarbanes Oxley, HIPAA, GLBA and FISMA fulfillment. AcquirerAccording to ControlScan’s CTO & Founder, Richard Stanton, the company recently became the ASV for PowerPay, LLC, mentioned previously in this article.“PowerPay requested that we [ControlScan] conduct all of their mandated PCI compliance scans, for all 16,500 of their merchants,” said Stanton.“What sets us apart from other vendors, is that we actually call the merchants, directly, and we also provide a secure Web system, so a company like PowerPay can log into our system and check their merchant’s PCI status at any time.”He continued, “ControlScan is very proactive, providing contact with the merchant, in order to make sure each merchant is PCI compliant…we actually make direct phone calls to each merchant.”
According to PowerPay President Ron Greenberg, after meeting representatives from ControlScan at an industry conference, the company decided ControlScan offered the best PCI compliance scanning program.
“They have a very structured program of trained outbound sales agents along with personalized consulting to assist our merchants in complying with PCI DSS,” says Greenberg. “Other vendors typically did limited outbound sales with no technical support to the merchant.”
In addition to offering the quarterly network scans, mandated by PCI DSS, ControlScan offers an automatic submission solution, for merchants sending the 12-section PCI Self-Assessment Questionnaire.
ISO
e-Online Data is a credit card processor, offering merchant solutions for Internet, Mail Order and Auction sellers. They service e-commerce merchants ranging from startups to billion-dollar companies, according to their Web site.
At the bottom of the e-Online Data homepage, there is a sentence that reads, “e-onlinedata is a registered ISO/MSP of HSBC Bank USA, National Association, Buffalo, NY”
In this model, HSBC Bank USA is the actual acquiring or ‘member bank’, and e-Online Data is considered an ISO.
The partnership between acquirer, member bank, ISO, third party ASV and merchant looks like this:
PCI Compliance: Who is the Acquirer? December 28, 2007
Posted by paragonhost in Internet, Internet Protection, PCI Compliance, ParagonAuthorize, Technology News, ecommerce.Tags: Acquirer, Bank, eOnlineData, Internet, Internet Security, Master Card, Merchant, Merchant Services, Online eCommerce, ParagonAuthorize, PCI, PCI Compliance, Security Focus, Transactions, Visa
add a comment
Who is the acquirer?
It’s a basic question, yet for merchants new to PCI compliance in general, the name ‘acquirer’ may mean several different things.
For some, it means the ‘acquiring bank,’ which is also known as the ‘member bank.’ The member or acquiring bank is the bank that underwrites and issues the credit card from the card associations to acquirers and ISOs. The member bank is just that: a member of the card association-the card association that gives it’s approval and permission for that bank to issue cards with the Visa, MasterCard, Discover or American Express logo.
But an ‘acquirer’ usually refers to the entity-usually a credit card processor–that provides credit card processing services for Visa, MasterCard, AmEx and Discover receipts collected by merchants, directly or through an affiliated ISO.
Moreover, another layer of merchant confusion comes in because there are times when an ISO is considered an acquirer as well, or, in the case of a company like North American Bancard, a Super ISO-an entity that takes the liability responsibility on, that the acquirer would usually take on for the ISO.
The member bank/acquiring bank receives funds from a cardholder when a credit card transaction is completed, and deposits the payment amount, minus any fees, into the merchant’s Merchant Account and from there into his business checking account. From a merchant perspective, knowing the acquirer may be a rather confusing question to even ponder, but it falls to the acquirer to make sure merchants, no matter their level, become compliant. With these new directives in place, it’s incumbent upon the acquirers take their own steps to ensure that they understand what their merchants, ISOs and, in some cases, third party vendors need and to make their merchants understand the PCI compliance process completely.
ISOs and the acquirer
According to an article entitled, “PCI Demands the Attention of Acquirers Now More than Ever Dramatic Non-Compliance Puts ISOs and Acquirers at Risk,” in the May 2007 online edition of “The Exchange” newsletter from the Strawhecker Group-a management consulting company focused exclusively on the merchant acquiring sector of the payments Industry-the relationship between an ISOs and acquirers is very important.
“The liability for non-compliance, when a merchant is breached and/or compromises sensitive data, lies on the acquiring institution; typically, this is passed on to the ISO providing Merchant Services and by that ISO onto the merchant themselves,” wrote Cliff Gray, a PCI expert and associate with The Strawhecker Group.
“Considering that the vast majority of Tier 4 merchants are signed by ISOs, it’s imperative that these ISOs take a stronger stance at ensuring their merchants comply.”
To strengthen the alliance between the ISO and acquirer, Gray offered the following step for moving toward PCI compliance.
“ISOs should carefully review their contract(s) with their sponsor acquirer, to understand exactly what liability they bear upon the event of a merchant breach.”
Greenberg and Richard Stanton, chief technology officer and founder of ControlScan -a leading PCI assessor, who works with US acquiring institutions, merchants, ISOs, weighed in on certain steps that acquirers should take in order to facilitate PCI DSS Compliance for their merchants.
Source: http://www.pcicomplianceguide.org/pcidss/pcidssi-iso-acquirer.html
Aggregation: ParagonHost, LLC http://www.ParagonHost.com/intro.html
“World Class Internet Services”
Merchant Services: Paragon Authrorize: http://www.ParagonAuthorize.com
PCI Compliance and Level 4 Merchants December 28, 2007
Posted by paragonhost in Internet, Internet Protection, PCI Compliance, Technology News, ecommerce.add a comment
For Level 4 merchants-brick and mortar or e-commerce sites with Less than 20,000 V/MC e-commerce transactions annually, and all merchants across channels up to 1,000,000 VISA transactions annually-understanding and following the rules of PCI compliance has been murky journey at best.
Despite the copious documentation available at the PCI Security Standards Web site, for many merchants, especially Level 4 merchants, knowing how to introduce and maintain a PCI compliance program is proving to be a puzzling endeavor.
It’s critical that acquirers maintain active and open communication of all policies and procedures with merchants, member banks and the card associations.
Acquirers are the new gatekeepers for PCI compliance information for merchants, but they also serve as information convergence points for card issuers and for third party vendors like ASVs.
It’s up to the acquirers, according to PCI Standards and Security Council, Visa and MasterCard, to ensure that their merchants follow the procedures for compliance.
For acquirers who are not vigilant about merchant compliance, the fines for non-compliance will be steep. Acquirers, whose Level 1 and 2 merchants are not compliant, will be fined between $5,000 and $25,000 a month.
Whether they wish to take on the gate-keeper role or not, Acquirers must step up to the plate, answer and clarify questions that merchants have, concerning the PCI process, or they face the consequences.
According to some merchants, and those working for merchants, how much involvement an acquirer has with the merchant, or the information that is given to the merchant by that acquirer, depends on the acquirer. The acquirer’s information is directly linked to the particular credit card brand’s rules, as well as PCI DSS guidelines. If there is little or no communication between the merchant, acquirer and the card brand, problems begin to accrue.
“The fact that the five major brands have agreed on a single standard is good. Unfortunately, due to federal laws, they do not have full freedom to agree on implementation standards,” said Ron Greenberg, COO of merchant acquirer, PowerPay, LLC.
Based in Portland, ME, PowerPay works with merchants across the US, from retailers, restaurants to convenience stores, all through it’s ‘member bank’ HSBC, and whose business partners include companies like Time Warner Cable, and The California ISP Association.
According to Greenberg, the different credit card brands introduce a whole new level of confusion for merchants and acquirers alike, when it comes to PCI compliance.
“For instance, Visa has defined four levels of compliance for merchants along with a set of fines and penalties,” he explained.
“MasterCard has a different set of rules as well as reporting requirements. Multiply this by five and it creates a mess of rules and compliance issues we need to track.”
When asked, bluntly, whether he felt PCI DSS was going to help or hinder acquirers, his answer was just as blunt.
“They [PCI guidelines] are a necessary evil. Any time you add more procedures it is a headache. Will it help? In the long run it should. But everyone must realize it will not solve the problem.”
Some merchants and employees of merchants, who are charged with facilitating the merchant acquirer relationship, seem to add credence to Greenberg’s assertions.
“I have the feeling, although I can not substantiate it to any degree, that the requirements a merchant is under (particularly absolute compliance dates) varies depending on which Acquirer you are going through,” posted Information Security Manager Andrew Mason, on a PCI Compliance Web forum, recently.
Mason, who works for a merchant company in Spain, is paired with an acquirer based in the United Kingdom; an acquirer that isn’t offering the kind of support he thinks is needed. As well, the answers he’s receiving from the credit cards, themselves, have been nebulous, at best.
“Visa seems happy as long as you can prove ‘progress’ in your PCI Compliance project,” commented Mason. “MasterCard appears to be less clear on the various aspects of compliance, particularly the dates.”
He continued, “I asked a question in a webinar recently which was joint hosted by MasterCard. The question was directed to the MasterCard rep. who was VP of something or other to do with PCI / Compliance. The question was, ‘when is the absolute deadline date for compliance?’ “
“The answer? Any guesses? ‘Speak to your Acquirer’”
Source: http://www.pcicomplianceguide.org/pcidss/iso-acquirer.html
Aggregation: ParagonHost, LLC http://www.ParagonHost.com/intro.html
