Posted by paragonhost in Hosting News, Internet, Internet Protection, Linux, Network 101, ParagonHost, Security Focus, Technology News, cPanel.
Tags: backscatter, bounce email, E-Mail, emails, managed, ParagonHost, reply address, security, spam, spammer
Bounced Email or Backscatter
April 28, 2008 10:07 AM
Email Bounces
In the past few weeks, we have seen a sharp rise in email bounces. These bounces are for emails that the person did not send. While there are many reasons you can get a bounce, the current wave appears to be a spamming technique where spammers spoof reply-to addresses.
Backscatter
Backscatter occurs when a Mail Transport Agent (aka email server) sends a bounce to a person who did not really send the email. Spam Links has a good description of Backscatter and why it happens. Essentially, someone is spoofing the Reply-To field in an email. They then send it to a mail server and it bounces not back to the sending server but to the Reply-To address. Thus you may receive hundreds of spam messages this way.
Symantec, in their April 2008 Spam Report, also noted an upward trend in backscatter attacks. So if you are seeing this issue, you are certainly not alone.
Backscatter Victim?
Unfortunately, there is little you can do. The protocols for email permit anyone to craft a Reply-To address. There is nothing you can do to force someone not to do it. There are some emerging tools that can help. SPF, sender policy framework, is a DNS based method to try to prevent email forgeries. Using DNS, you can specify what servers and IPs are allowed to send email from your domain. SPF can work very well, however, the technique is not widely adopted. Gmail, HotMail and some other major ISPs do use SPF records; however, using SPF alone will not prevent backscatter. The mail administrators must also configure their systems not to bounce emails that fail SPF tests.
If you are being bombarded by these bounces, you may be able to use your own spam filtering to drop the emails. They often have similar subjects, like failed delivery, Delivery Status Notification, or something similar. Typically the attack stops in 2-3 days.
Otherwise, you just have to keep deleting those emails.
Don’t Backscatter
A main source of backscatter is MTA’s that bounce email to unknown users. You should not bounce email that is sent to unknown users. On Plesk and Cpanel there are setting to reject/fail email to unknown users. On Ensim, there is a problem in that the system creates a default catch-all. From a management standpoint this is very poor. The default prevents you from rejecting email to unknown users. As a result, Ensim servers can become overloaded with dictionary-based email attacks. If your server does bounce emails, you could potential end up in RBLs like Spamcop.net, which not treats backscatter as spam.
Catch-22
Hackers are taking advantage of a key feature of email delivery. Bounces are important for system administrators as they are the first notification that something in the email systems may be awry. However, when they become hijacked by spammers, they become useless as you have to sort through the emails to find real bounces. As a result, some admins just route all bounces to the bit bucket. Disabling bounces can be dangerous however as they can give you an earlier indication if your system has been exploited by a spam bot. Many spammers use web based exploits to use your system to send out the messages. Disabling bounces or null-routing them prevents you from seeing these messages.
Headers, Headers, Headers
To determine if you are the victim of backscatter or if your server is really spamming, you have to analyze the email headers. If the headers do not contain your server as a source for the email, then backscatter is the cause.
Many attackers now spoof many headers in attempts to obfuscate the true sender, but with careful analysis you can often find the source.
Summary
If your inbox is full of those “Delivery Failure Notification” messages then you are likely seeing backscatter. Check the email headers and if the header nearest the bottom is not your server, then it is definitely backscatter.
TrackBack URL for this entry:
http://www.rackaid.com/cgi-bin/mt/mt-tb.cgi/54
Tags: gotcpanel gotmilk paragonhost marketing cpanel
After years of allowing numerous parodies (and even some similar third party trademark registrations) of its famous “Got Milk?” trademark, the California Milk Processor Board (”CMPB”) is threatening to sue People for the Ethical Treatment of Animals (”PETA”) over its use of the phrase “Got pus? Milk does.” on T-shirts, mugs, and other merchandise. See Associated Press article here.
In response to CMPB’s cease and desist letter, PETA’s lawyer wrote:
Your client cannot seriously contend that an appreciable number of consumers who see a T-shirt bearing the “Got Pus? Milk Does” slogan would be confused into thinking that your client is the source of the T-shirt, attempting to sell milk by letting the public know that when they drink milk they are also consuming pus.
So apparently, CMPB is ok with the myriad of “Got Milk?” ripoffs — so long as you don’t bash milk.
Source: http://www.vegastrademarkattorney.com/2007/12/california-milk-processor-board.html
Posted by paragonhost in Business Development, E-Mail, Hosting News, Internet, Internet Protection, ParagonHost, ecommerce.
Tags: content, hosting, manages services, ParagonHost, paragonhost.com, protection, spam, web hosting, world class internet services
Choosing A Hosting Provider
An important step in selecting the right hosting provider for your business is to first identify your hosting requirements such that you can effectively evaluate and compare the different options available. As you begin to define your requirements and consider different hosting providers, consider the following factors.
Customer Care (Support) Services
It is important to understand the level of Customer Care and Support services that will be available to you as a customer. What type of account team or support staff do they provide and what level of certification and expertise do they have? Are they available to help you with any problems 24×7x365 and what type of response time will they commit to for issues?
Review the company’s online resource for support to make sure they are user friendly and useful. Do they make it easy to contact them via phone, email and web submission? Consider testing out their responsiveness and level of expertise by submitting an issue to see how well they respond to your inquiry and if they can address your questions.
Make sure to select a provider that focuses on customer care as a primary objective. Their technical staff should monitor and maintain your site’s performance round the clock and automatically address any problems or performance issues as soon as they arise.
Uptime Guarantees
What level of uptime guarantee does the company provide? It should be as close to 100% as possible and if its not you should be concerned about their ability to maintain their service levels. Inquire as to the actual uptime levels for the past six months and what their worst/longest outage was during that timeframe. It’s important to remember that when your site is down, its lost productivity and revenues for your business so make sure you select a company that is passionate about sustaining its service level.
Be sure to get specific guaranteed commitments on network uptime, elapsed time for hardware replacement and elapsed time for on site data restoration. Additionally, in the event of an outage will they provide a credit to the monthly fees and determine the approach taken to determine the credit received based on the severity of the outage.
Bandwidth and Storage
Many hosting providers today offer generous amounts of disk space. However, depending on the usage of your site, the space requirements may be significantly greater than that which is provided. Carefully review the size of your existing site, plans for how you will evolve it over the coming months/years to determine what level of storage you require. If you require backend databases make sure to take into account growth over time of the database as well as space required for database backups.
Most providers now give bandwidth allocations of 200 Gb/month or more, which is more than adequate for most small businesses. Make sure to consider your site and how it’s used to ensure this is a sufficient level. If you offer a multitude of downloads or large collections of images/photos, then your bandwidth requirements will be much higher than that of a mostly text based web site.
Having high speed access is an essential to having a responsive site. Hosting providers offer connectivity to the internet through T1, T3, and, less frequently, OC (Optical Carrier) lines. T1 and T3 lines offer data transfer rates of 1.5 and 43 Mpbs (megabits per second) respectively and OC3 lines offer 155Mbps. The provider should offer a minimum of two OC-3 (311Mbps) lines for connectivity with sufficient bandwidth available for each server being hosted. This bandwidth should also preferably be connected to high speed internet backbone. The connection point to the internet should also be redundant to avoid outages if one of the lines to the internet is lost.
Shared vs. Dedicated Hosting
In a shared hosting environment, your site is placed on a server that also provides hosting for a number of other businesses. You have your own space, domain, etc, but other people are also using the resources of that server for their sites. There is no risk of your pages showing up on the other businesses site, or vice versa as each site has its own unique set of folders, logins, and so forth.
Besides the fact that shared hosting costs considerably less, the important consideration for most people is that the hosting company support staff administers the server. If there is a problem with the server, they have to fix it, not you. When the operating system or other system software needs to be upgraded, they do it. All you worry about is your own site and the pages contained on it.
For a large number of small businesses, shared hosting is more than adequate. In a shared hosting environment, there is no need for you to have technical knowledge of Windows or Unix server administration. That’s not your core business so why would you want to take that on? In some cases however, there may be specific reasons why someone needs to administer their own server. These usually involve people who have specialized requirements. In that case, a dedicated server would be the option of choice. In a dedicated server environment, you have full control over everything; you configure the server the way you want it. It’s almost as if the server were in your home or place of business, except that you are administering it remotely.
Security
The security of your environment, both physically and digitally, is very important. Determine what type of facility the provider has and how is it secured to ensure only appropriate people have access to your site? How do they control and manage the access such that as staff changes occur they can ensure you site is not at risk by previous employers of the provider?
What type of firewall systems are employed to keep intruders out of the network? How is data snooping prevented? What steps are talking to ensure a denial of service attack can not be employed against the facility or your site?
It takes many layers of Internet security, from password protection to firewall barriers to protect your site from determined hackers. Make sure the hosting provider you choose has enough security measures in place to ensure that your data is completely protected.
Server Platforms Offered
Does the hosting provider offer multiple platforms to selection from (e.g. Windows and Linux) on the latest and greatest equipment? Although it’s possible to host a web site on the CPU of an average personal computer, responsive web sites require high speed SCSI disk drives, lots of memory (ideally memory correcting RAM) and fast microprocessors. Reliable providers host their sites on equipment built to withstand that constant bombardment of web traffic. Inquire as to the hardware used by the provider and the robustness of its configuration to ensure high-availability. Ask about the certifications of the support staff and engineers with regards to the platforms leveraged.
Server and Device Administrations
What level of access and control will you have over the site? Can you directly access the site and if so over what means? Do they provide FTP access, a web-based administration console, remote control, etc? Make sure that you have the level of control you feel necessary to control your site and manage your companies public image. You need to be able to access the site in a manner that enables you to effectively manage it.
Reporting
What type of reporting capabilities are offered by the provider? It’s important to have good reporting analysis tools to watch how many people visit your site, where they are coming from and where they go on your site. In addition, it’s also nice to be able to track/audit updates to the site, when they were made and by whom such that if there is ever a issue you can determine who was the last person to modify the site.
Backups
Backup processes and procedures are critical in the event there is ever a disaster at the provider’s site. Make sure that the site is backed up at least once a day and more frequently if needed based on your specific business requirements. The backups should be kept at an offsite facility such that they are available in the event the primary facility is destroyed. If you leverage databases with your site, make sure the provider is capable of backing up the database and has the skills and a appropriate backup agent that can handle that type of database. What is the time required to restore a site from a previously taken backup? It’s important to understand how long you will be down in the event of hardware or other problem that requires your site be recovered from a backup.
Customer Base
It’s important to judge a hosting provider by the company they keep. Review their website and look for customer testimonials and reference. Ask in detail about the types of companies they serve and make sure you are a good fit for their business. Is your company comparable to their typical customer or are you too big/small for them? Ask for references of business that are similar in size to your business and preferably located in the same geographical area. Follow up with those references to confirm the service level they have received to date from the provider.
Additional Services
And finally, some other services to consider that may be of importance to your business.
- Does the provider offer fully managed email services on the email platform that you leverage?
- Do they provide 3-rd party plugin software for discussion forums or blogging?
- Do they provide eCommerce capabilities such as a shopping cart and merchant accounts?
- Do they provide Secure Socket Layer (SSL) certificates for secure transactions?
- Do they offer Internet Marketing services to help you optimize your site so it is found by search engines?
Tags: buttons brokent, format, graphics, htaccess, lw forum, mod security, modsecurity, phpfox, phpfox.com, phpsns.com, spaw editor
If ModSecurity is Turned On via your Web Server , then build a .htaccess file and place it in the root of the folder running the script that may be having issues.
Issues such as Web Scripts and Broken Graphics also any script that use’s the Spaw Editor will break the format of the editor button layout, this is due to Mod_Security in effect.
Building a .htaccess file and / or adding the noted commands below will resolve. this.
ModSecurity is an open source embeddable web application firewall, or intrusion detection and prevention engine for web applications. ModSecurity provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring and real-time analysis with no changes to existing infrastructure, by operating as an Apache Web server module mod_security or standalone, and thus increase web application security. However, misconfigured or overly strict rule sets, ModSecurity may cause your website to return various errors such as HTTP 403 Forbidden error or access denied error, login problems, or HTTP 412 Precondition Failed error, or HTTP 406 Not Acceptable error and other false positive symptoms.
To make matter worse, the configuration of ModSecurity rules and filters have to be done manually. Although there are free predefined certified rule set which can be used with ModSecurity out of the box, however the rule sets may be not suitable for each and every environment and may interfere with the operation of websites or blogs, and customizing and modifying the rules may be too sophisticated or complicated for some users. And for some websites that hosted on shared hosting service, the mod_security may be enable by default without options. So in this case, the best solution or workaround for mod security related issues is to disable mod_security filtering and rules.
If you’re using Apache web server (which mostly do), mod_security can be disabled by adding a specific in .htaccess file. Locate the .htaccess file in Apache web root directory (public_html or /var/www/ or others), if it does not exist, create a new file named .htaccess, and add in the following code:
SecFilterEngine Off
SecFilterScanPOST Off
The above entries in the .htaccess will disable the ModSecurity (mod_security) module for the domain.
Uninstallation of ModSecurity (mod_security) from Apache module
The easiest way to remove and uninstall mod_security is to comment out or delete the related mod_security entries from httpd.conf Apache configuration file. The lines that should be removed include:
AddModule mod_security.c
LoadModule security_module modules/mod_security.so
Include “/usr/local/apache/conf/modsec.conf” This line may be different depending on what variant of Linux or Unix you used and the installation location
Save the httpd.conf and restart the Apache. ModSecurity will not be loaded and as if uninstalled.
If you’re using WebHost Manager (WHM), uninstallation is even simpler. Just scroll to cPanel section, and click on Addon Modules. Then scroll to module named modsecurity. It should be checked Install and Keep Updated currently. Just click on Uninstall to remove the mod security feature from Apache web server.
Tags: Admin, Applications, dave safley, IT, network, ParagonHost, scandefense, Security Focus, thespambusters, Tools
Posted by Andrew Mitry under Web/Tech
Managing a small or medium sized network can be challenging, over the years I have found these free tools that provide solutions to common IT problems:
- Spiceworks - Inventory, monitoring and help desk.
- OpenDNS - Reliable, secure outbound DNS that blocks phishing sites and gives you the power to block adult sites, proxies and individual domains.
- SSL-Explorer Community Edition - An open-source, browser-based SSL VPN solution that can authenticate against Active Directory and give your users remote access without installing any client-side software.
- VMware Server - Server virtualization allows you to test and deploy new servers quickly and easily. Virtual appliances allow you to trial/run complex applications without having to go through the full install proces.
- GenControl - A simple desktop remote control program that can temporarily install VNC and connect to another machine on your domain in a matter of seconds.
- PaperCut Print Logger - A free print logging application for Windows systems designed to provide real-time activity logs detailing all printer use.
- CrossLoop - Simple and secure screen sharing, great for when you have to help out the boss with his home computer.
- Hamachi - Instant, zero configuration VPN for when you need more than simple screen sharing.
- Montastic - Free website monitoring service.
- Sysinternals - An assortment of utilities to help you manage, troubleshoot and diagnose your Windows systems and applications.
- PacketTrap pt360 - Network management tools with real time reporting.
- Clonezilla or g4u - Hard disk cloning.
- Knoppix - A bootable live Linux operating system on CD or DVD complete with troubleshooting and diagnostic utilities.
- SyncToy, RoboCopy or rsync - Move those files around.
- DNSstuff Tools - DNS, WHOIS,and other network tools.
Tags: aim, client, Collaboration, console chat, dave safley, google chat, icq, im, instant message, instant messenger, Linux, linux chat, mulitple im, open source, ParagonHost, paragonhost llc, scandefense, text based chat client, thespambusters, yahoo im
http://www.pidgin.im/
Pidgin is a multi-protocol Instant Messaging client that allows you to use all of your IM accounts at once.
Pidgin can work with:
- AIM
- Bonjour
- Gadu-Gadu
- Google Talk
- Groupwise
- ICQ
- IRC
- MSN
- MySpaceIM
- QQ
- SILC
- SIMPLE
- Sametime
- XMPP
- Yahoo!
- Zephyr
Pidgin is free software. It is licensed under the GNU General Public License (GPL) version 2. This means you are free to use it and to modify it, but if you distribute your modifications you must distribute the modified source code as well.
Pidgin is an instant messaging program for Windows, Linux, BSD, and other Unixes. You can talk to your friends using AIM, ICQ, Jabber/XMPP, MSN Messenger, Yahoo!, Bonjour, Gadu-Gadu, IRC, Novell GroupWise Messenger, QQ, Lotus Sametime, SILC, SIMPLE, MySpaceIM, and Zephyr.
Pidgin can log in to multiple accounts on multiple IM networks simultaneously. This means that you can be chatting with friends on AIM, talking to a friend on Yahoo Messenger, and sitting in an IRC channel all at the same time.
Pidgin supports many features of the various networks, such as file transfer, away messages, and typing notification. It also goes beyond that and provides many unique features. A few popular features are Buddy Pounces, which give the ability to notify you, send a message, play a sound, or run a program when a specific buddy goes away, signs online, or returns from idle; and plugins, consisting of text replacement, a buddy ticker, extended message notification, iconify on away, spell checking, tabbed conversations, and more.
Pidgin runs on a number of platforms, including Windows, Linux, and other UNIX operating systems. Looking for Pidgin for OS X? Try Adium!
Pidgin integrates well with GNOME 2 and KDE 3.1’s system tray, as well as Windows’ own system tray. This allows you to work with Pidgin without requiring the buddy list window to be open at all times.
Pidgin is under constant development, and releases are usually frequent. The latest news regarding Pidgin can be found on the news page.
What is Finch?
Finch is the text-based version of Pidgin. It supports the same IM networks, but you can run it in a console window. You can use it on Linux, BSD, and other Unixes.
What is libpurple?
libpurple is the programming library that powers Pidgin and Finch. It’s responsible for connecting to all the IM networks, and for managing your accounts and preferences. It’s written in C and makes heavy use of Glib.
Is all of this free?
We believe in freedom of communication. To support our aspirations of “IM Freedom,” we release Pidgin, Finch, and libpurple as free software under the GNU General Public License (GPL). We believe that giving others the freedom to modify, share, and augment our code contributes to the goal of bringing freedom of communication to the Internet. The GPL allows us to ensure that any modifications to our code remain free, so that everyone may enjoy their benefits.
How can I help?
We always welcome feedback and contributions. You don’t need to be a developer to help out, but if you are, you can help us by fixing bugs in our code or building new functionality into it. Our development site includes numerous resources for getting started with libpurple, Pidgin, and Finch development.
If you are a regular user, we encourage you to let us know about any problems you encounter and to provide us with suggestions for improvement. You can do so via our support system, IRC channel, XMPP conference, or development mailing list. We also encourage users to help one another solve problems and discover new features using any of these media.
Aggregation: ParagonHost, LLC http://www.ParagonHost.com
Content Filtering: Scan Defense http://www.ScanDefense.com
Email Spam Prevention: The Spam Busters http://www.TheSpamBusters.com
Tags: Acquirers, Compliance, ControlScan, Credit Card Fraud, eOnlineData, HackerSafe, ID Theft, Identity Theft, Interent eCommerce, ISO, Master Card, Merchant Services, online merchants, Paragon Authorize, ParagonAuthorize, PCI, ScanAlert, Security Focus, Visa
For liability concerns, an acquirer should not directly advocate any one ASV or QSA to their merchants, however it is acceptable for the acquirer to tell the merchants what third party company or companies that they have strategic partnerships with.
“Try to seek a partner who you can rely on to assist with your PCI Compliance program, ControlScan offers a number of solutions for merchants, ISOs and acquirers and currently partners with one of the largest acquirers in the United States,” said Stanton.
As well, the PCI Security Council has a list of approved ASVs and QSAs. Visa and MasterCard also offer their own lists on each Web site.
“Acquirers and ISOs should establish a relationship with a trusted, association-approved PCI assessor, and develop a program for all their merchants to establish compliance, and ensure periodic testing so that compliance remains intact moving forward,” wrote Gray.
A model relationshipThird Party ASVControlScan, Inc. is an Atlanta, Ga.-based, PCI Security Standards Council–approved third party vendor (ASV), providing vulnerability scan and assessments, compliance assistance and network security. Their clients include Fortune 500 and billion dollar corporations such as: Travelers Insurance and PBS.The company offers a turnkey, no-software-needed approach to PCI compliance, and its security certificates assist in meeting the criteria for mandates in Europe, Japan, Canada, ISO and the USA, not only for PCI compliance but also for Sarbanes Oxley, HIPAA, GLBA and FISMA fulfillment. AcquirerAccording to ControlScan’s CTO & Founder, Richard Stanton, the company recently became the ASV for PowerPay, LLC, mentioned previously in this article.“PowerPay requested that we [ControlScan] conduct all of their mandated PCI compliance scans, for all 16,500 of their merchants,” said Stanton.“What sets us apart from other vendors, is that we actually call the merchants, directly, and we also provide a secure Web system, so a company like PowerPay can log into our system and check their merchant’s PCI status at any time.”He continued, “ControlScan is very proactive, providing contact with the merchant, in order to make sure each merchant is PCI compliant…we actually make direct phone calls to each merchant.”
According to PowerPay President Ron Greenberg, after meeting representatives from ControlScan at an industry conference, the company decided ControlScan offered the best PCI compliance scanning program.
“They have a very structured program of trained outbound sales agents along with personalized consulting to assist our merchants in complying with PCI DSS,” says Greenberg. “Other vendors typically did limited outbound sales with no technical support to the merchant.”
In addition to offering the quarterly network scans, mandated by PCI DSS, ControlScan offers an automatic submission solution, for merchants sending the 12-section PCI Self-Assessment Questionnaire.
ISO
e-Online Data is a credit card processor, offering merchant solutions for Internet, Mail Order and Auction sellers. They service e-commerce merchants ranging from startups to billion-dollar companies, according to their Web site.
At the bottom of the e-Online Data homepage, there is a sentence that reads, “e-onlinedata is a registered ISO/MSP of HSBC Bank USA, National Association, Buffalo, NY”
In this model, HSBC Bank USA is the actual acquiring or ‘member bank’, and e-Online Data is considered an ISO.
The partnership between acquirer, member bank, ISO, third party ASV and merchant looks like this:
View the entire image here
“World Class Internet Services”
Tags: Acquirer, Bank, eOnlineData, Internet, Internet Security, Master Card, Merchant, Merchant Services, Online eCommerce, ParagonAuthorize, PCI, PCI Compliance, Security Focus, Transactions, Visa
Who is the acquirer?
It’s a basic question, yet for merchants new to PCI compliance in general, the name ‘acquirer’ may mean several different things.
For some, it means the ‘acquiring bank,’ which is also known as the ‘member bank.’ The member or acquiring bank is the bank that underwrites and issues the credit card from the card associations to acquirers and ISOs. The member bank is just that: a member of the card association-the card association that gives it’s approval and permission for that bank to issue cards with the Visa, MasterCard, Discover or American Express logo.
But an ‘acquirer’ usually refers to the entity-usually a credit card processor–that provides credit card processing services for Visa, MasterCard, AmEx and Discover receipts collected by merchants, directly or through an affiliated ISO.
Moreover, another layer of merchant confusion comes in because there are times when an ISO is considered an acquirer as well, or, in the case of a company like North American Bancard, a Super ISO-an entity that takes the liability responsibility on, that the acquirer would usually take on for the ISO.
The member bank/acquiring bank receives funds from a cardholder when a credit card transaction is completed, and deposits the payment amount, minus any fees, into the merchant’s Merchant Account and from there into his business checking account. From a merchant perspective, knowing the acquirer may be a rather confusing question to even ponder, but it falls to the acquirer to make sure merchants, no matter their level, become compliant. With these new directives in place, it’s incumbent upon the acquirers take their own steps to ensure that they understand what their merchants, ISOs and, in some cases, third party vendors need and to make their merchants understand the PCI compliance process completely.
ISOs and the acquirer
According to an article entitled, “PCI Demands the Attention of Acquirers Now More than Ever Dramatic Non-Compliance Puts ISOs and Acquirers at Risk,” in the May 2007 online edition of “The Exchange” newsletter from the Strawhecker Group-a management consulting company focused exclusively on the merchant acquiring sector of the payments Industry-the relationship between an ISOs and acquirers is very important.
“The liability for non-compliance, when a merchant is breached and/or compromises sensitive data, lies on the acquiring institution; typically, this is passed on to the ISO providing Merchant Services and by that ISO onto the merchant themselves,” wrote Cliff Gray, a PCI expert and associate with The Strawhecker Group.
“Considering that the vast majority of Tier 4 merchants are signed by ISOs, it’s imperative that these ISOs take a stronger stance at ensuring their merchants comply.”
To strengthen the alliance between the ISO and acquirer, Gray offered the following step for moving toward PCI compliance.
“ISOs should carefully review their contract(s) with their sponsor acquirer, to understand exactly what liability they bear upon the event of a merchant breach.”
Greenberg and Richard Stanton, chief technology officer and founder of ControlScan -a leading PCI assessor, who works with US acquiring institutions, merchants, ISOs, weighed in on certain steps that acquirers should take in order to facilitate PCI DSS Compliance for their merchants.
Source: http://www.pcicomplianceguide.org/pcidss/pcidssi-iso-acquirer.html
Aggregation: ParagonHost, LLC http://www.ParagonHost.com/intro.html
“World Class Internet Services”
Merchant Services: Paragon Authrorize: http://www.ParagonAuthorize.com
For Level 4 merchants-brick and mortar or e-commerce sites with Less than 20,000 V/MC e-commerce transactions annually, and all merchants across channels up to 1,000,000 VISA transactions annually-understanding and following the rules of PCI compliance has been murky journey at best.
Despite the copious documentation available at the PCI Security Standards Web site, for many merchants, especially Level 4 merchants, knowing how to introduce and maintain a PCI compliance program is proving to be a puzzling endeavor.
It’s critical that acquirers maintain active and open communication of all policies and procedures with merchants, member banks and the card associations.
Acquirers are the new gatekeepers for PCI compliance information for merchants, but they also serve as information convergence points for card issuers and for third party vendors like ASVs.
It’s up to the acquirers, according to PCI Standards and Security Council, Visa and MasterCard, to ensure that their merchants follow the procedures for compliance.
For acquirers who are not vigilant about merchant compliance, the fines for non-compliance will be steep. Acquirers, whose Level 1 and 2 merchants are not compliant, will be fined between $5,000 and $25,000 a month.
Whether they wish to take on the gate-keeper role or not, Acquirers must step up to the plate, answer and clarify questions that merchants have, concerning the PCI process, or they face the consequences.
According to some merchants, and those working for merchants, how much involvement an acquirer has with the merchant, or the information that is given to the merchant by that acquirer, depends on the acquirer. The acquirer’s information is directly linked to the particular credit card brand’s rules, as well as PCI DSS guidelines. If there is little or no communication between the merchant, acquirer and the card brand, problems begin to accrue.
“The fact that the five major brands have agreed on a single standard is good. Unfortunately, due to federal laws, they do not have full freedom to agree on implementation standards,” said Ron Greenberg, COO of merchant acquirer, PowerPay, LLC.
Based in Portland, ME, PowerPay works with merchants across the US, from retailers, restaurants to convenience stores, all through it’s ‘member bank’ HSBC, and whose business partners include companies like Time Warner Cable, and The California ISP Association.
According to Greenberg, the different credit card brands introduce a whole new level of confusion for merchants and acquirers alike, when it comes to PCI compliance.
“For instance, Visa has defined four levels of compliance for merchants along with a set of fines and penalties,” he explained.
“MasterCard has a different set of rules as well as reporting requirements. Multiply this by five and it creates a mess of rules and compliance issues we need to track.”
When asked, bluntly, whether he felt PCI DSS was going to help or hinder acquirers, his answer was just as blunt.
“They [PCI guidelines] are a necessary evil. Any time you add more procedures it is a headache. Will it help? In the long run it should. But everyone must realize it will not solve the problem.”
Some merchants and employees of merchants, who are charged with facilitating the merchant acquirer relationship, seem to add credence to Greenberg’s assertions.
“I have the feeling, although I can not substantiate it to any degree, that the requirements a merchant is under (particularly absolute compliance dates) varies depending on which Acquirer you are going through,” posted Information Security Manager Andrew Mason, on a PCI Compliance Web forum, recently.
Mason, who works for a merchant company in Spain, is paired with an acquirer based in the United Kingdom; an acquirer that isn’t offering the kind of support he thinks is needed. As well, the answers he’s receiving from the credit cards, themselves, have been nebulous, at best.
“Visa seems happy as long as you can prove ‘progress’ in your PCI Compliance project,” commented Mason. “MasterCard appears to be less clear on the various aspects of compliance, particularly the dates.”
He continued, “I asked a question in a webinar recently which was joint hosted by MasterCard. The question was directed to the MasterCard rep. who was VP of something or other to do with PCI / Compliance. The question was, ‘when is the absolute deadline date for compliance?’ “
“The answer? Any guesses? ‘Speak to your Acquirer’”
Source: http://www.pcicomplianceguide.org/pcidss/iso-acquirer.html
Aggregation: ParagonHost, LLC http://www.ParagonHost.com/intro.html
Tags: dave safley, david j. barrus, hosting, icontact, myicontact, network, paragon, ParagonHost, scandefense, secure, Security Focus, spam prevention, thespambusters, tsb, web
Layered Security Approach Helps Small Businesses Protect Information – Overview
As most seasoned mountain climbers know, the key to keeping warm in subzero temperatures is to put multiple layers of insulation between themselves and Mother Nature.
To help protect your company’s data, you should take cues from the climbers. Instead of looking for a magic formula, you should approach data security from the perspective of layers or building blocks. Each safeguard you can place between malicious online threats and your company’s data will provide another layer of security for the lifeblood of your business: information. The layers – or building blocks – that all small businesses should consider are:
- Physical security
- User security
- System security
- Network security
|
Following are some key considerations for these building blocks.
Building Block 1: Physical Security
When a notebook turns up missing, a desktop is stolen or a handheld is lost, the information stored on the devices goes right along with it. For many small businesses, the cost of losing that data can be far more devastating than the replacement costs of the devices. Small businesses whose employees spend most of their time out of the office, where wireless devices are more vulnerable to loss or theft, can be especially impacted and should be sure to have a protection plan as it relates to physical security.
Physical security includes cable locks and asset tagging, as well as recovery services (such as ComputraceComplete1 from Absolute Software) that are designed to protect your PCs and the data they contain from theft and unauthorized access. Products like those offered by Computrace also can help you remotely track PC configurations and usage.
Building Block 2: User Security
As a small business owner, you should consider your company’s data in much the same way you consider your personal property: You have things you don’t mind sharing with people you know and other stuff that nobody touches but you.
That’s the way you should set up your systems. And with user authorization protocols and software, you can. The first thing to do is to set up your systems so that only authorized users – your employees and, in some cases, your customers – can access the information you want to share with them. The next step is to make sure your employees can readily access information they need in order to do their work efficiently, but are restricted from accessing sensitive company information.
To meet these steps – user authentication, password and encryption technology offer the best solution:
- Look for systems that support BIOS-level passwords that require user authentication even before the operating system loads. All DellTM business systems do this.
- Consider using Smart Card technology to restrict/allow access to your systems. This is standard equipment on all D-family Dell LatitudeTM notebooks.
- Biometric solutions (such as fingerprint identification) offer even greater levels of user authentication.
- Encryption software – which scrambles data in such a way that it becomes useless to any unauthorized person who accesses it – helps to keep hackers and other malicious intruders at arms length.
|
Another important user security precaution is instituting an e-mail and Internet security policy. By getting each employee on the same page about security, you’ll be less likely to experience security problems. Click here for more information on e-mail and Internet security policies.
Building Block3: System Security
More than any other device on your network, the individual PC is the Achilles’ heel in terms of vulnerability because it’s the favored point-of-entry for some of the most common security threats. And the “work-anywhere workforce” enabled by wireless technologies heightens your security challenge. That’s why installing and keeping a current version of security software on all your employees’ computers is a necessary first step to system security. This software helps protect against viruses, worms, spyware, and other threats that are transmitted over the Internet, as well as files imported from USB keys, instant messaging and other means. Click here for a more focused article on spam, viruses and spyware.
Another smart step is to set up your IT structure in a way that enables you to view and manage all of your company’s computers from one central location. This step, which you can achieve by using solutions such as Dell’s OpenManageTM Network Manager, will add confidence that all your PCs have the same level of protection.
Dell also helps small businesses protect their systems from unauthorized access, control and damage with a more secure or “hardened” operating system configuration. This service involves more than 50 factory-activated security settings within the operating system designed to meet security benchmarks established by the Center for Internet Security.
Another important area that small businesses would prefer to avoid – but definitely need to consider – is hard drive failures. Specifically, you need to consider what will happen to your data – and how you want to manage it – in the event of a fatal hard drive crash. To that end, Dell offers a “Keep Your Hard Drive”2 service that helps small businesses stay in control of important data. Under this program, if a hard drive covered by your Dell limited warranty3 fails, you can keep the defective hard drive that’s being replaced by Dell, helping you protect sensitive, classified or proprietary information.
Building Block 4: Network Security
Without a doubt, network technology drives small business productivity and success. But it also increases vulnerability to security threats. Fortunately, a wide range of technologies in the marketplace today are designed specifically to help small businesses keep your networks safe and secure:
- Firewalls: A firewall is a protective barrier that prevents unwanted access to or from your company network. The firewall scans all traffic passing in and out of your network and blocks unauthorized messages, intruders and viruses.
- VPN Protection: A virtual private network (VPN) is a cost effective solution for employees at small businesses to connect securely to their respective business networks from remote locations, and communicate confidentially with each other across shared or public networks like the Internet. Leading technology vendors offer VPN and Intrusion Protection/Packet inspection to help ensure that VPN connections are secure.
- Encryption: When buying network technology, small businesses should seek out those vendors who provide hardware support for WPA2, a sophisticated encryption protocol and part of the 802.11 industry standard for networks. WPA2, which comes standard on select Dell Latitude notebooks, is designed to eliminate the weaknesses found in previous encryption protocols.
- Cisco Compatible Extensions Program: Because the vast majority of wireless networks come in touch with Cisco Systems technologies, small businesses should consider using wireless equipment manufactured by the Cisco Compatible Extensions Program, which is designed to ensure that wireless solutions deliver tested and certified compatibility with the latest Cisco wireless infrastructure hardware and security technology. Dell is a founding member of the program.
|
ParagonHost, LLC
http://www.ParagonHost.com
ScanDefense / TheSpamBusters / MyiContact
(866) 412-HOST
Comments (2)
Three quick additions, SPF is actually about the envelope sender address (Return-Path, MAIL FROM), not the Reply-To address.
Receivers checking SPF hopefully reject a forged mail from, if it was spam that’s it. If it was no spam (erroneous sender policy or receiver rejected FAIL elsewhere, relevant for forwarding) the legit sender gets an error code, and will create a good bounce (non-delivery notification) for the user.
Spammers won’t reach many of their targets with an SPF FAIL protected address, and hopefully give up using an unprotected address after some time.
Posted by Frank | May 2, 2008 10:20 AM
Posted on May 2, 2008 10:20
Thanks. I was being careless with my wording. I will make a clarification in the post.
For the backscatter issue, the field is the return-path field. For SPF, I am pretty sure most filters key off of the mail from header. So you could still spoof a reply-to even with SPF filtering provided the mail from headers were correct.
Currently, when we implement SPF filtering for a client, we reject all messages that have a hardfail. Also, on control panels like Plesk, we setup the default templates to include SPF records by default.
I suspect SPF’s ability to curtail spam will be short lived, but at least it should cut down on the email forgeries which are much more dangerous than the spam.
*** Back Scatter 101
http://spamlinks.net/prevent-secure-backscatter.htm
Bounces are messages, officially called non-delivery reports (NDR) or delivery status notifications (DSN), that are generated by a mail server to report on the delivery status of an email message.
Problems arise with bounces if they are sent by a mail server to a non-local recipient. If a message did not originate locally, then a mail server cannot know for sure if the address it is sending the bounce to is forged or not. This quickly leads to unsolicited “backscatter” (or more rarely “outscatter”), sent to sites that never originated the email.