Reach New Levels of Performance and Scalability
If your company conducts its business online, Atlantic.Net’s robust architecture, redundant connectivity, and secure PCI compliant hosting will ensure superior delivery and support for your applications. With our expanded network capacity and reliable data centers, your business will avoid traffic bottlenecks and gain the kind of competitive advantage that will bring down your cost and grow revenues.
The Payment Card Industry Security Standards Council develops standards that outline the proper protection of data in today’s security climate. These specifications form the basis of PCI compliant hosting requirements. Compliance with the PCI Data Security Standard (PCI DSS) is necessary for merchants and other entities that process payment cards, transmit that data, or store it.
Since PCI compliance is critical for so many parties, below is a list of PCI compliant server requirements.
The PCI council’s recommendations form the basis of this 12-point checklist of PCI compliant server requirements, which should be considered highlights rather than comprehensive. Click here for a more detailed look at PCI requirements.
When you join multiple networks together, you need a router. When you want to control the traffic entering and leaving a network, or to keep people from getting into certain critical areas, you need to integrate a firewall. Implementation of firewalls and systematic setup of routers and firewalls to better control traffic flow is one of the most fundamental PCI compliant hosting requirements.
If a hacker can just use a list of default passwords or exploits that prey on systems with out-of-the-box settings, your system is vulnerable. When an individual or organization wants to enter your infrastructure, they match together easily accessible default details with software that shows them all the devices connected to your network. When you deploy a new system, switch out those default settings and passwords right away.
Storage of cardholder data is generally not recommended by the PCI standards. The data that is on the chip or stripe should never be put into storage. If your organization does store permanent account numbers, or PANs (in this case payment card numbers), they should be encrypted. When displayed, PAN should be masked. Users should only be able to observe, maximum, the first 6 digits and last 4 digits.
Whenever sending cardholder data through any public network (including the Internet, WiFi, general packet radio systems, global systems for communications, etc.), use IPsec or SSL/TLS to encrypt. Strong encryption should be implemented both for authentication and for data transmission. If you want a sense of best practices for these PCI compliant server requirements, the PCI Council points to IEEE 802.11, which is a set of standards for wireless local area networks (WLAN).
There are plenty of opportunities during the course of business for downloads of malicious applications, through email or web browsing. Antivirus and anti-malware programs detect the activities of known malicious software. In fact, the best companies now work with predictive analytics and artificial intelligence to detect malware before it spreads. Deploy these tools on all systems, and select a solution that creates audit logs.
A hacker could get into a system or program with security weaknesses, potentially allowing them to steal or view PAN. When the developer of a product or platform releases a patch, it should be immediately installed since it solves a known problem. Patches should be implemented on critical systems first, followed by less critical systems, adhering to a vulnerability management program. Note: You can further confirm that you are meeting security-related PCI compliant hosting requirements by choosing one with SSAE 16 audited data centers.
Employee roles and business need-to-know should guide the development of access controls so that unauthorized use does not occur. The basic idea of need-to-know is that you only give the extent of privileges and amount of data to a user that is necessary to conduct their tasks. Zero Trust should be integrated into your access control system, as indicated by the PCI Council’s instructions to “‘deny all’ unless specifically allowed.”
You want to be able to know who is doing what within the system, and you want all activities to be easily trackable so that you can monitor and verify. Do not give anyone access to critical systems or data unless you have first given them a unique user ID. A password, passphrase, or multi-factor authentication (MFA) should be used standardly. MFA should be used for remote access. Virtual private networks, tokenization, or authentication and dial-in should be implemented for remote use.
Data is of course stored on real systems, and access to physical systems presents the opportunity for theft. In order to achieve PCI compliant hosting requirements, the provider’s data center should restrict physical access. Facility entry controls should be used. Before any outsider enters a space in which cardholder data is present or is being processed, they should receive a physical token that they give back prior to departure.
Being able to track exactly what a given user is doing by logging all steps they take allows you to perform vulnerability management and forensics in an organized fashion. Logs allow you to analyze something much more specifically and efficiently if there are any issues. They allow you to understand how hacking or other improper use occurs. You want automated audit trails in place so that you can review any activities.
Security gaps are often revealed through hacking. Testing security protocols, hardware, and software will keep you secure long-term. Check to see what wireless devices are being used with a wireless analyzer at least quarterly. Alternately, use a wireless intrusion detection system (IDS). Network vulnerability scans should be performed once each quarter and also following major adjustments within the network. Perform penetration testing annually at a minimum.
Beyond PCI compliant server requirements, you also need personnel interacting with the systems to be well-equipped. Everyone on staff should know their responsibilities for safeguarding sensitive data. Create, update, and distribute an information security policy that lets your employees know about PCI DSS rules. For internal environments, create usage policies to shape expectations for employees and contractors.
Atlantic.Net’s architecture offers online retailers fast and secure transfer of data, while supporting multiple distribution formats. Our PCI compliant infrastructure is backed by our 100% uptime guarantee, offering you the ultimate peace of mind. Better website performance means better end-user experience. By choosing to host your e-commerce app or website on Atlantic.Net, you are ensuring that it will remain reliable, secure, and robust, enabling a seamless user experience. Our flexible PCI compliant solution suite gives online merchants the power and freedom to choose the kind of top-notch hosting they need.
Our turnkey PCI ready hosting solution, backed by over 24 years of experience ensures that you gain maximum efficiencies and helps you bring focus to your core business and applications.
Ensures best practices for internal controls, physical security, availability, processing integrity, confidentiality, and privacy.
Ensures that our processes, policies, facilities, and hosting solutions comply with the latest HIPAA Audit Protocols.
Stringent testing that continues to expand to comply with HITECH Act policies and protocols.
Atlantic.Net provides secure Cloud Hosting in our agile virtual environment, supporting a variety of e-commerce platforms. Our storage-, memory-, and compute-optimized platform will boost the performance of your online applications and network connectivity, while 100% uptime will ensure your online retail store remains live, searchable, and relevant, building customer trust. The benefit in hosting your application virtually is that it is fast and easy to adjust your storage needs depending on traffic and usage, keeping your investment budget-friendly.
Boosting and supporting high traffic websites and high activity grids is our specialty. The robustness, high security, and meeting of the strictest compliance standards of our Dedicated Hosting environment ensure your data will remain safeguarded and its transfer seamless. Designed to handle massive amounts of data at lightening speeds, our servers feature enterprise-grade solid state drives. Our extensive networks are backed by redundant high-speed connections ensuring you’re always online. To maximize your investment, we offer a plethora of plans to fit any business, small or large, with the aim to elevate it's online retailing.
Our data centers were built to fulfill the strictest requirements, eliminating regulations concerns. Our data centers are routinely inspected. We are SSAE 16 SOC 1 and SOC 2 (Type I and II) certified to ensure that we are up to the exacting standards to secure the most sensitive data. Leave the monitoring of changes to us, as you focus on growing your business.
With hosted data centers in key metropolitan areas, we are prepared to support every geography with our extensive network and superior customer service. Our global presence reduces response latency and ensures that both you and your customers will never have to wait. We standby to assist you in choosing the eCommerce platform that’s best for you.
Dedicated to Your Success
– Jason Coleman
VP of Information Technology, Orlando Magic
"After evaluating a range of managed hosting options to support our data operations, we chose Atlantic.Net because of their superior infrastructure and extensive technical knowledge."
- Erin Chapple
General Manager for Windows Server, Microsoft Corp.
"Atlantic.Net’s support for Windows Server Containers in their cloud platform brings additional choice and options for our joint customers in search of flexible and innovative cloud services."
Contact an advisor at 888-618-DATA (3282) or fill out the form below.
© 2018 Atlantic.Net, All Rights Reserved.