{"id":1971,"date":"2012-07-09T00:00:00","date_gmt":"2012-07-09T00:00:00","guid":{"rendered":"http:\/\/otava.test\/why-invest-in-pci-hosting\/"},"modified":"2012-07-09T00:00:00","modified_gmt":"2012-07-09T00:00:00","slug":"why-invest-in-pci-hosting","status":"publish","type":"post","link":"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/","title":{"rendered":"Why Invest in PCI Hosting?"},"content":{"rendered":"

PCI DSS Compliance (Payment Card Industry Data Security Standards)<\/strong>\u00a0– those in the e-commerce, financial and retail industry know this means a lot of money, time and manpower. Many try to skirt around the issue and avoid investing in a PCI hosting<\/a><\/strong> partner that has been independently PCI audited and go for the cheaper guy. Why don\u2019t you want to do that? Because you don\u2019t want to suffer a data breach and the costly legislation, fees and reputation management that results.<\/p>\n

And because the cheaper guy doesn\u2019t even know what PCI compliance is, nor what technical or physical security requirements<\/a> should be in place on his end to help you achieve compliance.<\/p>\n

A few weeks ago, the FTC filed suit against Wyndham Worldwide, a major hotel chain including three subsidiaries, for the 600,000 credit cardholder data that was stolen in less than two years and in three different incidences. This resulted in more than $10.6 million in fraud loss, according to the FTC\u2019s lawsuit. Not sure why it took two more subsequent data breaches than necessary to elicit a lawsuit, but three certainly calls for serious action.<\/p>\n

[In the HIPAA compliance<\/a> world of healthcare, subsequent data breaches would show a lack of \u2018due diligence\u2019 or \u2018willful neglect,\u2019 meaning the organization or business failed to prove they had the standard security in place to meet compliance. Or, if they contracted with a third party, they had failed to thoroughly vet their service provider for their ability to meet compliance. Although this list is HIPAA-specific, it can still be handy to apply to all data center providers for all types of compliance needs – read up on the top Five Questions to Ask Your HIPAA Hosting Provider<\/a>].<\/p>\n

Back to the Wyndham case – in all three incidences, hackers were the root cause of the data breaches. They had compromised the security of Wyndham\u2019s data center located in Phoenix, Arizona, in which their corporate network and central reservation system is housed. According to the lawsuit, Wyndham failed to have a lot of standard, PCI security measures in place, both at their data center and at their chain of hotels. Here’s a list of what they were charged with (and what you should avoid):<\/p>\n

    \n
  1. They failed to use firewalls between their property management systems, corporate network and the Internet.<\/li>\n
  2. Their software at their hotels were misconfigured, resulting in unencrypted cardholder data.<\/li>\n
  3. They failed to check that their hotels implemented information security policies and procedures before connecting local computer networks to the corporate network.<\/li>\n
  4. They even failed to resolve known security vulnerabilities on their servers. For example, some of their servers used outdated systems without the ability to receive security updates or patches to resolve security vulnerabilities. Connected to their corporate network, these servers were a serious point of weakness and potential entry point for hackers.<\/li>\n
  5. They left default user IDs\/passwords on servers that were connected to their corporate network, which were easily found when searched online and allowed hackers access to their network.They also didn\u2019t use complex or hard-to-guess passwords – for example, remote access to their property management system was achieved by using \u201cmicros\u201d for both the user ID\/password (Micros Systems, Inc. developed their system).<\/li>\n
  6. They didn\u2019t employ any security measures to detect and prevent unauthorized access to the corporate network (anything from an IDS (Intrusion Detection System) to a WAF (Web Application Firewall<\/a>) or even daily logging and log review may have helped detect and prevent access).<\/li>\n
  7. They also didn\u2019t follow proper incident response procedures after their data breaches – including the failure to monitor their corporate network for malware that compromised their system in a previous incident.<\/li>\n
  8. Finally, they even failed to limit third-party vendor access to the corporate network and property management systems by restricting specific IP addresses or granting temporary\/limited access.<\/li>\n<\/ol>\n

    The actual case is a very interesting read (if you\u2019re into reading lawsuits), as it details how the hackers got into the system in each incident. I listed all of their weak points as a way to educate you on how to avoid a data breach, and create a stronger case for partnering with a PCI hosting<\/a> provider.<\/p>\n

    A PCI hosting provider knows certain things – like that the encryption of cardholder data, daily log review<\/a> and WAF<\/a>s are required to appropriately secure credit card information – plus, they know how to deploy this technology for you or refer you to a trusted partner. A managed hosting provider also knows that server operating systems need patch management and updates in order to keep up with the latest security vulnerabilities. And a PCI hosting provider knows they should not have access to any credit cardholder data stored on your servers.<\/p>\n

    \"PCI<\/a>To find out more about what a PCI compliant data center and hosting provider should entail, read our PCI Compliant Data Center white paper<\/a><\/strong>. This white paper explores the impact of the PCI DSS standard on data centers and server infrastructure, describes the architecture of a PCI compliant data center both technically and contractually, and outlines the benefits and risks of data center outsourcing, and vendor selection criteria.<\/p>\n

    Or use additional PCI resources below to learn about the standards, if you need\/how to achieve compliance, and more:<\/p>\n

    What is PCI Compliance?<\/a>
    \n    PCI Compliant Case Studies<\/a>
    \n    Levels of PCI Compliance<\/a>
    \n    PCI Compliant Hosting Guide<\/a>
    \n    Who Needs to Be PCI Compliant?<\/a>
    \n    PCI Glossary of Terms<\/a><\/p>\n

    References:
    \n    FTC v. Wyndham Worldwide and Subsidiaries<\/a> (PDF)
    \n<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

    PCI DSS Compliance (Payment Card Industry Data Security Standards)\u00a0– those in the e-commerce, financial and retail industry know this means a lot of money, time and manpower. Many try to skirt around the issue and avoid investing in a PCI hosting partner that has been independently PCI audited and go for the cheaper guy. Why don\u2019t you want to do that? Because you don\u2019t want to suffer a data breach and the costly legislation, fees and reputation management that results. And because the cheaper guy doesn\u2019t even know what PCI compliance is, nor what technical or physical security requirements should be in place on his end to help you achieve compliance. A few weeks ago, the FTC filed suit against Wyndham Worldwide, a major hotel chain including three subsidiaries, for the 600,000 credit cardholder data that was stolen in less than two years and in three different incidences. This resulted in more than $10.6 million in fraud loss, according to the FTC\u2019s lawsuit. Not sure why it took two more subsequent data breaches than necessary to elicit a lawsuit, but three certainly calls for serious action. [In the HIPAA compliance world of healthcare, subsequent data breaches would show a lack…<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"other_category":[],"class_list":["post-1971","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"acf":[],"yoast_head":"\nWhy Invest in PCI Hosting? | OTAVA<\/title>\n<meta name=\"description\" content=\"Many try to avoid investing in a PCI hosting partner that has been independently PCI audited and go for the cheaper guy. Why don\u2019t you want to do that?\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Why Invest in PCI Hosting?\" \/>\n<meta property=\"og:description\" content=\"Many try to avoid investing in a PCI hosting partner that has been independently PCI audited and go for the cheaper guy. Why don\u2019t you want to do that?\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/\" \/>\n<meta property=\"og:site_name\" content=\"OTAVA\" \/>\n<meta property=\"article:published_time\" content=\"2012-07-09T00:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.otava.com\/wp-content\/uploads\/2019\/04\/download-pci-white-paper-graphic.png\" \/>\n<meta name=\"author\" content=\"Irma Brillantes\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Irma Brillantes\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/\"},\"author\":{\"name\":\"Irma Brillantes\",\"@id\":\"https:\/\/www.otava.com\/#\/schema\/person\/35774075f8f4fcdd4eae80cb72034263\"},\"headline\":\"Why Invest in PCI Hosting?\",\"datePublished\":\"2012-07-09T00:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/\"},\"wordCount\":920,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.otava.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.otava.com\/wp-content\/uploads\/2019\/04\/download-pci-white-paper-graphic.png\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/\",\"url\":\"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/\",\"name\":\"Why Invest in PCI Hosting? | OTAVA\",\"isPartOf\":{\"@id\":\"https:\/\/www.otava.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.otava.com\/wp-content\/uploads\/2019\/04\/download-pci-white-paper-graphic.png\",\"datePublished\":\"2012-07-09T00:00:00+00:00\",\"description\":\"Many try to avoid investing in a PCI hosting partner that has been independently PCI audited and go for the cheaper guy. Why don\u2019t you want to do that?\",\"breadcrumb\":{\"@id\":\"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/#primaryimage\",\"url\":\"https:\/\/www.otava.com\/wp-content\/uploads\/2019\/04\/download-pci-white-paper-graphic.png\",\"contentUrl\":\"https:\/\/www.otava.com\/wp-content\/uploads\/2019\/04\/download-pci-white-paper-graphic.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.otava.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Why Invest in PCI Hosting?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.otava.com\/#website\",\"url\":\"https:\/\/www.otava.com\/\",\"name\":\"OTAVA\u00ae\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.otava.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.otava.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.otava.com\/#organization\",\"name\":\"OTAVA\u00ae\",\"url\":\"https:\/\/www.otava.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.otava.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.otava.com\/wp-content\/uploads\/2025\/03\/otava-logo.svg\",\"contentUrl\":\"https:\/\/www.otava.com\/wp-content\/uploads\/2025\/03\/otava-logo.svg\",\"caption\":\"OTAVA\u00ae\"},\"image\":{\"@id\":\"https:\/\/www.otava.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.otava.com\/#\/schema\/person\/35774075f8f4fcdd4eae80cb72034263\",\"name\":\"Irma Brillantes\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g\",\"caption\":\"Irma Brillantes\"},\"url\":\"https:\/\/www.otava.com\/blog\/author\/ibrillantesotava-com\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Why Invest in PCI Hosting? | OTAVA","description":"Many try to avoid investing in a PCI hosting partner that has been independently PCI audited and go for the cheaper guy. Why don\u2019t you want to do that?","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/","og_locale":"en_US","og_type":"article","og_title":"Why Invest in PCI Hosting?","og_description":"Many try to avoid investing in a PCI hosting partner that has been independently PCI audited and go for the cheaper guy. Why don\u2019t you want to do that?","og_url":"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/","og_site_name":"OTAVA","article_published_time":"2012-07-09T00:00:00+00:00","og_image":[{"url":"https:\/\/www.otava.com\/wp-content\/uploads\/2019\/04\/download-pci-white-paper-graphic.png","type":"","width":"","height":""}],"author":"Irma Brillantes","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Irma Brillantes","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/#article","isPartOf":{"@id":"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/"},"author":{"name":"Irma Brillantes","@id":"https:\/\/www.otava.com\/#\/schema\/person\/35774075f8f4fcdd4eae80cb72034263"},"headline":"Why Invest in PCI Hosting?","datePublished":"2012-07-09T00:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/"},"wordCount":920,"commentCount":0,"publisher":{"@id":"https:\/\/www.otava.com\/#organization"},"image":{"@id":"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/#primaryimage"},"thumbnailUrl":"https:\/\/www.otava.com\/wp-content\/uploads\/2019\/04\/download-pci-white-paper-graphic.png","inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/","url":"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/","name":"Why Invest in PCI Hosting? | OTAVA","isPartOf":{"@id":"https:\/\/www.otava.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/#primaryimage"},"image":{"@id":"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/#primaryimage"},"thumbnailUrl":"https:\/\/www.otava.com\/wp-content\/uploads\/2019\/04\/download-pci-white-paper-graphic.png","datePublished":"2012-07-09T00:00:00+00:00","description":"Many try to avoid investing in a PCI hosting partner that has been independently PCI audited and go for the cheaper guy. Why don\u2019t you want to do that?","breadcrumb":{"@id":"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/#primaryimage","url":"https:\/\/www.otava.com\/wp-content\/uploads\/2019\/04\/download-pci-white-paper-graphic.png","contentUrl":"https:\/\/www.otava.com\/wp-content\/uploads\/2019\/04\/download-pci-white-paper-graphic.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.otava.com\/blog\/why-invest-in-pci-hosting\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.otava.com\/"},{"@type":"ListItem","position":2,"name":"Why Invest in PCI Hosting?"}]},{"@type":"WebSite","@id":"https:\/\/www.otava.com\/#website","url":"https:\/\/www.otava.com\/","name":"OTAVA\u00ae","description":"","publisher":{"@id":"https:\/\/www.otava.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.otava.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.otava.com\/#organization","name":"OTAVA\u00ae","url":"https:\/\/www.otava.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.otava.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.otava.com\/wp-content\/uploads\/2025\/03\/otava-logo.svg","contentUrl":"https:\/\/www.otava.com\/wp-content\/uploads\/2025\/03\/otava-logo.svg","caption":"OTAVA\u00ae"},"image":{"@id":"https:\/\/www.otava.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.otava.com\/#\/schema\/person\/35774075f8f4fcdd4eae80cb72034263","name":"Irma Brillantes","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g","caption":"Irma Brillantes"},"url":"https:\/\/www.otava.com\/blog\/author\/ibrillantesotava-com\/"}]}},"_links":{"self":[{"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/posts\/1971","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/comments?post=1971"}],"version-history":[{"count":0,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/posts\/1971\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/media?parent=1971"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/categories?post=1971"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/tags?post=1971"},{"taxonomy":"other_category","embeddable":true,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/other_category?post=1971"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}