Dear Valued Client,
Milestones Accomplished During 2012
Below are a few of the significant milestones completed this year as we continually strive to be the most reliable and affordable web hosting provider in South Africa:
All DigiServ cPanel servers upgraded: During October 2012 we performed one of our biggest upgrades in infrastructure on our local South African network as well as in Germany. All our cPanel hosting servers were migrated over to new hardware and RAID10 storage offering a significant improvement in reliability and performance.
DNS Infrastructure moved over to Mweb: Part of our infrastructure upgrades during October was to implement redundancy on our local SA DNS servers that serve all our cPanel hosting servers. We moved our DNS servers over to the Mweb network to offer our existing and potential customers the highest availability and reliability on DNS hosting. Our DNS Cluster is now being synchronized between South Africa and Germany, meaning that if at any given time one DNS server should fail the next one will take over to ensure that your DNS is always online and available.
Improvements in Security: During the past month (November) we performed an extensive security audit on all our cPanel hosting servers. A number of vulnerability points were addressed while our primary focus is to keep customers confidential data secure, preventing eavesdroppers from obtaining access to this information. Further down in this newsletter we will discuss some of these changes and how it impacts you as a customer.
DigiServ is now an Accredited CO.ZA Registrar: On the 24th of August DigiServ became an official CO.ZA Accredited Registrar. Having scaled the technical and financial requirements for gaining this status, DigiServ is poised to offer the best value to its existing customers and potential customers, under the new EPP domain system that has been implemented by the CO.ZA registry.
New cPanel hosting packages launched: Earlier this year (July 2012) we introduced new cPanel hosting packages for both our standard shared customers and resellers. Through valuable feedback from customers we were able to significantly restructure our new offering of hosting packages bringing you even more value for money. As always our focus is to provide you with an amazing web hosting service that you can rely on and won't hurt your wallet.
Guides to Password Security
During recent months it has come to our attention that a fairly small number of customers are still unaware of the dangers a weak password could have until it is too late and they've lost their emails or website due to malicious activity on their hosting accounts.
As a responsible provider in this industry we feel we play an important role in educating people not just in the basic knowledge of website hosting but also staying safe on-line. Passwords are the first line of defence against password crackers and hackers and its often the most neglected. It is also currently the most targeted vulnerability in the hosting industry.
Below we've provided two valuable guidelines to using strong passwords.
The guide to password security (and why you should care):
Password Tips to Keep Your Company Secure:
How to protect yourself against Malware
Malware, short for malicious (or malevolent) software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to private computer systems. Malware infections are currently on the increase.
You as a website owner can protect your website visitors against such infections as well as your own computer.
The following is a good guideline in how to protect your computer against Malware infections:
Hacked, and you don't know it
Earlier this year we posted a link (to MyBroadband.co.za) on our Announcement section of our website referring to websites being hacked and the website owner not knowing about it. During recent months this type of activity is under an alarming increase in the hosting industry and it affects everyone with a website.
Customers who have not yet read this specific article are welcome to follow the link below:
Recent Security Improvements
November saw us perform an extensive security audit on all our cPanel hosting servers. After receiving numerous complaints and nearly losing our contracts from our respective data centre providers in South Africa and Germany we had to take a hard look at enhancing security on our entire network. We had to address each of these concerns with the utmost importance and urgency to keep our contracts with our providers.
After being in business for over 11 years now, we were not prepared to close our doors and did everything in our power to ensure that we were fully compliant with our data centre providers policies. Many of us here at DigiServ worked extremely long hours every day to prevent our servers from being shut off.
The main areas of concern we had to address were: - Hosting of Malware and Phishing websites on hosting accounts
- Hosting accounts that were used to host malicious scripts for hacking purposes on remote networks
- Email accounts being used to send SPAM messages
In many, if not all of these cases our customers were unaware of such activities on their hosting accounts and our data centre providers required immediate termination of these accounts. As DigiServ have a strict 3-strike policy we were not prepared to terminate these accounts from our network, especially if the customer did not know about these activities. None the less we had to re-assure our providers that we would address these security concerns and implement ways to prevent such activities from occurring on our network.
We immediately started enhancing our security and looking at areas that were the most vulnerable. Our FTP service was the most targeted by hackers and needed the most urgent enhancement. Secondly we had to address issues relating to weak passwords on all our cPanel accounts and improve our current password security policy even more to prevent the issuing of weak passwords and prevent password crackers from brute forcing passwords.
- FTP clear text sessions (Plain FTP) have now been disabled on all cPanel servers. We only permit FTP over SSL/TLS (FTPS) with Explicit Encryption Enabled. FTPS is also known as FTP-ES, FTP-SSL and FTP Secure.
- Our Password Strength requirement has been increased from 80 to 90.
We also implemented encryption mechanisms on majority of our services to ensure that customers login details and data remained safe against eavesdroppers.
- All cPanel, WHM and Webmail URLs are redirected to a Secure SSL URL issued by RapidSSL. When accessing either cPanel or Webmail please ensure you are using any of the following URL formats:
* Replace yourdomain.co.za with your actual dmain name. Using any other URL format will bring up a security warning in your browser.
- SMTP on port 26 now supports STARTTLS/TLS
- POP3 on port 995 now supports SSL
- IMAP on port 993 now supports SSL
All security certificates should show that it has been issued by RapidSSL and show the hostname in the following format: .dns-guards.com
Customers wanting to encrypt login details and data through the respective secure ports are now welcome to update the port and encryption settings in their email account properties in their respective email programs. Should you require assistance in changing these details please submit a support ticket through your client area and we'll gladly provide you with step-by-step instructions.
We installed additional security scanners to ensure every area is covered and that every single line of code in your website is scanned for vulnerabilities, exploits and Malware. We now perform not just real-time scanning of all website files but schedule nightly scans to ensure that exploits and Malware are quarantined automatically when discovered.
During our month long investigation we also had to look at other areas of concern relating to outdated and insecure web applications being hosted on our network. Wordpress website owners had it tough the past couple of months where outdated Wordpress web applications were being heavily targeted by hackers. These type of websites had the most Malware infections which resulted in Google Chrome and Firefox browsers generating warnings preventing internet users from accessing these websites. In many of these cases we found code injected into web pages retrieving malicious code (Malware) from a remote network to the internet users browser and infecting his/her computer.
We now also perform real time scans for common vulnerabilities in Wordpress websites and block these type of scripts from being executed. This allows Wordpress website owners to bring their installations up to date with the most recent versions released by the developers, while preventing the website from being abused by hackers.
Lastly we had to deal with our mail servers getting blacklisted constantly due to email accounts being hacked and then used to send out SPAM messages. We found in a lot of these cases the email user was unaware of these type of activities but also unaware of the importance of using strong passwords on email accounts. These weak passwords would be brute forced by password crackers resulting in SPAM messages being sent out. As our mail servers would be blacklisted it not only affected us as a hosting service provider but more importantly our customers and their businesses as they were completely unable to respond to their customers urgent emails.
While we found these concerns to be in the minority of our network it had the greatest impact to all customers due to extended issues with our servers being blacklisted. When we urge customers to use stronger passwords it is not only for their own benefit but for everyone else sharing the same server. As customers should consider that they share the server with other customers everyone must take caution against the use of weak passwords as it will impact other customers businesses too.
After all these recent security enhancements we can only do so much to protect each customer against malicious activities. The end responsibility still comes down to the customer ensuring that they are doing everything in their power to not only educating themselves regarding on-line safety but ensuring that they follow guidelines in securing their hosting accounts, email accounts and computers.
We would like to assure each and every customer that we remain committed and work hard in protecting your data on our servers so that confidential information is never compromised as well as your account not being abused by third parties. The very last thing we want is for anyone to gain access to this information on your hosting account. While we continuously work in enhancing security on our network we ask one small favour and that is for customers to work together with us to ensure that we are never put in a situation where any particular server will be terminated by our data centre providers.
Support over December
DigiServ would like to remind customers that technical support will be available as per usual over the festive season and limited to email support over the public holidays. Our Billing & Sales Departments will also be open for business during December, except for the following public holidays:
16/12/2012 - Closed
25/12/2012 - Closed
26/12/2012 - Closed
01/01/2013 - Closed
Manage E-mail Subscriptions
We recently introduced a new feature in the client area system allowing customers to manage email communications. This specific feature can be accessed in the client area under Update your Details -> Manage Subscriptions.
Customers are now able to unsubscribe from different email types namely:
General / Support / Billing / Product / Product Addon / Domain / Affiliates
By unsubscribing from a specific email type you will no longer receive automated and mass emails from us. For instance if you want to receive Network Notices and Product Login details DO NOT unsubscribe from the email type Product. On the other hand if you no longer wish to receive General Newsletters from us, you have the option to unsubscribe from all General email types.
Your Feedback Required
We are conducting a small survey this month for all customers hosted on our cPanel servers. We would like your feedback on whether you are satisfied with the current ASSP Anti-spam system being used.
1. Yes, I am currently satisfied.
2. No, please implement another solution.
3. No, please implement SpamExperts - I am willing to pay a little extra for spam filtering.
We appreciate and value your feedback.
Sunday, December 2, 2012