Loading...
 

MPC Security FAQs


We leverage vCloud® Networking and Security™ to provide necessary security for your virtualized environment. The integration with VMware vCenter allows the cost effective management of your MPC without the added complexity by using the software package you are familiar with.


PhoenixNAP gives you unrestricted Administrator level access and you can run practically any application or service that you can run from a traditional, physical machine. From that point, you will decide which user will have admin rights and which permissions.


Yes, each and every phoenixNAP Managed Private Cloud is built to meet PCI DSS 3.0 standards. Our internal processes are audited by independent PCI vendor to meet SSAE16 compliance. Since the architecture of our MPC is highly flexible, you can integrate any kind of security software or hardware to conform to all security control or compliance needs.


To be sure that data loss cannot occur, on-demand failover testing is available to check if the backup system is functioning as expected. Furthermore, the failback process is completed seamlessly, without impact to the end-user.


We leverage security tools from F5 Networks, Arbor Networks, Rapid7 / Metasploit, and VMware in order to maintain compliance with PCI DSS 2.0, SSAE 16 Type 1 and SOC 2 Type 2. All of our systems leverage Two-Factor authentication for administrative access and all events are centrally logged and reported in real time. These controls are in place to secure the underlying infrastructure that powers our IaaS systems and are not in place to protect or enhance the logical security of our customers’ infrastructure.


All of our systems are configured in blocking mode rather than alerting mode. However, the availability of the Client Portal and billing systems are the only components that would be unavailable if a false positive was triggered.


Signature update periods vary per vendor but happen at least quarterly.


Clients of MPC are responsible for securing their virtual machines. You need to implement security measures that are commercially reasonable for your use of MPC, including encryption technologies, password and user ID requirements, as well as procedures regarding the application of security patches and updates. If any breach happens on the management side, phoenixNAP will be held responsible.


After you delete a VM your data will be deleted as well. When you perform that action, you will not have a logical or direct access to the drive and thus the data cannot become visible to anyone.


Your MPC is secured by phoenixNAP DDoS Protect™ which takes care of your network traffic and constantly monitors for any attacks. Your services remain online even during attacks while we are working to eliminate them. We have a team of certified engineers, support staff and an automated rule sets to make sure your business stays unaffected.


We offer 20 Gbps of DDoS protection with phoenixNAP DDoS Protect™ for your complete server, not just individual IPs. This includes defense against UDP and TCP attacks, as well as ICMP based attacks.


Here is the list of UDP, TCP and ICMP based attacks that phoenixNAP DDoS Protect™ can block:

UDP Based TCP Based ICMP Based
UDP Flood SYN Flood ICMP Flood
Fragmentation SYN-ACK Flood Fragmentation
DNS Flood ACK & PUSH ACK Flood Ping Flood
VoIP Flood Fragmented ACK Fragmented ACK
Media Data Flood RST or FIN Flood RST or FIN Flood
Non-Spoofed UDP Flood Session Attack Synonymous Flood
etc. etc.