August 6, 200818 yr I am Looking for advice on how to store credit card details securely. I am about to develop a new website (details being finalized). The project consists of a website that requires a users credit card details to be stored to a database. Unfortunately there is no way around this (I tried to advise against storing the details - but this is a mandatory part of the business). The site requires mysql and php. So far I have the following: - use an ssl-ev certificate on the webserver (xampp) - store the mysql database on another server (also xampp) and restrict permissions depending on the action taking place. - use 256bit php encryption, and hashing for passing variables and clean mysql data (mysql_real_escape_string) before submitting it to the database. Does anyone have any other/more ideas on how to ensure security on the above - or perhaps a different process? Have I missed anything? (The site is a public site and the owners want to stay away fro the username password route for clients).
August 6, 200818 yr I know very little in this area but isn't xampp just for development? And in regards to storing credit card details (and what's all this about no login/password) I would stay WELL clear. If something goes wrong that's one hell of a responsibility on your shoulders. Just because the customer wants, doesnt mean they get.
August 6, 200818 yr I would always advise staying away from storing credit card details, but I understand that some sites must do this. A few security tips (I am assuming that you own and manage the server, so if you don't, ignore this!) Use a separate machine to act as your server rather than using a computer that has other uses. If you do this, I would recommend not using XAMPP, but using a full server disto, such as RHEL, centOS or similar. Running programs other than the server applications on it increases the risk of getting a virus or getting hacked. Install a good firewall onto your server. Talk to a security expert about the risks and how to combat them. I hope some of this is helpful. Also, what is the purpose of your site? That could help us think about how to secure it best.
August 6, 200818 yr I can't remember what the thing is, but to store credit card details you need to follow some very very strict guidelines. If possible I would suggest you try to do your site without storing credit card data.
August 6, 200818 yr There are so many problems with storing credit card numbers yourself, you need to follow some very tight guidelines and I am sure that you need to sign up to something (don't ask me what the name is). Plus these numbers need to have a high level of encryption on them. The reason for this is because if someone manages to hack your site and you have no or really bad encryption you will be in a lot of trouble for not safe guarding this information. Also needed will be a lot of security into this system. This will cost a lot of money to do, and as you don't seem very sure of yourself I would advice two things: Do not do this yourself, as if anything goes wrong you will be accountable for a lot...so get as much information as you can from people who can do it. If this is for an online store of some sort or something just for paying for a service, the best way to do such a thing would be to use a third party that is already secure and is able to provide you with such a service. This is the safest method of doing it, as you will still get what you need only you will not be as accountable or responsible should something happen when this information is lost.
August 7, 200818 yr Author The system is for a company that claims back credit card charges. Users enter personal information and add credit card details so that the company can claim back the credit card charges. Therefore they need to store the details but users never need to access the system again (hence no login information). I was thinking of only giving the website 'write' permissions. The data can then be accessed internally only - by staff (who Will have to login to access the data). I've read that amazon use a seperate server connected via a serial port because it is easy to analyse the data being passed through and check why it is being accessed. Anyone know how you would check the information being passed through the serial port? I believe the servers will be behind a sonicwall hardware firewall.
August 7, 200818 yr Author I should also add that there are no actual transactions taking place. All transactions are delt with offline. The system just needs to be secure to hold the personal and credit card data.
August 7, 200818 yr In that case you should be able to heavily encrypt the details then send them to another server which doesn't have public access. Then only internal members of staff will know the decryption password. But I don't know what level of encryption you need. PGP might be enough, not sure though.
August 7, 200818 yr Author But I don't know what level of encryption you need. PGP might be enough, not sure though. PGP? Do you mean PHP?
August 7, 200818 yr PGP? Do you mean PHP? No, I meant PGP. It stands for Pretty Good Privacy. I use it at work for storing Passport data temporarily. We don't store credit card information though. It is sent off to the payment gateway and discarded. Assuming that PGP is enough, you could save the PGP information to a database on another server with no direct online access then that database could be accessed by the staff and then the details could be decrypted.
August 18, 200818 yr It would depend on what information you wanted to store on the card as you will need to be PCI Compliant which means you cannot store the 3-digit card number from the rear of the card.
August 19, 200818 yr It would depend on what information you wanted to store on the card as you will need to be PCI Compliant which means you cannot store the 3-digit card number from the rear of the card. PCI compliant? EDIT: never mind, I've looked it up. For any others who are interested: http://www.pcicomplianceguide.org/, http://en.wikipedia.org/wiki/PCI_DSS
August 19, 200818 yr This document on PCI Audit Procedures is worth a read. It would be worth talking to your clients Bank to see what kind of security requirements they have.
August 22, 200818 yr If you are storing card details you need to be PCI/DSS compliant. Key parts. Regular Scans firewall Web server firewall Database server Card nos must be encrypted on database server If you are dealing with any volume of card data you will need an external security company to audit your code, design, security procedures and confirm you are compliant. Amazon do not do real time card lookups, so their is probably not a configuration that you want to copy. See https://www.pcisecuritystandards.org/ for the standards.
May 14, 200917 yr Thanks Boris fo rthe keys and the link. That's exactly what I'm searching for. Regards, simulation credit auto
May 19, 200917 yr Thank u so much, Boris. that's the link I need. Thanks again. simulation rachat credit
June 27, 200917 yr Thanks for giving us tips on how to store securely the credit card details. Fantastic. Simulation pret
Create an account or sign in to comment