RE: FN-FORUM: Storing credit cards

date posted 30th May 2006 08:44

Hello Andy,

Here are a few ideas off the top of my head.

1. Rijndael is the Advanced Encryption Standard (AES) so you'd have to have
a good reason for not using it as your symmetrical encryption algorithm.

2. Storing the key is going to be one of your biggest security problems.

3. Ensure you have locked down your database correctly allowing only the
minimum required access to the database containing the card numbers.

4. Ensure you have registered with the correct authorities for storing card
numbers.

5. Check your liability insurance covers you for this as well.

6. You'll need certificates for https.

7. Don't do it - use a payment gateway, it's cheaper, easier and safer in
the long run.

Hope this helps,
Gary
http://www.garyshort.org/


-----Original Message-----
From: [EMAIL REMOVED] [EMAIL REMOVED] On Behalf Of Andy Creed
Sent: 30 May 2006 09:29
To: FN-FORUM / [EMAIL REMOVED]
Subject: FN-FORUM: Storing credit cards


Hi

I am sure this subject has been covered before but I want to get advice on
storing credit cards in a site database rather than using a payment
processor.

I know this should avoided for obvious reasons. However the client wants to
pursue this line of thinking? So if we can discount the fact it is a bad
idea - what is the best way it can be done.

As symmetrical encryption methods will need to be used what is the best one
to use and what other methods should be employed to ensure (as much as
possible) that data will be kept secure?

BTW - I am not mad just curious

Thanks

Andy

--
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.1.394 / Virus Database: 268.7.4/351 - Release Date: 29/05/2006



--
Freelancers, contractors earn more with Prosperity4
Call 0870 870 4414 or visit www.prosperity4.com
and benefit from Inland Revenue approved expenses today.

To advertise here: http://www.freelancers.net/advertising.html