信用卡信息，必须采取哪些安全措施？

Question

We don't store any credit card information. It is gathered via an HTML form, then processed by a PHP script which uses the API from Intuit to charge the credit card. After calling the API to charge the card, all credit card information is disposed of.

Here are my questions regarding the security of the credit card information:

• I assume SSL is a must. Is this correct?
• Should I switch from shared hosting to a dedicated server?
• I assume there is no encryption that isn't easily un-reversible that can take place between the HTML form and the PHP script, does any encryption need to be used for what I'm trying to do?

If there is anything else you can think please share it. Thanks for your time everyone.

Answer 1

I assume SSL is a must. Is this correct?

Yes, correct.

Should I switch from shared hosting to a dedicated server?

A VPS at minimum is a very good idea. You can probably not be PCI compliant successfully on a shared host, you just don't have enough control to lock your server down as required by PCI.

I assume there is no encryption that isn't easily un-reversible that can take place between the HTML form and the PHP script, does any encryption need to be used for what I'm trying to do?

Your API should take care of that. Be sure the API is over an SSL/Secure connection as well.

Please read up on PCI requirements. You are transmitting cardholder data so you DO NEED TO BE PCI COMPLIANT. You will be at the "lowest level" of compliance (I think it's C or D). You will need to run quarterly scans on your server IP to prove compliance as well. As an FYI, I use McAffee Secure for this.

The only way you won't be subject to PCI rules is if the cardholder's data is entered on somebody else's server (think: paypal). Whenever you pay by paypal, you are transferred to PayPal's server, then transferred back. In that scheme, you would not need to be compliant.

Now a lot of the PCI requirements talk about some stuff that don't apply in the questionaire (ie is your server stored in a safe place, how physically secure is your building, etc....) - the good news is that your server/hosting company should handle that.

After your network scan, it'll come up with a list of things that make you non-compliant. They are almost always server related issues. You can either fix them yourself, or ask your host to help you - most hosts will do it if you send them the list. You will NOT be able to fix a lot of them on shared hosting.

Answer 2

Your points addressed in order

• Yes, even when connecting to the API, which should be the only option
• Its a good idea, less security exposure. You will have lower probability that a compromised tenant will compromise your site.
• As long as you are not storing or caching the data in any form and using SSL for transit, you wont have to implement encryption on your application.

PCI requirements may be applicable.

Answer 3

1) I would serve the entire page through HTTPS to avoid users from getting the alarming message of "some resources are not protected"

2) Depends on the integration, if Intuit has provided you with an iframe or form action to use, then sensitive data never reaches your server. user either type and/or submit it directly to intuit with your page merely as a container.

If the above is true:

3) You don't have to pass PCI compliance. Intuit already did. Sensitive data never reaches your server, thus there's nothing to dispose.

4) Shared or dedicated host doesn't really matter since you are not transiting or storing any sensitive information.

Answer 4

1. SSL: Yes, of course. Between your server and the client, as well as between you and the API.

2. Dedicated Hosting: Ideally, yes. There are two problems with using shared hosting:

   1. Anything stored in a session can potentially be retrieved by others on the server.
   2. A security breach in a site that is not even yours could lead to a breach in yours.

   
   These are primarily the domain of your host's security policies, and are not easily identified by PCI scans.