Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm starting a project in which certain users will be giving their credit card numbers for online payments. I know how to deal with the web-application side of things, however I would like to get advice about what should be the IT considerations of maintaining such servers.

For starters, I guess I would rather keep the servers in-house and not use any cloud solution. But what in addition? What are the recommendations for firewalls or equivalent? Other systems to install? Other best practices?

Many thanks.

share|improve this question

closed as too broad by HopelessN00b Dec 5 '14 at 11:45

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 7 down vote accepted

There are regulations around this, namely PCI-DSS, that you need to be aware of. It talks about minimum requirements for network protection, encryption across the transaction line (SSL, database, etc.). Also security measures, such as firewalls, IDS, patching schedules, etc. are outlined.

I think a better solution would be to use a hosted solution from a payment processor. That way your exposure is much more limited, as the company dealing with the payments will store any sensitive data, and you can lessen your exposure (a generic transaction ID is less valuable than a credit card number).

If the project does not require storing the sensitive payment information, then I would look at a hosted solution. It'll probably pay off better in the long run.

share|improve this answer
Agreed on the hosted solution. We use PayPal's Payflow Pro service, and it's been great thus far. The user never sees any difference, as you keep the forms and processing on your site and send off cURL requests to PayFlow on the backend. – ceejayoz May 27 '09 at 12:51

Although this is not practical hands on advice, you should be aware of PCI compliance.

share|improve this answer

The standard way of handling credit card transaction is to authorize it through your bank or credit card authorization center. In a standard way you don't get CC's data (thus you don't need to worry about it's security), you only get the unique authorization token.

CC sale schema

share|improve this answer

Use SSL to encrypt the entire pipeline. Unless ABSOLUTELY NECESSARY, Do NOT store credit card numbers in your database. You should use a payment gateway, such as to process the transactions. Each transaction will receive a transaction ID and that should be logged in your database because it is not a high-value or confidential piece of information.

One thing to be careful of is error-logging. I use ELMAH for error logging, and discovered that if someone hits an error on the page where they're entering in their card information, that card information gets logged as part of the HTTP POST values.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.