IT Considerations for Web Application Dealing with Online Payments?

Question

I'm starting a project in which certain users will be giving their credit card numbers for online payments. I know how to deal with the web-application side of things, however I would like to get advice about what should be the IT considerations of maintaining such servers.

For starters, I guess I would rather keep the servers in-house and not use any cloud solution. But what in addition? What are the recommendations for firewalls or equivalent? Other systems to install? Other best practices?

Many thanks.

Answer 1

There are regulations around this, namely PCI-DSS, that you need to be aware of. It talks about minimum requirements for network protection, encryption across the transaction line (SSL, database, etc.). Also security measures, such as firewalls, IDS, patching schedules, etc. are outlined.

I think a better solution would be to use a hosted solution from a payment processor. That way your exposure is much more limited, as the company dealing with the payments will store any sensitive data, and you can lessen your exposure (a generic transaction ID is less valuable than a credit card number).

If the project does not require storing the sensitive payment information, then I would look at a hosted solution. It'll probably pay off better in the long run.

Answer 2

Although this is not practical hands on advice, you should be aware of PCI compliance.

Answer 3

The standard way of handling credit card transaction is to authorize it through your bank or credit card authorization center. In a standard way you don't get CC's data (thus you don't need to worry about it's security), you only get the unique authorization token.

Answer 4

Use SSL to encrypt the entire pipeline. Unless ABSOLUTELY NECESSARY, Do NOT store credit card numbers in your database. You should use a payment gateway, such as Authorize.net to process the transactions. Each transaction will receive a transaction ID and that should be logged in your database because it is not a high-value or confidential piece of information.

One thing to be careful of is error-logging. I use ELMAH for error logging, and discovered that if someone hits an error on the page where they're entering in their card information, that card information gets logged as part of the HTTP POST values.