Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm starting a project in which certain users will be giving their credit card numbers for online payments. I know how to deal with the web-application side of things, however I would like to get advice about what should be the IT considerations of maintaining such servers.

For starters, I guess I would rather keep the servers in-house and not use any cloud solution. But what in addition? What are the recommendations for firewalls or equivalent? Other systems to install? Other best practices?

Many thanks.

share|improve this question
add comment

4 Answers

up vote 7 down vote accepted

There are regulations around this, namely PCI-DSS, that you need to be aware of. It talks about minimum requirements for network protection, encryption across the transaction line (SSL, database, etc.). Also security measures, such as firewalls, IDS, patching schedules, etc. are outlined.

I think a better solution would be to use a hosted solution from a payment processor. That way your exposure is much more limited, as the company dealing with the payments will store any sensitive data, and you can lessen your exposure (a generic transaction ID is less valuable than a credit card number).

If the project does not require storing the sensitive payment information, then I would look at a hosted solution. It'll probably pay off better in the long run.

share|improve this answer
    
Agreed on the hosted solution. We use PayPal's Payflow Pro service, and it's been great thus far. The user never sees any difference, as you keep the forms and processing on your site and send off cURL requests to PayFlow on the backend. –  ceejayoz May 27 '09 at 12:51
add comment

Use SSL to encrypt the entire pipeline. Unless ABSOLUTELY NECESSARY, Do NOT store credit card numbers in your database. You should use a payment gateway, such as Authorize.net to process the transactions. Each transaction will receive a transaction ID and that should be logged in your database because it is not a high-value or confidential piece of information.

One thing to be careful of is error-logging. I use ELMAH for error logging, and discovered that if someone hits an error on the page where they're entering in their card information, that card information gets logged as part of the HTTP POST values.

share|improve this answer
add comment

The standard way of handling credit card transaction is to authorize it through your bank or credit card authorization center. In a standard way you don't get CC's data (thus you don't need to worry about it's security), you only get the unique authorization token.

CC sale schema

share|improve this answer
add comment

Although this is not practical hands on advice, you should be aware of PCI compliance.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.