Database security guidelines and tips

Question

I have been recently hired by an event-planning company to create a web application that will allow online payment for specific events and keep a list of registrants. My employers are asking for a documentation of the project's specifications/requirements before I can start coding the application to make sure I fully understand the idea behind this project to minimize the risk of error while working towards the final product.

This is my first time working with Paypal, Caledon and other online payment processors and I realize that I need to have a very secure database, as critical information is to be retained in the servers (i.e. the last four digits of the credit card used for payment).

I know that the following is good practice:

• Keep the database on an independent machine (away from the webserver) and access it only when needed;
• Secure the database behind a firewall;
• Create long and "hard-to-guess" passwords for the root user and the users who will be accessing the database for maintenance/administration.

Aside from that, I do not know what else I could do to secure the database even more. Microsoft SQL 2005/2008 will be used to build the database.

Any tips/suggestions on how I should proceed with this?

Thank you in advance,

-Christopher

Answer 1

The definitive guide for online credit card processing is the Payment Card Industry PCIDSS standard: https://www.pcisecuritystandards.org/security_standards/pci_dss.shtml All of the things on your list (and much, much more) are in that document.

Doing it right is a lot of work, are you sure there isn't a already written app/service that will meet the client's needs?

Answer 2

I'd consider:

• Force encrypted connections to the server http://msdn.microsoft.com/en-us/library/ms191192.aspx

  • Enable auditing: http://msdn.microsoft.com/en-us/library/dd392015%28SQL.100%29.aspx

  • Consider disabling sql logins to the server and only allow Windows Authentication

  • Configure, preserve & review your windows and sql server logs including audit login/out attempts.

  • Make sure your database backup files are encrypted and keep track of where they go.

  • Be sure your server is behind a locked door.

Answer 3

First thin to do is check the local laws applying to where both the business and the server(s) are located. I was surprised to learn that where I am we are not allowed to keep any credit card details on record (on the server, printouts, etc.), not even a partial number.

Not just the root account but all accounts on the server need decent passwords. The root account shouldn't even be accessible remotely. It should only be used locally on the server by logging on as a "normal" user and issuing commands via sudo or su. I also like the idea of making the logon names as hard to guess as the passwords. Not just those accounts used to access the data but any and all accounts that can be logged on remotely, as this will help slow down brute force attacks.

I can't comment on MS SQL as I don't use it but the most important point to bear in mind, especially with anything Internet facing, is the Principle of Least Access. In other words, only grant the absolute minimum access required by any user or function.