I have been recently hired by an event-planning company to create a web application that will allow online payment for specific events and keep a list of registrants. My employers are asking for a documentation of the project's specifications/requirements before I can start coding the application to make sure I fully understand the idea behind this project to minimize the risk of error while working towards the final product.
This is my first time working with
Caledon and other online payment processors and I realize that I need to have a very secure database, as critical information is to be retained in the servers (i.e. the last four digits of the credit card used for payment).
I know that the following is good practice:
- Keep the database on an independent machine (away from the webserver) and access it only when needed;
- Secure the database behind a firewall;
- Create long and "hard-to-guess" passwords for the root user and the users who will be accessing the database for maintenance/administration.
Aside from that, I do not know what else I could do to secure the database even more. Microsoft SQL 2005/2008 will be used to build the database.
Any tips/suggestions on how I should proceed with this?
Thank you in advance,