1

I'm a web developer, and don't know much about system administration and security. Would it be possible for me to set up a site that processed credit card payment, payouts, bitcoin payments, or other private activities while using a managed host or outsourcing the security and administration, without sacrificing security?

Of course, I could use APIs, such as Stripe, to process payments, but that doesn't mean someone with access to my server won't go using the secret API key to charge customers and other such misbehavior.

In summary, how do small startups without a security/system administrator on board deal with security/administration, without jeopardizing its users?

Improve this question
10
  • 2
    Not possible. "He who owns the server, owns the application, and therefore, the data".
    – dawud
    Aug 14, 2013 at 18:25
  • How difficult, and how long would it take, to learn system administration and security, so that I can take it into my own hands?
    – timetofly
    Aug 14, 2013 at 18:26
  • Forever. This is why people with more experience tend to make more money. You should never stop learning and there's no such thing as perfect security. You get what you pay for.
    – user143703
    Aug 14, 2013 at 18:33
  • 1
    @user371699 Not to be harsh, but there's a reason there are professional system administrators, and professional developers. Asking your plumber to fix the electrical problems in your kitchen can burn your house down, so you hire an electrician. Trying to be a sysadmin without the practical experience can destroy your environment, so you hire pros. If you really want to learn you will need to hire a sysadmin and work alongside them, and you should be prepared for a long, steep learning curve. I've done both jobs - I can honestly say sysadmin work is harder.
    – voretaq7
    Aug 14, 2013 at 18:48
  • 2
    @user371699 you can spend the time to learn system administration, and I think every developer should know at least a little about what's going on behind their app, but to be any good at it (to the point where you would trust yourself with a production environment) is a pretty major time commitment -- basically it's a career direction change.
    – voretaq7
    Aug 14, 2013 at 20:15

2 Answers 2

Reset to default
6

This is not a technical question, and the answer is not technical either.

I colocate servers in a datacenter which is regularly audited for PCI-DSS and SAS-70 Type II compliance. My agreements with them specify that they will treat my data confidential (the same as theirs).

You need a legal agreement with the datacenter or managed service provider you do business with that they will not swipe your customers' data off your server, and you will need copies of their PCI compliance audits to provide to your own auditors, when they show up.

Improve this answer
7
  • That relates to those who deal with the credit card transactions (not on my server). How about the people who get access to my server, and thus, to the API?
    – timetofly
    Aug 14, 2013 at 18:28
  • Who's going to get access to your server?
    – Michael Hampton
    Aug 14, 2013 at 18:29
  • 1
    As for managing the server itself, if this isn't something you can handle, then you should hire a system administrator or a service provider to do it for you. The same caveat about confidentiality and contracts applies.
    – Michael Hampton
    Aug 14, 2013 at 18:45
  • 1
    @user371699 If you would like to outsource your system administration (which is usually a good starting point if you don't have the skillset and don't have the budget to hire someone) the magic Google phrase to help you out is Managed Services -- they're pricey, but most are pretty good (and as in the answer above, they're usually audited against a number of relevant standards which makes life easier for you). And yes - this does require your having a pretty high level of trust in the provider (and a good contract).
    – voretaq7
    Aug 14, 2013 at 18:50
  • 1
    It's not much different from trusting the systems administrators that you hire as employees. You have to trust somebody, but you certainly don't do it blindly.
    – mfinni
    Aug 14, 2013 at 19:34
0

Everything depends on your agreement, certification and audits they will pass, their policies, specialists, recommendations, server software maintenance, environment etc. Security is a huge thing - you need a manpower to check the provider.

P.S.

PCI-DSS Has nothing to do with this! THEY WONT EVER CHECK YOUR SERVER, it's out of their mission

According to VISA/MC/AMEX requirements, credit card data (so-called sensitive information) is not allowed to be processed through website until it will reach significant number of transactions (hundreds of 1000s), so credit card numbers are not sent to your server, clients are redirected to the payment site of processing center and you are getting confirmation for payment, that's all (if you are running site like this - you already know that). So, PCI-DSS won't affect you until you will reach that number. I was employed by one of processing centers and I was working on secure payments for websites (3-D Secure etc), successfully passed PCI-DSS. PCI cares about sensitive data only, and NOTHING else.

When your website will reach that number, I believe you'll have your own DC and security team with admins :)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .