We're currently setting up our existing web service to be PCI-DSS compliant and we're a little stumped on one of the compliance requirements.
In short, we need to ensure a credit card number is never stored anywhere in plain text. Our CC submission forms all work on SSL, we store the information in an encrypted field, everything is compliant except: IIS logs.
Our auditing team have noted that, if you type anything into the search box we provide for other features on the site, the query term is logged into the IIS logs. If a user puts their credit card number into this search box, that number gets logged to IIS in plain text.
Has anyone else dealt with this problem? I've had no look finding a solution online, especially given the other requirement in PCI DSS that we log absolutely everything possible to provide as full an audit trail as possible.