Beefy Boxes and Bandwidth Generously Provided by pair Networks
XP is just a number

Comment on

( #3333=superdoc: print w/replies, xml ) Need Help??
The thing to do is to look at the ways in which a hacker might attack the system in order to get the credit card details and assess the risk.

The customer uses an SSL enabled browser to access your application. We have to assume that this is secure as the communications are going to get. If SSL is compromised then everything is in the open. The browser may similarly be compromised. If this is the case then all of the customer's transactions are compromised.

The application stores the encrypted credit card number in a database such that it is written to disk. The encryption needs a key which also has to be stored. The encrypted records are written to disk which means that they could be recovered even if they have been deleted from the database. Storing the credit card information to non-volatile storage is a security headache.

The application is hosted on a third party computer that may also host other peoples code. You cannot assume that the system is secure at all. It is subject to both physical and remote access from other people. This issue is best tackled with expensive SLAs, contracts and indemnity clauses.

If I was doing this I would avoid the problem all together and leave out screen four. The customer supplies their credit card details once and the application sends it for processing. If you do this then you don't need to store their credit card info to a database at all.

In reply to Re: Storing credit card numbers temporarily (OT) by inman
in thread Storing credit card numbers temporarily (OT) by bradcathey

Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post; it's "PerlMonks-approved HTML":

  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.
  • Log In?

    What's my password?
    Create A New User
    and all is quiet...

    How do I use this? | Other CB clients
    Other Users?
    Others lurking in the Monastery: (3)
    As of 2018-05-24 05:05 GMT
    Find Nodes?
      Voting Booth?