Re: Credit Cards & MySQL

You need to encrypt the credit card numbers, I'd suggest using public key encryption that way even if the machine is breached the credit card numbers are not exposed. Storing credit card numbers is not a good idea unless you have really deep pockets. Not only do you need to secure the OS from Internet attackers if the machine is colocated you also need to physically secure the machine (it is trivial to access information off any computer once you have physical access). If you are operating in any type of shared environment forget storing numbers, use your credit card processsing companies services, if you need reoccuring billing find a processer that lets you store peoples credit card numbers on their systems, then they take the fall if security is compromised. Jason David Otton wrote:

On Fri, 16 May 2003 17:45:46 -0400, you wrote:

While I agree with the 'ideal' situation from David, often that is not possible.

I certainly agree that my solution was idealized - I was trying to stress the logical split between processes. If you prefer, substitute "account", "script", etc. for "machine" in my post. In the real world, I personally would use two machines and a hardware firewall.

If you have to store credit cards, you need to ensure first of all the the MYSQL server is NOT accessible from anywhere except the localhost that you will be calling it from. That minimizes one possible security leak.

But I have to say, I do think that holding valuable data (eg CC numbers) on a DMZ'd machine is foolhardy. Yes, the risk is small, but if the cost of reducing it is just a few hundred dollars in hardware...

The second thing to do would be to encrypt the credit card using the mcrypt functions and a key that is stored on the server, but is only accessible OUTSIDE the web directory. This way in order for someone to get the credit cards, a hacker has to: A. Get access to the machine - not tough B. Read your scripts to know the encryption method C. Gain Access to the mysql server D. Reproduce the decryption with your key

Um... if they've completed A, surely they can just lift the file with the key in it, and the database, and walk away? Or are you assuming limited access, rather than root? Or am I missing something obvious? Security isn't my speciality.