Client is not storing Credit Cards Securily (near plain text). How do I convince client to be more secure?

Question

I am writing in regards to PCI-DSS compliance for taking credit cards. A client of mine is not willing / does not want to bump up security beyond what is currently done for their credit card data. All data is currently being stored on a server's MySQL database until it is run through the merchant system manually. Currently, only the credit card number is being encrypted, and only that is using using basic MySQL ENCODE() with an short string as the key. The rest of the information is plain text.

Personally, I am not comfortable with this low level security and they are pushing back for bumping up the security. What should I do / what can I do to explain, encourage, or force PCI DSS compliance or at least a higher level of security?

We are using PHP 5.2 and MySQL (sorry, forget the version number)

If nothing else, is there a way to encrypt it with PHP or MySQL that will be more secure but minimize the work for the client to be more secure.

Answer 1

You tell them what you know, and then you let them make the decision they want to make. Unless you've been hired to do their PCI audit, this probably isn't your fight. Put together a report explaining the relavant threats and potential issues so that both you and they have it in writing, and then you're done. Specifically, you may want to let them know what sort of attacks they're properly defending against, and what sort of attacks they are not properly defending against as well as what the ramifications may be.

In the end, though, your role is as a consultant, not any sort of enforcement capacity. If you push any further than just giving them advice, you put yourself at significant risk with really zero reward.

Answer 2

I would recommend notifying them of the PCI-DSS requirements for storing credit card information from the Major Credit Card issuers, especially the fines and lawsuit potential that they face for low security of especially if this is a USA or UK based business.

Also to stay in accordance with their state Consumer Protection laws, they will more then likely have to follow the requirements to notify:

• All residents that there was a security breach.
• Email all user's about the breach and post a message on the site if the user base is extremely large.
• Notification to their state's department of Consumer Protection, Attorney General and Office of Cyber Security & Critical Infrastructure Coordination.
• There may also be other requirements by the FTC depending on the situation.

Answer 3

Push back on them. Show them how easy it is to recover credit card numbers from the database without the key. Remind them that their own clients' money is at risk here, and if they get a bad reputation for lax storage of sensitive data, they may well be out of business before they can repair the damage to their image.

I don't know the specifics of your contract with your clients, but if your pay is not directly tied to getting them into PCI compliance, then I would point out the weakness to whomever is doing the compliance inspection. You simply cannot, in good conscience, try to gloss it over and get the company certified as compliant when you know there is a glaring security hole.

As their external advisor, you will almost certainly be bound by an NDA, and therefore you will not legally be able to inform any third parties of this weakness. But, that would be the next step in pretty much any other case; anonymously post information regarding the weakness on well-known online "zero-day" journals. If everybody knows that there is a problem, and the company knows that everyone knows, they'll be motivated to fix it before someone can exploit it.

Usually, there's a "cooling-off" period; if you were a "white hat" completely unrelated to the company, and found this problem, you could tell them that if they don't fix it in 30 days you'll post it to the zero-day journals. But, if you gave them any anonymous notice it would be too easy to put one and one together and come after you for the NDA violation.