SSL is absolutely the correct first suggestion here, but SSL alone doesn't protect you from:
Direct attacks such as XSS, SQL injection, remote file inclusion
Out-of-band attacks such as key loggers and viruses, both on the client systems and the server.
If you happen to be running an unrelated vulnerable service on your system, such as an out-of-date mail server, an attacker could target that and gain a shell account on your system. A virus on your work desktop could steal your credentials the next time you log in to your server. A keylogger on the client's system could steal their credentials, and while this one is technically not your fault, the client will certainly blame you anyway and you may have a hard time proving that it wasn't stolen from you.
Newly developed attacks against SSL such as BEAST, CRIME and Lucky Thirteen.
It is inevitable that there will be a period of time where you are vulnerable to these sorts of attacks. Your job when securing your client's data is to:
- Keep on top of known new attacks that affect any product you use.
- Assess each one as soon as possible and make a decision whether to continue running the affected service or to shut it down until a patch is available. (You may be able to delegate this decision to your clients.)
- Update and/or patch as soon as possible.
It sounds like you are a lone sysadmin who cares about security, rather than an employee dedicated solely to security, which means all the above is probably quite daunting. A good way to approach this would be to rank each of the suggestions you receive in terms of value and try to implement one each month or so. Set a realistic time frame and try to stick to it.
- Code audit/penetration testing of the code your organisation wrote.
- Intrusion detection.
- Abnormal client behaviour detection (Unknown IP address, unknown User-Agent, etc).
- Regular and prompt OS and product updates.
- Minimise attack surface (remove unneeded services from your server).
- Encryption of the data when it's stored in your database and in any backups.
- Logging of any type of access to the data. Good database software and appropriate OS controls can enforce this. This can help absolve the blame if a breach wasn't your fault and track down who the culprit is and how they got in if it was your fault.
- Pervasive security throughout your organisation.
The PCI-DSS contains a good list of things that can improve your overall resistance to attacks.
Which of these you actually implement will depend on cost/benefit and risk analysis:
- How much is the data (or the client) worth?
- What is the likelihood of a breach?
- How much does the security measure cost?
- How much does it reduce the likelihood of a breach?