I'm working on a system that takes the customers credit card information before sending it to the processor. It requires me to ask the customer for cc#, CVV, date, one at a time and send that to my server between each request (https, no cookies, cache, or sessions used). How should I keep track of the data between requests? I thought about Memcache(d) or storing (encrypted) in a database and deleting as soon as the transaction is completed. They don't really seem like the best options. I would appreciate some suggestions if you have some.
It is compliant to keep them in memory during the transaction. It is safer (from a compliance Pov) and easier that storing them temporarily in a database.
PCI DSS 3.0 provides now guidance to protect Sensitive Data in memory while being processed to avoid data leakage in crash dumps.
Best practice is to use a library that encipher volatile memory.
Mark, from PCI Initiative
First up, I strongly recommend you offload your PCI-DSS compliance obligations entirely by moving the responsibility to capture and process payment credentials over to the payment gateway provider. Most payment providers host the payment capture pages for their clients for this reason. This allows you to simply pass price information and invoice details to the payment gateway and then they return if the customer actually paid. Rolling your own payment gateway is about as dangerous as rolling your own crypto - worse actually; as you'll be handling money and various banking liabilities.
However, if for some reason you or your organisation doesn't want to use any of pre-existing payment vendors; you will need to keep the following in mind:
So think very carefully about your business' core goods or services. Then consider if establishing and maintaining direct credit card processing is a key product of your business.
* password cycling, shell sudo restrictions, full support documentation, division roles regardless of company size; the list goes on. The PCI-DSS compliance process can take 6 months or more.
You can check and try OSSEC (Open Source Security) which is a host-based intrusion detection system. Being open source is a plus for security and it helps with PCI.
It is said: