Payment gateway integration, any security considerations?

Question

I'm interested in understanding what security considerations there are around implementing a payment gateway. I have, so far, thought of:

• having a SSL Cert is a MUST.
• logging actions is critical.
• a database separate from the internet.

Any other recommendations?

As background, my application is selling product to the client via electronic delivery. When the user pay the fee via paypal, I will send the 'code' to them. And they can use the 'code' to redeem the goods, for example, active the software or items from the game.

Answer 1

Never store the credit card details: number, ccv, exp, etc. There is rarely a situation where you need them. Instead just store the response code and reference number from your gateway. Those are sufficient to issue refunds from when necessary.

---

Okay, from your comments you are using PayPal.

Paypal has several different gateways, I'm going to assume it's the PayFlow Pro one.

First, as stated above, do NOT store the credit card information locally. Simply accept it the post from the user and immediately send the data using PayPal's API. Once you get the response, keep the transaction ID and store that.

Under no circumstance should you "log" the credit card information. Logs can be hacked and you don't want that liability.

In the event you are allowing the end user to set them selves up for recurring payments, still DON'T STORE THE CC INFO. The paypal API can handle this and will give you the relevant transaction ID's to keep for future reference.

Next, review the paypal documentation for their best practices.

Finally, don't store the credit card number. Not even part of it. You do NOT need a "remember my payment details" button. Those are a very bad idea and scream "target" to hackers.

Okay, now what should you do? First, read the PCI compliance literature. Second, read OWASP literature. Third, build your site and secure it. Fourth, hire a third party company to do a security audit. Fifth, fix whatever it is they found and have them do another audit. Repeat until your site is considered "secure" by someone other than you. Preferably someone with experience doing audits. It won't be cheap. If it is, then you've hired the wrong company.

Ongoing, keep up with your windows and gateway updates. If paypal sends out a new API, check it out, update your code and deploy.

Every time MS sends an update, apply it. Don't wait, just do it. If something breaks, fix it then. Anymore by the time MS or another vendor issues a patch there is almost always an exploit deployed within a day or two for that patch. Sometimes the exploit was already out there.

Answer 2

Actually, many gateways recommend you not to keep a log - as they do this themselves in environments "considered" to be more secure than yours. Usually you can query any transaction from them for audit purposes. You certainly should never log a card number. This is my experience having worked with SagePay (formerly Protx) and DataCash.

Many providers also require your server to PCI compliant - this certification can usually be provided by companies such as as McAfee Secure.