2

My company is trying to become fully PCI Compliant and we are switching our outdated systems to use Authorize.net CIM among other things. But, currently we're all over the place and until our new database management system gets updated, I don't have a place that I can temporarily store credit cards for payments to a bill.

Currently, when a customer calls up and wants to pay their bill, they fill out a payment form online (which among other things includes their credit card number) that gets securely emailed (lol oxymoron) to us for a temporary period of time (before it is submitted into our database system and then sent to authorize.net to be charged). Or even worse, sometimes it's actually written down on a piece of paper! Not cool... It's just the number though, no CVV2 or anything.

Is there ANY method that allows us to store just a credit card number and an identifier for it (locally or remotely) that is PCI compliant? I can't use CIM for this as these are just loose numbers with no accounts at the time of entry, way way too complicated and our new system will be using it. I need a quicker solution for now. Basically I'd like to be able to say "Store Credit card xxxxxxxxxxxx1234 HERE with ID 5" and then later come back and say "Get me the credit card with ID 5". Just so it's stored encrypted somewhere in a PCI compliant manner.

Improve this question
1
  • Yes, CIM is our final solution, but that will take most likely 2+ months to set that up for us because we are building a giant custom system that uses it. We need some other solution for the time being, do you have any other suggestions besides Authorize.net services (as now that I see it, most likely none of them are that simple)? Thanks
    – TheFrack
    Dec 6, 2012 at 18:35

3 Answers 3

Reset to default
2

I was trying to think of the easiest possible solution for you. What I came up with is just simply writing down all the info you need in a txt doc using Notepad++, then just encrypt the entire contents of the file. When you need to get a number out or add a number just get off your network completely so you are not connected at all, then decrypt the file using whatever password you came up with.

There is a built in plugin module to do this in notepad++. You can find the details here: http://howto.cnet.com/8301-11310_39-57449365-285/how-to-encrypt-selected-text-and-entire-text-files-with-notepad/

Of course this is in NO WAY any kind of long term or perfectly secure solution. But for a quick and dirty way to just store some encrypted data this should do the trick. I am not sure about this meeting PCI though, a QSA might have a hay-day with this one lol

Improve this answer
1
  • Haha, I like your creativity. Yeah we're going to have to do something like that unless I can find a company that can just temporarily store random data with an ID. Thanks!
    – TheFrack
    Dec 6, 2012 at 21:10
1

Authorize.net provides a feature that lets you have the payment processed on their server and they supply what is basically a receipt token. This might be your best bet until you can get your system PCI compliant for handling the CC number yourself. Depending no the volume of transactions you do, it might even be preferable to having to deal with PCI compliance issues. I unfortunately don't remember the exact name of the feature on Authorize.Net for it, but it is described as the one where you redirect to their page and it makes a callback to you after payment is processed.

Improve this answer
1

It will depend on whether or not you want to store this information yourself, and which implementation you are using.

If you are using their SIM (Server Integration Method), which is recommended in situations where you want to store card information to ease PCI compliance, then you are able to use their card storage (Vault).

If you are using AIM, or you do not wish to use their Vault, then you will just need to encrypt this information in a secure database that is not directly connected to the internet to be PCI compliant. So, you can use a database with the information you'd like, and have Unique keys mapped to the information you'd need.

If you are using DPM, then you should not have to worry about any of this at all, as it will be handled by Authorize.Net.

I would recommend CIM in the future though, as it may ease some of these problems you are seeing, and you could also map this information to local customer accounts etc.

For some more information on their security best practices, you can always visit the following URL:

http://www.authorize.net/files/developerbestpractices.pdf

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .