We are a small company and process less than 500 Credit Card transactions each year so we fall under Level 4 category merchants. The company heads wants to make sure that we are PCI compliant at all levels. I see that we are storing the credit card data in one of our databases but the PAN number is encrypted using RC2 encyption when it was initially developed years ago. I still feel that the RC2 encryption is vulnerable to attacks though we use SSL connection to transmit the data.
I have a few things in my mind as follows.
- Removing Card data from our database and only transmit details to the payment gateway.
- Secure Key Storage for the encrypted card Data.
I checked with the business and they said that the option 2 to remove card data is fine as they do not need to store data, but since there are some recurring transactions, my question is will that be affected if card data storage is removed??
If I go with option 3 of securing the keys used to decrypt the data, I see that there is a lot of procedures that needs to be followed as to implementing a commercial key management system etc.
Can you please suggest as to what is the best way of getting around this and be compliant.