Credit Card Details

If sensitive information (such as a credit card) has to be saved to a
database then there is a duty of care to protect this information.

If the data is saved in plain text, then there is a concern that a hacker
gaining access to the server will therefore gain access to the credit card
data.

One option is therefore to encrypt it. This means that the data is stored
on the server in an encrypted format. However, at some stage, the software
will legitimately need to decrypt the data in order to use this information.
To achieve this, it has to have access to the key to decrypt the
information. If the software has access to this decryption key then surely
so will any hacker. It would be equivalent to buying a secure safe and
hanging the keys next to it.

There must be a more secure implementation - could someone describe it>

Many thanks

Griff


.

Relevant Pages

  • RE: PGP scripting...
    ... Let me provide some clarification as to the way TRSM (tamper resistant ... The solution to this problem is "translation". ... example of a merchant site accepting credit card numbers. ... The TRSM would instead decrypt the credit card number inside it's secure ...
    (SecProg)
  • Re: PGP scripting...
    ... (for instance, the credit card aquirers). ... could decrypt your date securely (since the crypto box knows the ... re-encrypting) and transfer the transaction log to some people ...
    (SecProg)
  • RE: PGP scripting...
    ... Let me provide some clarification as to the way TRSM (tamper resistant ... The solution to this problem is "translation". ... example of a merchant site accepting credit card numbers. ... The TRSM would instead decrypt the credit card number inside it's secure ...
    (SecProg)
  • [PHP] Re: keeping credit card info in session
    ... You have to store the keys somewhere to decrypt the data to use it. ... As we have seen with blu-ray and HD DVD movies, the keys are the weak point that are easily compromised. ... Once you have the decryption key, the strength of the encryption means nothing. ... Anyways, if you're storing the credit card in the database, then why are you ...
    (php.general)