1

We have to be sure that this temporary data will be persistent and that deletion is compliant with the DoD's security standards (wiping data on the disk / avoiding storage on the disk).

I thought to store the data encrypted with the RIJNDAEL 256 algorithm + a crafted secret into memcache but I'm afraid of data loss / corruption.

I thought as well to MySQL and the memory heap storage engine but I don't know the reliability of the thing so far.

Any thoughts on the subject?

ljs.dev
  • 4,449
  • 3
  • 47
  • 80
Christophe Eblé
  • 8,071
  • 3
  • 33
  • 32
  • 1
    If the storage is only temporary are you absolutely sure you need to store it at all? – Matt Asbury Dec 16 '10 at 23:05
  • Farm this out when possible. It generally isn't worth the liability. – Brad Dec 17 '10 at 05:23
  • @Matt, Yes we need to store data because we need to process some credit card info after card holder authentication on his bank. (We are using Verified by Visa and Securecode) – Christophe Eblé Dec 17 '10 at 05:40

2 Answers2

4

It's probably more trouble than you're expecting. As soon as you persist card details to disk the whole weight of PCI-DSS bears down on you. That means your whole network (and indeed company) comes under close scrutiny to ensure it is secure and follows strong best practice advice.

Using AES (256 bit Rijndael) is a step in the right direction, but the actual encryption is trivial compared to the difficulty in organising a PCI compliant key management system. Keys must be split (dual knowledge), cannot be stored on the same box as the data, must be able to be rotated at least yearly, and so on. Getting key management right is challenging.

Ultimately though, you will need to prove whatever solution you have come up with is PCI compliant. You prove your compliance by enrolling the assistance of a QSA (Qualified Security Assessor). The best advice would be to bring in a QSA now, so that they can advise on what approach to take, and guide you around the pitfalls where necessary.

Bringing in a QSA when the project is complete is a false economy, because if they fail your solution, you start again.

Community
  • 1
  • 1
PaulG
  • 13,871
  • 9
  • 56
  • 78
0

Is storing card data absolutely necessary? There are vendors (Braintree for example) that will process cards without requiring your site to store card info, thereby relieving you of the burden of being PCI compliant.

Ed Mays
  • 1,730
  • 4
  • 13
  • 12
  • @Ed, Yes we need to store data because we need to process some credit card info after card holder authentication on his bank. (We are using Verified by Visa and Securecode) – Christophe Eblé Dec 17 '10 at 05:41
  • How long after the credit card is verified do you then perform your internal processes? How long is the data stored for? – Matt Asbury Dec 17 '10 at 08:20