Comments on: Please build a… PCI DSS compliant Secure Proxy

By: Brian

Brian — Thu, 09 Oct 2008 23:56:48 +0000

@Henry – today, if you’re a small merchant, no one. Within the next few years, I suspect all merchant levels are going to be required to submit their report on compliance. The average level 3 and 4 merchant will not have even the foggiest clue here. Failure to comply will result in fines and ultimately loss of your merchant account.

In the mean time, if credit cards are compromised from your system (which the banks can tell by cross-referencing where cards have been used and finding the common point), then you will be subject to LARGE fines which your merchant agreement already states you agree to pay. Most small businesses will go bankrupt since general E&O insurance will generally not cover hacking losses (if you have E&O to start with).

By: Henry

Henry — Thu, 09 Oct 2008 23:45:43 +0000

Who will come knock your door and check if you’re PCI DSS compliant?

By: brian

brian — Wed, 08 Oct 2008 19:28:39 +0000

@Jimmy – now you’re feeling the pain. The catch that most people don’t understand is that if your network or systems EVER sees a full credit card number in plain text, you are subject to PCI DSS. It doesn’t matter if you process and forget, or quickly ship it off to a third party, etc. If the number traverses your network, you’re on the hook.

I’m got something brewing that might alleviate this for a lot of people… we’ll see!

By: Jimmy

Jimmy — Wed, 08 Oct 2008 16:04:48 +0000

Griiiiiiiipes! I spoke with my merchant company and understood everything was on the up and up. Looks like I need to do some work.

Now, at Brian…. add me to the list of people who would be interested in that proxy.

By: Peter Bell

Peter Bell — Wed, 08 Oct 2008 09:24:40 +0000

@Brin, I want one.

@Jimmy, I have bad news and bad news for you. We’re also looking at using auth.net’s CIM, but it does NOT mean your website is out of scope. You’ve handled the “store part”, but because your network transmits cardholder data, your website and web hosting environment are IN SCOPE for PCI DSS. The only way to keep your website out of scope is for your clients to post their form the with cc data to someone elses website. If they post the data to your site, even if you just pass it immediately to auth.net and then kill it, your entire website is in scope and will have to be PCI compliant.

Welcome to the wonderful world of PCI

By: Jimmy

Jimmy — Tue, 07 Oct 2008 17:41:18 +0000

As you explained, dealing with PCI DSS is a big big pain in the butt. When building the credit card processing for Music Arsenal, rather than dealing with all the rules of PCI DSS and potentially putting myself at lots of risk I decided to use Authorize.nets Customer Information Manager.

When I do a monthly charge to a customer instead of using authnets clunky recurring billing I’m able to pass an encrypted customer and card id to the CIM and have their server do all the charging and authorization.

I built a CFC to manage the integration with that and I’ll get it up on RIAForge one of these days soon. (Along with the Eventful CFC which is coming along nicely!)