|
Thursday 13 March 2008 12:27:01 am
While Bruce suggestion is accurate, it is simpler for the inexperienced, another very serious point to consider is security of your customer information. This subject goes so very much much deeper.. While using the GPG encrypted storage provided with eZ Authorize is as Obi-Wan Kenobi would say ". . . from a certain point of view" more secure than storing this information in plain text form within a user content object / plain text datatype .... Most of the information security professionals and credit card companies point out that if you store sensitive information like credit card information on any public webserver in any form (encrypted or otherwise) you are leaving the information at great risk. These same companies have recommended at great length that the actual storage only occur behind a specially fire walled storage system completely separate from the front end web application/servers. The trouble often surrounds customers. Whether by malicious intentions (yes some business leave customer information insecure and use another separate third party to steal customer information indirectly on their own behalf), ignorance, or greed (not wanting to pay for an industry standard secure solution to be used or developed) ... the results are all to often the same in the egalitarian or fascist realm that is the world of business, customers are at risk when they give out their personal information. Customers often want to store this information in generally insecure ways (even when they don't realize it) because this additional security brings a host of additional cost and requirements in the software solutions they are creating / using / working with.
Most payment gateway service providers sell the more secure payment information storage services.
Authorize.net for example at additional cost offers such a service which is a vastly more secure storage alternative. Sadly from all the customers I have encountered to date ... care more about reducing their bottom line than securing customer information in a real way. Many disregard the separate storage requirements / recommendations and store credit card information in the databases or filesystems of public web servers. Even eZ Authorize which offers encrypted storage within a single eZ Publish installation ... is not immune to these realities. This may be why it was never packaged and released as a default enabled option. The key concern is that if the public webserver can encrypt and decrypt the information through the application itself, chances are, if a malicious attacker could compromise the server, gain access, it is possible that they could gain access to the information encrypted or otherwise. Which is just a brief tip of the iceberg that is this issue. In the past while the recommendations were strongly against these bad practices. It seemed they were not 'illegal' or directly forbidden. Which in part is why so many normal software developers trying to earn a living have been coerced into creating bad solutions to meet manipulative customer demands. We do need to earn a living and take care of ourselves. Thankfully it seems the industry is starting to change. Looking just now at a glance I find changes brewing. Sadly compliance is not perfect. As long as small business (as a simple example) are willing to do something foolish (for what ever excuse) and their are other people (often developers looking to earn a living at demands of another person) poor results will continue to occur. This is not new and passing laws does not put an end to this cycle. Here are a few related links regarding this avoided subject.
http://www.securityfocus.com/news/11496
http://www.darkreading.com/document.asp?doc_id=138838
http://www.pcicomplianceguide.org/ Please do be careful. Think of others before yourself. Treat others as you would wish to be treated. Be responsible. Use wisdom. It is OK to say no to a customer. There are always better ways to earn a living. I've said it before when talking about information/software security. "Remember that humans are insecure creatures so it is no surprise that the systems we continue to create are all to often equally insecure". <i>//kracker</i> Most refuse to accept the truth about .. until it is too late. <i>"...The world can not be free! Because Man does not want it to be!" -- kracker @ 06/07/2007</i>
Member since: 2001.07.13 || http://ezpedia.se7enx.com/
|