q; keep credit card data

[Guest]

Hello,
If I need to keep credit card data in my database, is there any site that
talks about the requirements need to be realized during SW development and
the liabilities for overall system development.

 

[Steve C. Orr [MVP, MCSD]]

Well you'd need to encrypt it at a minimum, but I would highly advise NOT
keeping complete credit card details in the database because there is no
such thing as 100% secure and I'm sure you'd rather not be liable.

 

[Ken Cox [Microsoft MVP]]

Hi Jim,

If you must keep credit card data (not recommended), be sure to check out
the ASP.NET 2.0 Internet Security Reference Implementation. It revised the
PetShop 4 sample to use security best practices:

http://www.gotdotnet.com/codegallery/codegallery.aspx?id=48f35de8-cd92-4ac6-9144-12d5a13f22ff

Ken
Microsoft MVP [ASP.NET]

 

[Mark Rae]

If I need to keep credit card data in my database

In addition to what Steve and Ken have said, you also need to think about
the legal aspect of what you're doing. I don't know where in the world
you're based, but we in the UK certainly have very strict laws about holding
data such as this:
http://www.dataprotectioncenter.com/s/data_protection_act_1998

 

[Windsun]

Not sure of the exact time, I think 30 days, but there is a short limit on
how long you can store CC numbers, by US law.

 

[Mark Rae]

Not sure of the exact time, I think 30 days, but there is a short limit on
how long you can store CC numbers, by US law.

So how do companies like Amazon, PayPal etc do it...?