You should be using a separate database server than your web server if you're going to be storing credit card numbers. The database server should not be accessible by any machine except a small whitelist of IPs that you've specified. That way when your webserver gets compromised, it will require some looking around to realize the database containing credit card numbers isn't there.
Most server compromises that I've seen have stayed local to the server - I'm not a security pro; but generally I've seen the server that got knocked over get messed around with, anything on that server was fair game.
Beyond that, I'm sure there are other things you should do to protect the database that contains the credit card numbers; but seriously - keep them off your web server.
That's actually a direction I was thinking about myself. Make myself a restful decryption webservice, Communicating by backchannel private ip to the webserver. When I need a number for monthly billing, submit it to the web service.
I also had the idea of some dummy security trigger database entries, so if somebody actually camps out on my server, using my own webservice to decrypt the database, eventually they hit one of my trigger entries, and my webserver reboots and my cell phone starts ringing.
If it's monthly billing, why not keep that computer off (plugged out if you're worried about wake-on-LAN attacks), and manually turn it on once a week/month for 10 minutes to process everything?
Comments
You should be using a separate database server than your web server if you're going to be storing credit card numbers. The database server should not be accessible by any machine except a small whitelist of IPs that you've specified. That way when your webserver gets compromised, it will require some looking around to realize the database containing credit card numbers isn't there.
Most server compromises that I've seen have stayed local to the server - I'm not a security pro; but generally I've seen the server that got knocked over get messed around with, anything on that server was fair game.
Beyond that, I'm sure there are other things you should do to protect the database that contains the credit card numbers; but seriously - keep them off your web server.
That's actually a direction I was thinking about myself. Make myself a restful decryption webservice, Communicating by backchannel private ip to the webserver. When I need a number for monthly billing, submit it to the web service.
I also had the idea of some dummy security trigger database entries, so if somebody actually camps out on my server, using my own webservice to decrypt the database, eventually they hit one of my trigger entries, and my webserver reboots and my cell phone starts ringing.
If it's monthly billing, why not keep that computer off (plugged out if you're worried about wake-on-LAN attacks), and manually turn it on once a week/month for 10 minutes to process everything?