四月 15th, 2009 | Eric | (5 votes, average: 4.60 out of 5) Loading ...
写paypal程序有一段时间了。关于电子支付,安全问题非同小可,总是要反复留心。但不管怎么谨慎,按照个人主观标准做的东西总不能保证质量。近日开始系统阅读paypal开发文档,没想到第一课就是PCI DSS(Payment Card Industry Data Security Standards支付卡数据安全工业标准)。有了标准就有质量保证的依据,应该是做电子支付的必修课了。
什么是PCI DSS?
PCI DSS是:支付卡数据安全工业标准
按照支付卡行业安全标准委员会(PCI SSC)需求设计
保护持卡人在支付卡欺诈、遗失、偷盗情况下的数据安全规范
PCI SSC 管理此标准
支付卡公司执行此标准(如:Visa, MasterCard, DiscoverCard and American Express)
PCI DSS适用于持卡人数据存储、处理与传输的全过程
PCI DSS 目标概略
建设与维护安全网络
保护持卡人数据
维护系统弱点
实行健壮的访问控制
监控与测试网络
维护一个安全策略
遵守PCI DSS
遵守PCI DSS不是一次性目标,它是不断评估与执行的过程。
评估:确定持卡人数据与相关IT设施清单,分析弱点
纠正:修正弱点并保持只对指定数据进行处理
报告:记录所有的行动日志,并通知收单行与有关经营体
PCI DSS 12 Core Requirements
Build and Maintain a Secure Network
Requirement 1 Install and maintain a firewall configuration to protect cardholder data
Requirement 2 Do not use vendor-supplied defaults for system passwords and other security parameters
Protect Cardholder Data
Requirement 3 Protect stored cardholder data
Requirement 4 Encrypt transmission of cardholder data across open, public networks
Maintain a Vulnerability Management Program
Requirement 5 Use and regularly update anti-virus software
Requirement 6 Develop and maintain secure systems and applications
Implement Strong Access Control Measures
Requirement 7 Restrict access to cardholder data by business need-to-know
Requirement 8 Assign a unique ID to each person with computer access
Requirement 9 Restrict physical access to cardholder data
Regularly Monitor and Test Networks
Requirement 10 Track and monitor all access to network resources and cardholder data
Requirement 11 Regularly test security systems and processes
给数据库建控制帐号:(高安全,可选) mysql> grant select,insert,update,delete on ericbess.eric_ to eric@”%” Identified by “eric_password”; mysql> grant select,insert,update,delete on ericbess.bess_ to bess@”%” Identified by “bess_password”;
十一月 10th, 2008 | Eric | (1 votes, average: 5.00 out of 5) Loading ...
一直想直接用JavaScrip调用Xurrency.com 的 SOAP,实现汇率的AJAX,找到个JavaScript SOAP Client做了测试。本机上IE,Chrome成功返回,firefox与在host上报错,”access to restricted URI DENIED”不知其所以然。
Popular Posts