PCI Security Practices

Merchants who accept credit card payments should be aware of the PCI (Payment Card Industry) Data Security Requirements from the major credit card companies. These requirements have been developed to ensure safe handling of sensitive payment information, such as storage and transfer of credit card information. PCI is the umbrella program for other programs, such as Visa Cardholder Information Security Program (CISP) and Master Card Site Data Protection (SDP). This document contains instructions for configuring ShopSite to meet PCI requirements. Merchants may also need to implement other procedures for handling credit card information outside of the ShopSite Shopping Cart Software.

These guidelines are for merchants who handle and process credit card information. If you do not accept credit cards, PCI requirements do not apply to you. You should, however, still follow good security practices and implement applicable guidelines included here.

Installation

Your hosting provider should have already installed ShopSite for you. Instructions to securely install ShopSite can be found in the ShopSite Installation help.

You and your hosting provider should always use a secure connection (SSH, SFTP, FTP over SSH, etc.) and two-factor (password plus public key) authentication when connecting to the server for administrative purposes. This includes when you connect to install or upgrade ShopSite, or when you connect to perform other administrative tasks on your server.

The server Operating System and other applications such as the Web server and E-mail server must be kept up to date with the most recent security patches. Your hosting provider is usually responsible for this, and should already be doing this. For more details regarding this subject, see the Visa CISP Web page.

Accepting Credit Cards

There are three different ways to accept credit cards with your ShopSite store. The first is an external processor, which has the customer enter payment information directly on the payment processor's site. Merchants who want to keep the customer on their own site can use an internal processor, which gathers the payment information within the ShopSite shopping cart and then sends it to the processor. Finally, merchants can manually process credit card information.

External payment processors take the customer off your site to the payment processor site to enter payment information. Processors that use this method include PayPal Website Payments Standard, PayPal Website Payments Pro (Express Checkout), and WorldPay. Because ShopSite never actually sees the payment information, using these payment processors makes your ShopSite store PCI compliant as long as the external processor is PCI compliant.
Internal payment processors accept payment information within the ShopSite shopping cart, then the information is submitted to the processor. This method is preferred by many merchants because it doesn't send the customer off to a different site to accept payment information. PCI requires that any time credit card information is gathered within the shopping cart, ShopSite must be configured to use SSL. To learn more about configuring SSL, see the Hosting Service Configuration screen help.

When using one of these payment processors, the payment information is immediately sent to the payment processor, and there is no further need to store the payment information in ShopSite. ShopSite recommends that if you are using one of these processors, you select the option to not store credit card information for maximum security. See the Credit Card Storage screen help for instructions to configure your store not to keep credit card information. If you feel that it is necessary to temporarily store the credit card information, follow the guidelines for manual payment processing below.
Manual payment processing requires the merchant to collect the payment information in the shopping cart, then manually bill the card using a separate payment processing method. When ShopSite is configured for manual payment processing, PCI requires that SSL be used for any screen where payment information is gathered or viewed. See the Hosting Service Configuration screen help for instructions to configure ShopSite to use SSL.

By default, ShopSite will store credit card information using symmetric encryption. For PCI compliance, you must enable Merchant Key (asymmetric) encryption for payment information storage. Only one employee should have access to the Merchant Key and billing information. See the Credit Card Storage screen help for instructions to configure your store to use Merchant Key encryption. Even with Merchant Key encryption turned on, you should not store credit card information any longer than absolutely necessary to bill the order. Merchants should view or download any order on the same day it is created, then delete the order from ShopSite once the order has been billed.

Security Logs

PCI guidelines require merchants to log all access to payment information, and to retain those logs for 12 months. ShopSite's Intruder Detection System records every time someone views an order. The current month's log is viewable from the Back Office, and the previous 12 months are automatically stored. See the Intruder Detection Help for more information.

Determining Compliance

ShopSite includes a feature to help you know how compliant your store is with PCI security guidelines for credit card processing and storage. On the ShopSite Order Screen you will see a security level indicator near the top, left corner of the screen. If you have a high security level, your ShopSite store is configured to comply with PCI requirements. If your security level is Medium or Low, you are not meeting all the PCI requirements regarding your ShopSite store. Even if your security level in ShopSite is High, you may still need to do other things to comply with PCI requirements. See the Visa CISP Web page for the complete PCI requirement specification.

Additional Requirements

In addition to the guidelines for storing credit card information, PCI requirements include numerous additional guidelines regarding safe practices. You must meet all the guidelines in order to be PCI compliant. Some of the guidelines relevant to managing ShopSite stores are listed below.

Access Payment Information Securely. Whenever you access payment information, do it from a computer that is behind a firewall and which has frequent spyware and anti-virus scans. You should never used a shared (public) computer to access payment information. Always access payment information using an encrypted connection (SSL), and never send payment information via E-mail.
Use Secure Connections. Unencrypted internet connections, such as Telnet and FTP, could be intercepted and read by malicious hackers. Any time you connect to your server for administrative purposes, you should use a secure internet connection, such as SSH instead of telnet, FTP over SSH or SFTP instead of FTP, and of course HTTPS instead of HTTP. Two factor authentication (password plus public key) is required for any administrative access. You also need to avoiding using unencrypted wireless network connections, especially in public places.
Use Unique Passwords and User Accounts. The local computer from which you access payment information should require users to log in using a unique username and password. You should also have a different username and password for administrative access to the Web server than you use to access the ShopSite back office.
Disable unused accounts on your local computer and on your Web server. All user accounts, regardless of what they are used for, should either have strong passwords or have user access disabled.
Use Strong, Secure Passwords. The passwords you use, especially the ones used to access payment information, should be difficult for malicious intruders to guess. See our Password Security Guidelines for details regarding good password practices.
Change your Passwords and Merchant Key regularly. You should change your passwords and merchant key every ninety days (3 months) as a precautionary measure. You should also change them if you think they have been or may be compromised. Whenever you release an employee who had access to payment information, or if you see suspicious behavior on your server, you should change the access information.

See the Visa CISP Web page for the complete PCI requirement specification.

ShopSite Help and Resource Center
Last updated: March 14, 2007
Give Feedback