<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<br>
<div class="moz-signature">PCI compliance depends on the volume of
transactions and you have to be doing serious volume to get out of
level 1 compliance which is a scan and self certification
questionnaire. <br>
<br>
The scan will hit your system for now exploits or vulnerabilities and
provided a report of what you need to fix, we managed to secure our
platform once so all of our clients pass. The only thing it found for
us was one injection issue on a contact form and the fact that our load
balancer was supporting SSL2 and weak ciphers which was easy enough to
resolve. <br>
<br>
I understand that this is not compulsory but failure to implement can
result in the cancellation of you card processing rights in the event
of fraud - so for the sake of £120 per year per merchant and a bit of
work to the e-commerce platform essesntial<br>
</div>
<br>
<br>
Andy Cowan wrote:
<blockquote cite="mid:4AF4556F.40006@w4.co.uk" type="cite">
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
<title></title>
Several issues/experiences spring to mind:<br>
<br>
1. AFAIR PCI compliance is not the compulsory thing it's being made out
to be much of the time - effectively it's a liability shift, like with
chip and pin, and a revenue earning opportunity, as the card companies
push merchant to people to security testers like SecurityMetrics for
compliance. In all the cases that we've dealt with so far, badly
informed bank sales staff have scared our merchants into paying for
Security Metrics when they really didn't need it. Worldpay have issues
of their own, just look at the security issues they've had this year...<br>
<br>
2. However, despite this, it's not that hard to acheive PCI compliance
- depnding on whether you run your own servers (dedicated or VPS) or
whether your host bothers with it. It can however be a pain with some
OS' - Windows/Centos/Redhat sping to mind (for entirely different
reasons). We have to ensure all our servers are PCI compliant and once
they are compliant, keeping them there isn't too much of a chore.<br>
<br>
3. There are easy ways round if you want to play the system - I know of
at least one customer who is compliant because what is actually being
scanned in the load balancer in front of his windows machines, not the
servers themselves. Not strictly within the spirit, but definitely
passes SecurityMetrics scans..<br>
<br>
I think that your analysis that they are going to push e-commerce into
a tighter and tighter corner is probably correct, but I think then that
the onus on providing that 'corner' is going to fall on the hosting
companies - I imagine that if I was to offer PCI compliant hosting,
you'd be interested in having me deal with that for you? It's a
function of the hosting environment I think...<br>
<br>
A.<br>
<br>
On 06/11/2009 16:21, Bronwen Reid wrote:
<blockquote cite="mid:4AF44D03.5070607@bronwenreid.com" type="cite">
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
Hello,<br>
<br>
Andy's right - integration with Sagepay direct is fairly okay, and the
online examples are useful.<br>
<br>
However, something I've been looking at recently is PCI DSS
compliance. Sagepay mention this, but don't emphasis it; Worldpay ask
for a Payment Card Industry Data Security (PCI DSS) Vulnerability Scan
before they let people use the XML direct transfers (their equivalent
of the sagepay direct model)<br>
<br>
But I think PCI compliance going to become more and more of an issue -
credit card companies are making great efforts to tighten up on
security and this seems to involve pushing e-commerce into a very
restrictive environment where solutions like paypal or google checkout
will be the norm.<br>
<br>
Has anyone got any experiences here, good or bad?<br>
<br>
<br>
<br>
Gavin Kimpson wrote:
<blockquote
cite="mid:9458559b0911060633k2ca67281w945ca422fffe52a8@mail.gmail.com"
type="cite">
<pre wrap="">Hi Guys,
I've done Sagepay integrations in the past with no issues but these
have usually been using the more simple 'Form' approach, however this
time I would like to build an integration with Sagepay Direct. Does
anyone know of any pre-built classes that perform Sagepay Direct
integration as I'd prefer to not use an entire pre-built eCommerce
system like Magento.
Thanks in advance
_______________________________________________
Phpwm mailing list
Website : <a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://www.phpwm.org">http://www.phpwm.org</a>
Twitter : <a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://www.twitter.com/phpwm">http://www.twitter.com/phpwm</a>
Facebook: <a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://www.facebook.com/group.php?gid=2361609907">http://www.facebook.com/group.php?gid=2361609907</a>
Post to list: <a moz-do-not-send="true" class="moz-txt-link-abbreviated"
href="mailto:Phpwm@mailman.lug.org.uk">Phpwm@mailman.lug.org.uk</a>
Archive etc : <a moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://mailman.lug.org.uk/mailman/listinfo/phpwm">https://mailman.lug.org.uk/mailman/listinfo/phpwm</a>
</pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<font color="#000000" face="verdana, Helvetica, Arial, sans-serif"
size="-1">Bronwen Reid, </font></div>
<pre wrap=""><fieldset class="mimeAttachmentHeader"></fieldset>
_______________________________________________
Phpwm mailing list
Website : <a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://www.phpwm.org">http://www.phpwm.org</a>
Twitter : <a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://www.twitter.com/phpwm">http://www.twitter.com/phpwm</a>
Facebook: <a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://www.facebook.com/group.php?gid=2361609907">http://www.facebook.com/group.php?gid=2361609907</a>
Post to list: <a moz-do-not-send="true" class="moz-txt-link-abbreviated"
href="mailto:Phpwm@mailman.lug.org.uk">Phpwm@mailman.lug.org.uk</a>
Archive etc : <a moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://mailman.lug.org.uk/mailman/listinfo/phpwm">https://mailman.lug.org.uk/mailman/listinfo/phpwm</a></pre>
</blockquote>
<br>
<pre wrap="">
<hr size="4" width="90%">
_______________________________________________
Phpwm mailing list
Website : <a class="moz-txt-link-freetext" href="http://www.phpwm.org">http://www.phpwm.org</a>
Twitter : <a class="moz-txt-link-freetext" href="http://www.twitter.com/phpwm">http://www.twitter.com/phpwm</a>
Facebook: <a class="moz-txt-link-freetext" href="http://www.facebook.com/group.php?gid=2361609907">http://www.facebook.com/group.php?gid=2361609907</a>
Post to list: <a class="moz-txt-link-abbreviated" href="mailto:Phpwm@mailman.lug.org.uk">Phpwm@mailman.lug.org.uk</a>
Archive etc : <a class="moz-txt-link-freetext" href="https://mailman.lug.org.uk/mailman/listinfo/phpwm">https://mailman.lug.org.uk/mailman/listinfo/phpwm</a></pre>
</blockquote>
</body>
</html>