eCommerce checkout security

Question

I'm developing an eCommerce site and using SagePay as a card processor.

Customers will enter their delivery/invoice details into a form which is then submitted to a checkout page. This page encrypts the data and sends it over to SagePay to process the payment. No credit card details are entered or stored on my site, this is all handled by SagePay. The address details only are stored in my database.

My question is what sort of security do I need to implement ?

As I see it, my options are:

• Use an SSL to provide a secure site
• Encrypt the address details before insertion into the database (I'm intending to do this anyway)
• Do nothing

For reference, the site is written in Coldfusion.

Answer 1

You'll want to use SSL for any pages in the checkout process, for sure. Encrypting address data in your own database is optional. If someone were able to access your database, they'd likely be able to get your encryption key also, so that would provide little defense. Also name and address are not nearly as sensitive of information as credit card data.

Answer 2

With me helping with the back-end system for a web hosting company, we strive to make sure our customers personal data is secured by SSL and we do encrypt their name, address, and phone numbers to just make sure if there is any data breaches, there should be minimal damage as possible.

Trust is one thing when it comes to having loyal clients.

As for your reference of your site using ColdFusion. For me, that bugs me, to be using a web programming language that is not being updated, exploits and vulnerabilities being fixed within the language itself.

I question if there is anything that is still exploitable in ColdFusion code still, because the last update that I do remember was in the middle of 2007.

But, encrypting customer information and SSL should be more than enough protection.