在 php/mysql 应用程序中收集和存储银行帐户详细信息时的安全注意事项
我们被要求研究收集银行帐号和分类代码并临时存储它们以通过无纸化直接借记系统进行离线处理的应用程序的可行性。
数据将通过 256 位 SSL 连接从网站访问者收集，并存储在 mySQL 数据库中，供我们的客户稍后收集。该数据将暂时保留，直到下载为止，下载后将从数据库中删除。
细节： 我们在此特定服务器上托管一些其他网站 没有人具有对服务器的 shell 访问权限或 FTP 访问权限 服务器符合 PCI 标准 Mod_security 和在机器上运行的其他软件
我知道这与这个问题非常相似
据我所知，安全考虑因素可能非常庞大。
我们应该关注哪些特定的安全领域？
We have been asked to look into the feasibility of an application to collect bank account numbers and sort codes and store them temporarily for offline processing through a paperless direct debit system.
Data will be collected from website visitors through a 256 bit SSL connection and stored in a mySQL database for later collection by our client. This data would be held temporarily until downloaded at which point it would be erased from the database.
Details:
We host a few other websites on this particular server
No-one has shell access or FTP access to the server
Server is PCI compliant
Mod_security and other software running on machine
I know this is very similar to this question Best practices for storing bank information in a database, and appreciate the bulk of responses are to steer clear.
I understand the list of security considerations is potentially very large.
What particular areas of security should we focus on?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
使用非对称加密，以便数据在插入数据库之前进行加密，但您不会在服务器上存储解密数据所需的密钥。
此密钥应仅存储在客户端，以便他们可以在从服务器检索密钥后对其进行解密。
仍然有了这种保护，您将需要为它们创建某种隧道以安全地连接到您的服务器。如果你打算让它们直接连接到MySQL，我应该提一下，不建议不加区别地接受外部连接到MySQL监听端口。如果他们有静态 IP，如果创建 VPN 对您来说不可行，您可以使用软件或硬件防火墙以这种方式限制它。
此答案提供了有关使用内置进行非对称加密的一些信息PHP 中的
openssl_*函数。如有必要，请要求对此进行澄清/扩展。
Use asymmetric encryption so that the data is encrypted before being inserted into the database, but you don't store the necessary key to decrypt the data on the server.
This key should only be stored on the client's side, so they can decrypt it after retrieving it from your server.
Still with this protection, you'll want to create a tunnel of sorts for them to securely connect to your server(s). If you intend to let them connect to MySQL directly, I should mention it is inadvisable to accept external connections to the MySQL listening port indiscriminately. If they have a static IP, you can make use of a software or hardware firewall to restrict it in that manner, if creating a VPN is not workable for you.
This answer provides some information about doing asymmetric encryption with the built-in
openssl_*functions in PHP.Please ask for clarification/expansion on any of this as necessary.