Path: csiph.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: "J.O. Aho" Newsgroups: comp.lang.php Subject: Re: Need help with two-way script (PCI DSS) Date: Fri, 9 Sep 2016 06:32:19 +0200 Lines: 47 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Trace: individual.net TkIGhjbCsPvAHklAVK6UVQQm6yhGTYSfZKX0CFmPdWZAuiDC5t Cancel-Lock: sha1:ll4rjiqMTd7JkICRf4xjeHecGFo= X-Enigmail-Draft-Status: N1110 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.8.0 In-Reply-To: Xref: csiph.com comp.lang.php:17039 On 09/08/2016 10:59 PM, Jerry Stuckle wrote: > On 9/8/2016 4:06 PM, J.O. Aho wrote: >> On 09/08/2016 08:05 PM, Jerry Stuckle wrote: >>> So it sounds like you have control over both sides of the conversation, >>> in which case you can do about anything you want. So the first thing >>> you need to do is determine how you want to transfer the data. >>> >>> Personally, I would consider directly accessing the MySQL database - I >>> believe for the most part the less involved, the less that can go wrong. >> >> In this case you may get a PCI DSS dependency which you may not want to >> have, you will want as few machines as possible in scope, as this makes >> audits a lot easier and less work. >> > > Not if it's designed properly. For instance, MySQL can use encrypted > connections, and firewalls can limit access. If application A stores PAN/Card holder data in the database and application B only is interested in the email address and both access the same database, then both applications are in scope for PCI audit. If you let application A send the email address to application B with a https request and application B returns a true or false answer, then application B is out of scope for PCI. There are big difference in the amount of PCI documentation you have to have and less requirements on the server which application B is running. > But if the MySQL database is on another system, you'll have that problem > anyway, no matter how you access it. You have a compensating control on the MySQL too, as it don't support encrypted columns, sure you can (must) have it running on a luks partition. From PCI point of view, I would recommend to use postgresql unless you want to use money and go for oracle/sybase... the less compensating controls you have the smother the PCI audit will be. -- //Aho