Re: credit card number stored issue

storing the card#'s - definitely encrypt - there are encryption apis to do this in rpgle.
You need to understand pci requirements - your company could have tremendous liability if not handled properly. Determine how many trans per month to match up with the requirement levels.
Also check if your state has their own set of requirements (credit card and identity theft laws).
Jim

----- Original Message ----- From: "tim" <tim.dclinc@xxxxxxxxx>
To: "'Midrange Systems Technical Discussion'" <midrange-l@xxxxxxxxxxxx>
Sent: Wednesday, December 08, 2010 4:51 PM
Subject: RE: credit card number stored issue

I will give you a little more background on what I am trying to do.

This is our current process:
1. Get CC info over phone
2. Key CC into green screen and authenticate using Java App
3. Show user confirmation or declined message
The CC info is not stored on your system.

The new requirement is to set up a recurring payment process. I will need to
store the CC info in order to do this. I will have a night job that runs to
process any additional CC transactions.



-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of DeLong, Eric
Sent: Wednesday, December 08, 2010 3:02 PM
To: Midrange Systems Technical Discussion
Subject: RE: credit card number stored issue

Just pitching this over the fence, but you might want to google "credit
card tokenization" and consider this approach from the very start...
PCI security can make you miserable if you start down the wrong path.

Tokenization relieves you of many of the most stringent PCI
requirements, but may not be appropriate for your application. Depends
mostly on how you plan to use this credit card data. You didn't say
what sort of application you are dealing with, but in many cases, you
might select a third-party solution, that keeps you completely out of
the credit card storage and transmission game. I have had good results
with CyberSource.com, but there are many providers that might fit your
needs.

Hth,
-Eric DeLong

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of David Gibbs
Sent: Wednesday, December 08, 2010 12:55 PM
To: Midrange Systems Technical Discussion
Subject: Re: credit card number stored issue

tim wrote:

I am interested in the "best" way to store credit card numbers on my
iseries. Im not sure of compliance issues.

There are very specific rules regarding storage & processing of credit
card numbers on a system.

Check out https://www.pcisecuritystandards.org/ for more information.

david

--
IBM i on Power Systems - For when you can't afford to be out of business
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.



--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.