How important is a secure certificate for internal credit card processing?

Question

Where I work we have an ecommerce system on an intranet set up to process customer's credit cards. Currently when we charge a customer's credit card using Authorize.net we are not sending the credit card info to Authorize.net over a secure connection. Instead it goes over regular http. I'd like to get other opinions of how serious/negligent this is. Thanks.

EDIT: It looks like I'm wrong. I snooped around in the code and it looks like it's processing the credit card at https://secure.authorize.net. However, the web page where the credit card is entered is not secure. This is a different situation than I originally described. Sorry about that.

Answer 1

This seems very negligent. There have been too many leaks of credit card information to allow this sort of behavior.

Even if the processing was handled internal to your intranet, and not being sent up to a 3rd party, I would recommend using secured connections. You don't want this to be accessible by anybody, even internal, non-authorized employees.

Answer 2

It's an absolute, unmitigated disaster. You should immediately (and I mean immediately) use at least transport level security (SSL/TLS) and if Authorize.net can set up for it, message level security as well.

Answer 3

I'm confused. How are you sending plain HTTP requests to Authorize.net? Their transaction endpoints don't have HTTP versions - they'd be criminally negligent to permit that.

---

Now that you've edited, things are a bit clearer. Yes, it's still a security risk to have the intranet page be HTTP instead of HTTPS, but far less than what your question originally indicated (unencrypted transit of the public Internet).

As it's internal, you don't need a paid SSL certificate (if cost is the reason for avoiding HTTPS - I can't think of any other good reasons) - you should be able to use a self-signed one.

Answer 4

It's very important and what you do can cause some serious problems.

Also it's against PCI standards and every company who process credit card information has to follow PCI standards, therefore you might go into some legal trouble to do so.

Answer 5

I would recommend reading the OWASP guide: http://www.owasp.org/index.php/Category:OWASP_Guide_Project (Free download)

Page 53 and onwards .. Got some great information.

I would say, what you're doing is terrible negligent and needs to be sorted ASAP ..