ECommerce Security SSL Secure Directories

As more & more Web Developers/Designers get involved in ECommerce and Shopping Cart applications, we are seeing an increase in request for information on this subject. I’ll attempt to clarify some of the confusion:

Secure directory: A secure directory is a directory on a web server that has a certificate issued by an Issuing Authority, such as Verisign or Thawte. To obtain a certificate the owner of the IP # issued to a web server must furnish proof (Corporate papers, tax ID, etc – signed by the owner or officer) that they are the registered owner of the domain using that IP #.

Any connection to that directory by a client computer (using the HTTPS protocol) will cause data to be encrypted as it is sent between those two computers. So, a client entering credit card information to a secure directory (a form post method by HTTPS protocol) can be assured that information is secure TO THAT DIRECTORY. Credit card on-line processors such as Authorize.net & Cybercash then transmit this information over leased, secure lines to the credit card clearing houses. The approval or rejection is sent back to them over these same lines. An approval (or rejection) is return to the client through the secure link established by the submission of the form. Normally an email is generated to the merchant informing him of the successful order submission and a thank you email is sent to the customer.

Any information is only secure as long as it stays within these channels. Emailing of credit card information from the secure directory to a merchant breaks this secure chain and becomes a risk. Developers (normally at the insistence of a client) are continually asking if they can gather the information in a secure server, and email it to the merchant for processing, thus saving the merchant the few hundred dollars to set up an account with Authorize.net or Cybercash. By using a secure mail server and a secure mail protocol (such as PGPmail), this could be accomplished. However, it normally would take more time and expense to set this up than to use a secure processor. Developers also need to be aware of their liability exposure in this process – by using a qualified on-line processor the processor assumes the liability. And as we recently saw in Europe, once the data is moved from the secure directory (to a database on the same machine), it is no longer secure.

I have tried to provide a light overview here. If there is further interest, I will submit additional articles on: How Certificates Work, What levels of encryption exist, How PGP works, etc.

Gil Harvey