Up until last year, I used to work in the credit card industry. I noticed a couple things about
your software and marketing that could help you, and I have a question about
security in BVC5.
"CISP Compliance" First of all, CISP (Visa's Cardholder Information Secuirty Policy) has been superceeded by PCI (Payment Card Industry Compliance). Since complying with Visa, Mastercard, American Express, and Discover meant 4 different audits with (possibly conflicting) rules, over 3 years ago the credit card giants joined their efforts to come up with a security policy that everyone could comply with using only 1 set of rules.
However, CISP and PCI basically cover the same things so we are just talking about
semantics. It would probably help your marketing efforts if you advertised that you are compliant with the current standard, though.
Basically, the 3 main things an e-Tailer needs to consider are:
1. Payment information is stored in encrypted format (and BVC5 does this).
2. Payment information is transmitted in encrypted format (SSL handles this one)
3. CVV2 code is never stored (which BVC5 also supports)
For more information on PCI:
http://www.internetsecurityguide.com/pci/pcicompliance.shtml Credit Card Transmission: There is one thing Microsoft came up with in .NET 2.0 that goes beyond complying with the credit card standards. There is now a datatype called SecureString that allows you to transmit sensitive information around in .NET. The main advantage of using it is once you have moved the sensitive data to its destination, you can call the Dispose() method on the object to instantly remove the sensitive information from memory. A regular string datatype will remain in memory on the computer it existed in until the .NET garbage collector removes it - which gives the more astute hackers the opportunity to capture it if they compromise the web server's memory.
Upon my analysis of your demo, I noticed that you are not using SecureString to move sensitive data around within BVC5.
Encryption Key Storage: Just out of curiousity, how is the encryption key that is used to encrypt the credit card information stored in BVC5 and what specifically was done to keep it from being compromised?