3 Options for Accepting Secure Payments in Magento
By Richard Loerzel, Senior Applications Engineer
While there are many options for accepting payments with Magento, not all of these options are created equally. With so many high-profile data breaches in the news, the credit card industry is no longer as lenient with the security requirements for their customer’s systems. eCommerce businesses have to make sure that they maintain a secure environment for processing, storing, or transmitting customers’ credit card data.
PCI Compliance
As we mentioned in a previous blog about PCI compliance for Magento stores, to establish a uniform set of security requirements for the processing of credit cards over electronic networks, a consortium of all the major credit card companies established the PCI Data Security Standard (PCI DSS). These requirements outline the rules for storing sensitive customer financial data and define the setup and configuration of servers, encryption, password creation and other processes or behaviors that are needed to keep your customer’s data free from the prying eyes of hackers.
Why PCI Compliance and Security Matter
Unfortunately, there are some payment gateway options for Magento that are not PCI compliant. For example, the original version of the Authorize.Net gateway had some holes in its system that didn’t make it completely secure. Even though this gateway didn’t store any sensitive data in the database (like credit card numbers or CVV codes), the payment form resides on the server. When a customer submits her credit card number with that form, the data passes through its controller, core server code, and any add-on modules that extend payment functionality. It would be extremely easy for an unscrupulous developer to insert a tiny piece of code to intercept this financial data without the customer, the credit card company, or the payment gateway knowing. Thankfully, all of the popular payment gateway companies, including Authorize.Net, have upgraded their offerings to the new realities of the marketplace.
Magento Secure Payment Bridge
Probably the most secure way to process payments on a Magento server is to use Magento’s very own Secure Payment Bridge. This software’s enhanced security comes from the fact that it’s not just a payment gateway module, it’s a standalone server that sits in-between Magento and your payment gateway. The source code of this server is tightly controlled to prevent malicious add-on modules from capturing any sensitive data. Since none of the credit card data will ever pass through your Magento server’s code, it is impossible for the data to be illicitly captured. Secure Payment Bridge returns a transaction key to represent the order payment within Magento. This transaction key can be used to access your customers’ payment records in your credit card processor’s system.
While Magento Secure Payment Bridge provides excellent security, it can be tricky to install and still requires a fair amount of server knowledge to keep things working properly. Thankfully, there are many more options that provide great security and are easier to setup.
Hosted Order Post (HOP)
One of the most secure payment gateway methodologies is Hosted Order Post or “HOP”. Similar to the Magento Secure Payment Bridge, the credit card payment form resides outside of your Magento server. With HOP, the form lives on your payment gateway company’s server and is displayed on your checkout page in an iframe. When a credit card is successfully processed, a transaction key is returned to represent the payment in Magento. This key ties the Magento order to the customer record in your credit card processor’s records. Authorize.Net and Chase Paymentech have quality HOP solutions. CyberSource also provides a service called Secure Acceptance Mobile/Web that is marketed as an alternative to HOP, but in reality, it functions in the same basic manner.
A downside to these services is that you will generally need to sacrifice flexibility and customizability for security. Options for changing the look and feel of the payment form on the external server are usually limited.
Silent Order Post (SOP)
If the lack of flexibility and customizability with HOP is a problem, an alternative method called Silent Order Post or “SOP” is also an option. Instead of hosting your payment form on an external server, the form is “injected” into your checkout page using JavaScript that’s hosted by your payment gateway. When your customer submits the payment form, it posts the sensitive data directed to the credit card processors servers over HTTPS. By doing this, any sensitive data has only passed through the client browser and has technically been isolated from any code in the Magento server code. I say “technically” because there still is the potential, however small, for malicious JavaScript to interfere with this process. If this is an acceptable risk for your company, there are many excellent options that allow you to customize everything to your heart’s content. CyberSource’s Secure Acceptance Silent Order POST service is a very flexible option that allows you to customize the payment process to a very fine degree.
Want to learn more? Contact us.
