If your database has Mass. residents, you need a security plan per Massachusetts

Re:If your database has Mass. residents, you need a security... by bobbyi on Saturday April 24, 2010 @11:15PM (#1292065)

There's no need to store any of those things in your database in order to allow card transactions.

[ Parent | on HN ]

Re:If your database has Mass. residents, you need a security... by viraptor on Saturday April 24, 2010 @11:50PM (#1292112)

Unless I misunderstood this, it affects you even if you only transfer the information to a 3rd party:

17.04: Every person that owns or licenses personal information about a resident of the Commonwealth and electronically stores or transmits such information...

Also many online shops allow you to save the info in case you want to reuse it in the future.

[ Parent | on HN ]

Re:If your database has Mass. residents, you need a security... by nostrademons on Sunday April 25, 2010 @01:38AM (#1292240)

If you're not storing the information, presumably you don't need to encrypt the data that you're not storing. You do need to encrypt it while transferring it (i.e. use https instead of http), but if you don't do this already, shame on you!

Similarly, if you're storing credit card numbers in plaintext in a database, shame on you! That's worse than storing plain-text passwords.

I think the worst parts of this law are the "you have to file with the Massachusetts government" aspects. The technical stuff is basically common-sense data security that everyone should already be doing.

[ Parent | on HN ]

Re:If your database has Mass. residents, you need a security... by hga on Sunday April 25, 2010 @07:41AM (#1292565)

This is not my field, but don't you have to store card card numbers in order to do things like issue refunds?

[ Parent | on HN ]

Re:If your database has Mass. residents, you need a security... by hga on Sunday April 25, 2010 @12:00PM (#1292909)

Correct that, partial refunds.

[ Parent | on HN ]