Designing a Payment System

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70

// Pattern 1: Hosted Fields Integration (SAQ A)
// Card data never touches your code - gateway controls input fields
 
import { loadStripe } from '@stripe/stripe-js';
import { Elements, CardElement, useStripe } from '@stripe/react-stripe-js';
 
// Initialize Stripe (loads from their CDN, not your bundle)
const stripePromise = loadStripe('pk_live_...');
 
function CheckoutForm() {
  const stripe = useStripe();
  
  const handleSubmit = async (event: React.FormEvent) => {
    event.preventDefault();
    
    if (!stripe) return;
    
    // createPaymentMethod sends card data directly to Stripe
    // Your server never sees the card number
    const { paymentMethod, error } = await stripe.createPaymentMethod({
      type: 'card',
      card: cardElement,  // Reference to Stripe's hosted element
      billing_details: {
        name: 'Customer Name',
      },
    });
    
    if (error) {
      console.error(error);
      return;
    }
    
    // Only send the token to your server
    const response = await fetch('/api/process-payment', {
      method: 'POST',
      body: JSON.stringify({
        paymentMethodId: paymentMethod.id,  // Token, not card number!
        amount: 5000,
        currency: 'usd',
      }),
    });
  };
  
  return (
    <form onSubmit={handleSubmit}>
      {/* CardElement is rendered by Stripe in an iFrame */}
      {/* Your page never has access to card number */}
      <CardElement 
        options={{
          style: {
            base: {
              fontSize: '16px',
              color: '#424770',
            },
          },
        }}
      />
      <button type="submit">Pay $50</button>
    </form>
  );
}
 
// Wrap with Elements provider
function Checkout() {
  return (
    <Elements stripe={stripePromise}>
      <CheckoutForm />
    </Elements>
  );
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71

// Pattern 2: Backend handling tokens (never card data)
 
interface ProcessPaymentRequest {
  paymentMethodId: string;  // Token from frontend
  amount: number;
  currency: string;
  customerId: string;
}
 
class PaymentController {
  async processPayment(req: Request): Promise<Response> {
    const body = req.body as ProcessPaymentRequest;
    
    // Validate token format (should be token, not card number!)
    if (!this.isValidTokenFormat(body.paymentMethodId)) {
      throw new ValidationError('Invalid payment method format');
    }
    
    // Double-check we're not receiving card data
    if (this.looksLikeCardNumber(body.paymentMethodId)) {
      // Log security alert - someone is sending card data!
      this.securityLogger.critical('Raw card data received in API');
      throw new SecurityError('Invalid request format');
    }
    
    // Process with gateway using token
    const result = await this.paymentService.charge({
      paymentMethodToken: body.paymentMethodId,
      amount: body.amount,
      currency: body.currency,
      customerId: body.customerId,
    });
    
    return Response.json(result);
  }
  
  private isValidTokenFormat(value: string): boolean {
    // Stripe: pm_*, Adyen: stored-payment-method-*
    return value.startsWith('pm_') || 
           value.startsWith('tok_') ||
           value.startsWith('stored-');
  }
  
  private looksLikeCardNumber(value: string): boolean {
    // Check if value looks like a card number
    const digitsOnly = value.replace(/\D/g, '');
    return digitsOnly.length >= 13 && 
           digitsOnly.length <= 19 &&
           this.passesLuhnCheck(digitsOnly);
  }
  
  private passesLuhnCheck(number: string): boolean {
    // Luhn algorithm for card number validation
    let sum = 0;
    let isEven = false;
    
    for (let i = number.length - 1; i >= 0; i--) {
      let digit = parseInt(number[i], 10);
      
      if (isEven) {
        digit *= 2;
        if (digit > 9) digit -= 9;
      }
      
      sum += digit;
      isEven = !isEven;
    }
    
    return sum % 10 === 0;
  }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99

// Pattern 3: Comprehensive Audit Logging (Requirement 10)
 
interface AuditLog {
  timestamp: Date;
  eventType: string;
  userId: string;
  resourceType: string;
  resourceId: string;
  action: string;
  outcome: 'success' | 'failure';
  ipAddress: string;
  userAgent: string;
  details: Record<string, unknown>;
}
 
class AuditLogger {
  constructor(
    private storage: AuditStorage,
    private config: AuditConfig
  ) {}
  
  async log(event: AuditLog): Promise<void> {
    // Ensure no sensitive data in logs
    const sanitized = this.sanitize(event);
    
    // Write to immutable audit log
    await this.storage.write(sanitized);
    
    // Real-time alerting for suspicious activity
    if (this.isSuspicious(event)) {
      await this.alertSecurityTeam(event);
    }
  }
  
  private sanitize(event: AuditLog): AuditLog {
    const sanitized = { ...event };
    
    // Remove any accidental PAN data
    sanitized.details = this.maskSensitiveData(event.details);
    
    return sanitized;
  }
  
  private maskSensitiveData(data: Record<string, unknown>): Record<string, unknown> {
    const masked = { ...data };
    
    for (const [key, value] of Object.entries(masked)) {
      if (typeof value === 'string') {
        // Mask anything that looks like a card number
        if (this.looksLikeCardNumber(value)) {
          masked[key] = this.mask(value);
        }
        // Mask CVV-like values
        if (/^\d{3,4}$/.test(value) && key.toLowerCase().includes('cv')) {
          masked[key] = '***';
        }
      } else if (typeof value === 'object') {
        masked[key] = this.maskSensitiveData(value as Record<string, unknown>);
      }
    }
    
    return masked;
  }
  
  private mask(cardNumber: string): string {
    // Show only last 4 digits
    const digitsOnly = cardNumber.replace(/\D/g, '');
    const last4 = digitsOnly.slice(-4);
    return `****${last4}`;
  }
  
  private isSuspicious(event: AuditLog): boolean {
    // Detect suspicious patterns
    const suspiciousPatterns = [
      // Multiple failed auth attempts
      event.eventType === 'authentication' && event.outcome === 'failure',
      // Bulk data access
      event.action === 'export' && event.resourceType === 'transactions',
      // Admin access outside business hours
      event.resourceType === 'admin' && !this.isBusinessHours(),
      // Access from new location
      event.eventType === 'access' && !this.isKnownLocation(event.ipAddress),
    ];
    
    return suspiciousPatterns.some(p => p);
  }
}
 
// Requirement 10.2: Key events that MUST be logged
const REQUIRED_AUDIT_EVENTS = [
  'user_access_cardholder_data',
  'admin_action',
  'access_control_change',
  'authentication_attempt',
  'audit_log_access',
  'security_event',
  'initialization_of_audit_logs',
  'creation_modification_deletion_of_accounts',
];

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

# Kubernetes Network Policy for CDE Isolation
 
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: payment-service-policy
  namespace: cde  # Dedicated namespace for CDE
spec:
  podSelector:
    matchLabels:
      app: payment-service
  policyTypes:
    - Ingress
    - Egress
  
  # Only allow ingress from API gateway
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: api-gateway
          podSelector:
            matchLabels:
              app: api-gateway
      ports:
        - protocol: TCP
          port: 443
  
  # Only allow egress to:
  # - Payment gateway (external)
  # - Token database (internal)
  # - DNS
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: token-database
      ports:
        - protocol: TCP
          port: 5432
    
    # Payment gateway IPs (whitelist)
    - to:
        - ipBlock:
            cidr: 54.200.0.0/16  # Stripe's IP range
      ports:
        - protocol: TCP
          port: 443
    
    # DNS
    - to:
        - port: 53
          protocol: UDP
        - port: 53
          protocol: TCP
 
---
# Deny all other traffic to CDE namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-cde
  namespace: cde
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131

// Automating PCI Compliance Checks
 
interface ComplianceCheckResult {
  checkId: string;
  requirement: string;
  status: 'pass' | 'fail' | 'warning';
  details: string;
  evidence: string[];
  remediation?: string;
}
 
class PCIComplianceChecker {
  async runDailyChecks(): Promise<ComplianceCheckResult[]> {
    const results: ComplianceCheckResult[] = [];
    
    // Requirement 10: Verify log collection
    results.push(await this.checkLogCollection());
    
    // Requirement 2: Check for default credentials
    results.push(await this.checkDefaultCredentials());
    
    // Requirement 6: Check for missing patches
    results.push(await this.checkSecurityPatches());
    
    // Requirement 8: Check for inactive user accounts
    results.push(await this.checkInactiveAccounts());
    
    // Alert on failures
    const failures = results.filter(r => r.status === 'fail');
    if (failures.length > 0) {
      await this.alertSecurityTeam(failures);
    }
    
    return results;
  }
  
  private async checkLogCollection(): Promise<ComplianceCheckResult> {
    // Verify all CDE systems are sending logs
    const cdeSystems = await this.cdeInventory.getSystems();
    const loggingSystems = await this.siemClient.getActiveSources();
    
    const missingLogs = cdeSystems.filter(
      sys => !loggingSystems.includes(sys.id)
    );
    
    return {
      checkId: 'PCI-10.2',
      requirement: 'Audit logging for all CDE systems',
      status: missingLogs.length === 0 ? 'pass' : 'fail',
      details: missingLogs.length === 0 
        ? 'All CDE systems logging to SIEM'
        : `${missingLogs.length} systems not sending logs`,
      evidence: loggingSystems,
      remediation: missingLogs.length > 0 
        ? `Configure logging for: ${missingLogs.map(s => s.name).join(', ')}`
        : undefined,
    };
  }
  
  private async checkDefaultCredentials(): Promise<ComplianceCheckResult> {
    // Check common default credential patterns
    const defaultCreds = [
      { service: 'postgres', user: 'postgres', pass: 'postgres' },
      { service: 'redis', user: '', pass: '' },
      { service: 'admin', user: 'admin', pass: 'admin' },
    ];
    
    const issues: string[] = [];
    
    for (const cred of defaultCreds) {
      if (await this.tryCredential(cred)) {
        issues.push(`${cred.service} using default credentials`);
      }
    }
    
    return {
      checkId: 'PCI-2.1',
      requirement: 'Remove vendor-supplied defaults',
      status: issues.length === 0 ? 'pass' : 'fail',
      details: issues.length === 0 
        ? 'No default credentials found'
        : `Found ${issues.length} default credential issues`,
      evidence: issues,
      remediation: issues.length > 0 
        ? 'Change all default credentials immediately'
        : undefined,
    };
  }
  
  private async checkSecurityPatches(): Promise<ComplianceCheckResult> {
    // Query patch management system for missing critical patches
    const missingPatches = await this.patchManager.getCriticalMissing({
      maxAgeDays: 30,  // PCI requires critical patches within 30 days
      systems: await this.cdeInventory.getSystems(),
    });
    
    return {
      checkId: 'PCI-6.3.3',
      requirement: 'Install critical patches within 30 days',
      status: missingPatches.length === 0 ? 'pass' : 'fail',
      details: missingPatches.length === 0
        ? 'All critical patches applied'
        : `${missingPatches.length} critical patches overdue`,
      evidence: missingPatches.map(p => p.cveId),
      remediation: missingPatches.length > 0
        ? 'Apply patches immediately: ' + missingPatches.map(p => p.cveId).join(', ')
        : undefined,
    };
  }
  
  private async checkInactiveAccounts(): Promise<ComplianceCheckResult> {
    // Find accounts inactive for 90+ days
    const inactiveAccounts = await this.identityProvider.getInactiveUsers({
      inactiveDays: 90,
      scope: 'cde',
    });
    
    return {
      checkId: 'PCI-8.1.4',
      requirement: 'Remove/disable inactive accounts within 90 days',
      status: inactiveAccounts.length === 0 ? 'pass' : 'fail',
      details: inactiveAccounts.length === 0
        ? 'No inactive accounts found'
        : `${inactiveAccounts.length} inactive accounts require review`,
      evidence: inactiveAccounts.map(a => a.username),
      remediation: inactiveAccounts.length > 0
        ? 'Disable or remove inactive accounts'
        : undefined,
    };
  }
}