Need Suggestions With New Site
I am currently trying to decide how to setup my website and I am stuck between making the site easy to manage and making it as secure as possible. From what I have read in my web development books is to keep any sensitive information that is entered by users who sign up to my site (credit card, etc.) away from the public web server and onto a private station (non web server). I was thinking about creating my SSL membership signup as usual but when the user submits the information, the sensitive information gets compiled into a PGP (possibly GnuPGP) encrypted e-mail maybe using like 1024-bit encryption or whatever and then sending that e-mail via a secure layer connection to the private station to be processed (into QuickBooks maybe) and authenticated by our staff. The only thing about this is that it may be frustrating because it will not be a very simple and easily manageable approach as it requires dealing with many requests personally I would think.
What do you other folks think about this method? If you know of something better that could implement easy to manage with highest security possible please share. I am open to ideas for more research.
My current setup is Apache, PHP, MySQL, SSL. My site is basically a services sites and are subscribed to memberships in which they are charged monthly. We only accept credit cards for now though we may allow additional payment methods in the future. If you need further clarification just ask.
Thanks all.