Encrypting backups makes a lot of sense. Is encrypting an active db a requirement in some enterprise environments?
PCI Requirement 3.4:
Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using any of the following approaches:
- One-way hashes based on strong cryptography, (hash must be of the entire PAN)
- Truncation (hashing cannot be used to replace the truncated segment of PAN)
- Index tokens and pads (pads must be securely stored)
- Strong cryptography with associated key-management processes and procedures.
PCI Requirement 3.5
Document and implement procedures to protect keys used to secure stored cardholder data against disclosure and misuse.
> Section 3 provides the high-level details around encryption. At a minimum, PCI requires the PAN (primary account number) to be rendered unreadable anywhere it is stored, including portable digital media, backup media and logs.