Re: Protecting database encryption key

[Bill Karwin]

Right; if they have the key, they can read your data easily. You need to make sure they *can't* get that key.

If they have access to the host on which the key is stored, assume they can get the key. Don't let unauthorized people have access to that host, except through carefully controlled -- and tested -- access via your applications.

I'm no expert in software security, I only know a little bit.

I'd suggest reading some good books on data security, if you're responsible for implementing a secure system. Here are some examples:
"Building Secure Software: How to Avoid Security Problems the Right Way" by John Viega
"Software Security : Building Security In" by Gary McGraw
"19 Deadly Sins of Software Security" by Michael Howard

Regards,
Bill K.