Column-Level Database Encryption
PCIComplianceHubLast updated
Encrypting the contents of a particular database column, such as the one holding PAN, rather than the whole database or the disk underneath it. The database still serves every other column in the clear, and the encrypted column is unreadable without the key even to someone with a database login.
Applies to. Entities that store PAN in a database and choose encryption as their 3.5.1 method. The standard also names file-level and field-level encryption as the same family.
Example. The card_number column is encrypted with a data-encrypting key held in a key management system; the customer_name column next to it is not. A report user querying the table sees names and ciphertext.
Limits. This is the family of methods 3.5.1.2 contrasts with disk-level and partition-level encryption. Disk encryption protects a stolen disk; it protects nothing from an authenticated user or a compromised application, because the operating system decrypts transparently. Column-level encryption protects against that, which is why disk encryption alone cannot satisfy 3.5.1 on non-removable media and must be paired with another method, while column-level can stand alone. The key, not the column, is then what has to be protected (3.6, 3.7).