Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are in the process of setting up a PCI compliant server (with Firehost's help). We are using MongoDB as our primary database. I am having some concerns about the encryption, though. Are there any advantages of Field-level data encryption over Disk encryption (maybe with something like truecrypt)? Which would be the preferred choice for a PCI compliant MongoDB database server?

share|improve this question

Field level encryption is important in case of SQL injections or your database server getting hacked. Assuming application and database are on different servers, the data will still be encrypted by application server.

Full-disk encryption would help in case of hardware theft as otherwise encrypted server will not be protected in case it is broken into as your encrypted partitions will be mounted so you database (MongoDB) can access it.

From this I would say that Field-level data encryption should be your focus.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.