Threat Model / Scenario
I am concerned with a Thread Model, where certain sensitive data is stored in a database. Its not as sensitive as Credit Card information or passwords, but telephone numbers, email addresses and the like. Lets assume I fear a database leak, where an attacker somehow can read more information than allowed to him from the database. What can one as administrator do against that?
What I considered
Lets assume that we keep the software which organizes and dispenses the data up to date and patch every vulnerability as fast as a patch is available.
I considered that we may encrypt the sensitive data with for example the users password. (Not the stored hash in the database). The consensus however is that its not good practice to save encrypted data in a database. Furthermore the data would be lost if a user forgets her password.
I also considered encrypting all data with a key that is stored in the OS environment, but this would probably not help against leaks in the form of e.g. SQL-Injections, unless one keeps the data encrypted until a user logs in and then decrypts only the users portion of the data until she logs out again.
So my question is, what would be a sensible way to go about in the aforementioned scenario?