The scenario: Data is sent to an application server and you want to selectively encrypt some data before sending it to a DB server for storage. All servers run some linux distro. This is a relatively high security situation where significant financial losses could be incurred if the data leaked, but at the same time this is not an issue of national security. Also, the servers are in a third-party cloud infrastructure, so HSMs are not an option. Specific regulatory requirements are not necessary, but I suspect the answer to this would satisfy the bulk of requirements.
Assumptions: Data is securely sent to the application server and application users are properly authorized for retrieval of data.
I have been searching for a while to come up with what is the currently accepted "industry best practice" for key management and keep coming across bits and pieces of good advice scattered about. Can someone point me to a resource that already answers this or can we come up with the best "currently accepted answer" to the exact scenario described above?