Note: this is a cross post from my question on SO. Feel free to keep the one in the more relevant location and close the other.
We have a rails app which will be deployed on torquebox/jboss. (This in a way does not matter too much for the question as it would apply to any Web app, not just a Rails one.) It retrieves certain app-level sensitive configuration variables from the environment, such as
ENV['DATABASE_URL'] (which includes the auth credentials so it looks like
ENV['PEPPER'] when it starts up, to do essential processes like connecting to the database. The variables are not encrypted at this time. In essence the use of the environment to hold these variables follows the 12-factor app Heroku playbook.
There are in a way two questions here:
Is it PCI compliant to store such variables unencrypted in the environment at all?
The environment variables need not come from the OS shell (the normal place where they would live). They could equally be set in jboss or torquebox if that would be any more secure eg against an attack like shellshock. Which ENV variable store should be used?
I am aware that there are alternatives, such as encrypting with DPAPI (but that is Windows only), using Java key stores (but that is limited to client certificate based authentication AFAIK, not plain old passwords), but they are more of a pain to use, and the use of environment variables seems so widely recommended even by PaaS providers themselves that I am wondering if we actually need to go the extra mile.