> <i>Chief among them is the fact that none of the 354 database tables containing social security numbers were encrypted. Using strong cryptography to protect such "at rest" PII has long been considered a best practice in government and corporate data security.</i><p>Really? Although I don't work in that field ('government and corporate data security', or generally anything where we have to deal with SSN's and such) -- that doesn't make a lot of sense to me. Encrypted database tables? I've never even heard of that. Can someone who does work in this domain tell us if this makes any sense at all, or translate this into what it actually means technically?<p>(On the other hand, the fact that 354 database tables existed with SSN's is a red flag in the first place, clearly. There's plenty of clear problems with what was described, I'm just curious about this alleged 'encrypted database table best practice')