Recently I've been working on some data which, although not directly governed by any infosec laws, is sensitive enough to warrant being encrypted. I'm interested in finding out about best practises with regards to storage of such data, in particular whether encryption is best implemented at the OS / filesystem level or at the database level?
What are the pros and cons of these two approaches in terms of security, scalability, and accessibility, and is either one of these approaches inherently better than the other?
The particular application I'm working on is a webapp, and it should go without saying that the data will need to be transmitted over HTTPS, since storing data in a secure fashion is pointless when it is transmitted over an open connection.