PCI compliance requires annual rotation of keys. The definition of "rotation of keys" that I keep coming across is decrypting your data, then re-encrypting with a new key. Really? Everyone out there is decrypting / encrypting all their encrypted data every year?
Currently, I've got 16 databases across 3 servers, with multiple tables in each database - and this will just continue to grow. Doing this manually introduces a huge opportunity for mistake, rendering my data unreadable. Yes, I could write something to do this...but is this really what everyone is doing?
So the question is are you handling this manually or can you recommend an affordable (subjective, I know) 3rd party tool?
I've seen some suggestions out there about "changing" the keys higher up in the hierarchy. We use the oft recommended hierarchy of Database Master Key encrypting a Certificate, which encrypts a Symmetric Key, which encrypts the data.
First, this doesn't seem to meet the definition of "rotating the keys". Second, even if I change the DMK or the Cert, this doesn't prevent the data from being decrypted with the same Symmetric Key that presumably bad guy has stolen / cracked.