CWE-311 and CWE-312 describe the same failure at two layers: storing sensitive data without encryption (CWE-311) and storing passwords or credentials in a recoverable format (CWE-312). When neither TDE nor column-level encryption is present, every backup file, DB replica, and read replica contains plaintext cardholder data. PCI-DSS 4.0 Req-3.4 requires protection of stored cardholder data; NIST SC-28 requires protecting the confidentiality of data at rest. A breach that dumps the database — via SQL injection, misconfigured IAM, or insider access — becomes a full cardholder data exposure with no additional attacker steps. OWASP 2021 A02 (Cryptographic Failures) specifically calls out missing database encryption as a root cause.
High because absence of TDE or column encryption means any database read path — including replicas, snapshots, and developer copies — exposes sensitive data without additional exploitation steps.
Enable TDE at the cloud provider level first (it covers every table automatically), then add application-level column encryption for the highest-sensitivity fields. In Prisma, annotate encrypted columns so they're never queried or returned raw:
// prisma/schema.prisma — document encryption expectations in comments
model Account {
id String @id @default(cuid())
// Encrypted with AES-256-GCM before insert; decrypted on read in AccountService
cardToken String @db.Text
// Encrypted with AES-256-GCM; never selected in list queries
ssn String? @db.Text
balance Decimal @db.Decimal(15, 2)
}
For PostgreSQL, enable encryption at rest in AWS RDS by checking "Enable encryption" when creating the instance, or use pgcrypto for column-level encryption on an existing unencrypted instance.
finserv-encryption.data-at-rest.tde-or-column-encryptionhigh"0 of 3 sensitive tables have encryption — no TDE, no column-level encryption in application code"// Prisma example
model Account {
id String @id @default(cuid())
cardNumber String @db.VarChar(255) // Application-encrypted before insert
balance Decimal @db.Decimal(15, 2) // Application-encrypted before insert
}