[wkd]

> Encrypt all data at rest in the database

This is funny, I've actually inherited a project where the original developer had this idea, he used the same function to encrypt everything: even the news posts available on the front page were encrypted. The passwords were using the same encryption functions and needless to say not using a one way hash so fully decryptable...

[aeronautic]

Sorry that is not quite what was intended. I've revised the text to say:

If your database supports low cost encryption at rest (like AWS Aurora), then enable that to secure data on disk. Make sure all backups are stored encrypted as well.

i.e. this kind of encryption costs very, very little and give you physical security if you need it.