Yes ... that's about the simplest form. If you want to get really fancy you can use a further cloistered machine with hardware encryption and a key that's only

Yes ... that's about the simplest form. If you want to get really fancy you can use a further cloistered machine with hardware encryption and a key that's only inserted when the machine is booted but that's pretty excessive. The main thing is that you don't want your database server's port exposed to the Internet and you don't want your database on your web servers (the most likely part of your infrastructure to be compromised).