Depends on the use case :) If you don't need to decrypt the data on the same system, you could always use asymmetric encrpytion, so encrypt with the "public" k

Depends on the use case :) If you don't need to decrypt the data on the same system, you could always use asymmetric encrpytion, so encrypt with the "public" key and then keep the private key elsewhere. If you require to be able to decrypt on the system in question then you need a key somewhere, so secure storage of the key is very important. One option, often deployed in banks, is to store the key in a hardware security module (HSM) and then ensure that it's not available outside of that. There's a load of tradeoffs to using HSMs but they can be useful where symmetric encrpytion is needed.