From my experience, regulated industries use a combination of the following techniques : - Dont use passwords for databases. Make services use integrated authe

From my experience, regulated industries use a combination of the following techniques : - Dont use passwords for databases. Make services use integrated authentication to interact with the database. - Developers / operations dont have read / write access to production tables. It can be obtained momentarily for ad-hocs operations. - When the database needs to be modified, the script goes through a change management system and it is executed at a planned time, ideally by another person. - If you use private keys, ex for symmetric encryption, don't store them with the data it's used to encrypt. - Use database level encryption on sensitive data to prevent anyone with read access to snoop on PII. - Enable database level audit and change tracking. - Developers don't push their own changes to production.