Implementing Security In Databases (to Reduce Loss Due To Theft, Etc.)

What is the best way to implement security in a SQL database to reduce the loss in the situation when a database is stolen?

In my tests for disaster recovery while catering for security I am using

create master key with password, create certificate and then symmetric key using certificate.

This does require the master database password to be known if restoring on a second machine before anything can be recovered. But is there anyway to secure this even more?

If things like passwords and stuff needs to be specified then it would require an application change as well, at the moment the changes are made to be seamless for applications (inserts/updates done via triggers until the app is made aware of the schema changes) so that is viable but not for the first phase implementation.

Basically looking for an idea of is this is considered a good enough start, and what possible changes can be made to ensure data is even more secure later (algorithm used is AES128 and AES256), data will be emails, creditcard details (so MasterCard/VISA compliancy needs to be adhered to as well), etc.

Thanks