I'm currently taking over a service and while looking through the DB, I noticed that we encrypt some of our data using a function in the DB where the encryption key is hardcoded in the DB function.
As far as I know, this is not a good practice and makes the encryption pretty much redundant because the whole point of encrypting DB data is to protect the data should the DB leak to unauthorised parties. But in this case, if the DB is compromised, so is the encryption key and the encryption becomes meaningless.
Am I correct here or am I missing something?
Also, if it's a wrong practice, should I change the encryption/decryption process so that it happens on the server app level?