We have a database hosted by SQL Azure, and accessed via a REST service that itself is accessible only via https. We wonder though whether we should encrypt all or part of the database in case it was to be accessed by a hacker (we are not a prime target, but students will know of the system). The Azure database is set up with firewall rules to allow only a few systems access.
Would encrypting add anything meaningful? Would it just be security theatre? Or is database encryption best-practice regardless.