Despite the fact that they’ve been around since the 90s, SQL injection attacks are still making headlines. Well-documented by security organizations like the Open Web Application Security Project (OWASP), SQL injection attacks should be well-known territory to any IT security professional.

WHAT IS AN SQL INJECTION ATTACK?

A SQL injection attack works when an attacker inserts a SQL query, or command, into form fields that have not been properly coded. Forms are used all the time within organizations and on websites to enable legitimate users to submit and retrieve information. When an attacker exploits these forms by inserting commands rather than expected data, the attacker can gain access to the data in the database—including sensitive data—and might be able to modify, perform administrative tasks on, issue additional commands for, and shut down the database.

HOW DO YOU PREVENT AN SQL INJECTION ATTACK?

The defenses against an SQL injection attack are usually implemented at the code level, though administration best practices also play a part:

1. Routinely update and patch all services, servers, and applications
2. Employ well-tested and well-implemented website code that doesn’t allow unexpected SQL commands
3. Implement prepared statements with parameterized queries
4. Build SQL statements using standard stored procedure programming constructs
5. Use whitelist input validation where applicable in SQL queries
6. Limit the privileges assigned to every database account in your environment to the least privilege necessary for roles to accomplish their tasks

PURSUE STRONGER SECURITY

The long life and common use of SQL injection attacks highlight the complexity sometimes involved in protecting against these attacks. For organizations who want to outsource security concerns and for those who want to bolster their existing security support, Security Pursuit offers its Cyber Alliance Program (CAP). With a team of cybersecurity experts, you can affordably and (on an as-needed basis) ensure your organization is secure from SQL injections and other attacks.