Content area
Full text
ABSTRACT
One of the risks to a company operating a public-facing website with a Structure Query Language (SQL) database is an attacker exploiting the SQL injection vulnerability. An attacker can cause an SQL database to perform actions that the developer did not intend like revealing, modifying, or deleting sensitive data. This can cause a loss of confidentiality, integrity, and availability of information in a company's database, and it can lead to severe costs of up to $196,000 per successful injection attack (NTT Group, 2014). This paper discusses the history of the SQL injection vulnerability, focusing on:
* How an attacker can exploit the SQL injection vulnerability
* When the SQL injection attack first appeared
* How the attack has changed over the years
* Current techniques to defend adequately against the attack
The SQL injection vulnerability has been known for over seventeen (17) years, and the countermeasures are relatively simple compared to countermeasures for other threats like malware and viruses. The focus on security-minded programming can help prevent a successful SQL injection attack and avoid loss of competitive edge, regulatory fines and loss of reputation among an organization's customers.
Keywords: SQL, SQL Injection, Cybercrime, Intrusion, Database
I INTRODUCTION
The Internet brings humans closer together than ever before, and in order to take advantage of the increased connectivity to customers, many organizations maintain a link to the Internet. However, with that link, organizations take on many risks because of the increased attack surface, but there are ways to mitigate those risks to an acceptable level with administrative, physical, and technical controls. Ultimately, it is the business leader's or authorizing officials' responsibility to decide whether the benefits outweigh the potential negative effects of implementing a technology, but information security professionals can add more confidence behind that decision by having a thorough understanding of the threats and vulnerabilities to information systems (NIST, 2010).
One of the risks from a web server connected to the Internet is an attacker exploiting an SQL injection vulnerability on an organization's website. In fact, the Open Web Application Security Project (OWASP) consistently lists injection as the top website vulnerability while stating that it is "EXTREMELY simple" to prevent (OWASP, 2013, 2016). A vulnerability that is simple to fix yet continues to plague...