SQL Injection Attacks and Defense - 2009

410 Chapter 9 • Platform-Level Defenses
Summary
Platform security is an important part of the overall security architecture of any Web
application. You can deploy runtime protection techniques, such as Web server and applicationlevel
plug-ins, without modifying application code to detect, prevent, or mitigate SQL injection.
The best runtime solution will depend on the technologies and platforms that make up
the application environment. You can harden database servers to significantly mitigate the
scope of compromise (i.e., application, server, and/or network compromise) and unauthorized
data access. In addition, you can leverage network architectural changes and a secured Web
infrastructure configuration to mitigate and lessen the chances of detection.
It is important to remember that platform security is not a substitute for addressing
the real problem: the insecure coding patterns that cause SQL injection in the first place.
A hardened network and application infrastructure combined with runtime monitoring and
tuned prevention provide a formidable defense to thwart the SQL injection vulnerabilities
that may be present in the code. Platform-level security is an important component to the
overall security strategy for both existing and new applications.
Solutions Fast Track
Using Runtime Protection
˛˛ Runtime protection is an effective technique for addressing SQL injection when
code changes are not possible.
˛˛ Web application firewalls can provide effective detection, mitigation, and prevention
of SQL injection when properly tuned.
˛˛ Runtime protection spans multiple layers and tiers, including the network,
Web server, application framework, and database server.
Securing the Database
˛˛ Hardening the database will not stop SQL injection, but can significantly reduce
the impact.
˛˛ Attackers should be sandboxed to application data only. In a locked-down database
server, compromise of other databases and systems on connected networks should
not be possible.
˛˛ Access should be restricted to only required database objects, such as EXECUTE
permissions on stored procedures only. In addition, judicious use of strong
cryptography on sensitive data can prevent unauthorized data access.