SQL Injection Attack Prevention - SQL Server Security Audit
How to secure SQL Server databases from SQL injection
There are a few ways to protect your database against these kinds of attacks. First
we need to lock down the database security using database security best practices.
This involves setting up the database security with the lowest set of permissions
possible. It also includes not using any table-level access to the tables.
All access to the tables should be done through stored procedures, and those stored
procedures should not include any dynamic SQL
By removing access to the table objects you greatly reduce the surface that can
be attacked. However, this is not the only thing that must be done. The stored procedures
still present an attack vector that can be exploited. While this attack vector takes
more time to exploit, it is possible to exploit the database using your stored procedures
-- they're designed to insert, update and delete data from your database. A clever
hacker can use your own stored procedures against you.
This is where your application developers need to work with you to ensure the code
being executed against the database is secure. Without securing the application
layer against SQL injection attacks, all bets are off. The data, as it comes into
the database, is basically impossible to validate within the database. It needs
to be validated at the application layer.
Without properly securing your website's front-end application and back-end database
fully, you leave yourself wide open to SQL Injection attacks. These attacks
can be as unintrusive as seeing if it's possible and as intrusive as sending all
your customer data to the attacker. Destruction could reach levels of all data being
deleted or your site and application being used to distribute a virus to unsuspecting
customers. In the short term, this would infect your customers' computer; in the
long term, your company could be added to an unsafe browsing list.
MCC's SQL Server DBA's are capable of reviewing code and SQL Server's configuration
to assess for SQL Injection and other vulnerabilities. Remedies that we can
advise or perform include:
- Audit of source code and SQL Server
- Rewriting .NET application code and SQL Server Objects that previously dynamically
built SQL executable strings, into using parameterized SQL Server Stored Procedures
- Locking down SQL Server via Surface Area Configuration
- Limiting the access of SQL Server service accounts
- Setting permissions within SQL Server
The SQL Server consultants at Miles Consulting Corp are ready to assist you in securing
your SQL Server database from SQL Injection and other attacks.
|
|
|