Most people have a general understanding that cybercrime is a very real problem. Also, a threat to just about anyone who has an Internet connection and data they’d like to protect. If your company has a relational database, you should know that you’re a potential target of hackers who would love to take a look at the information you have to offer. Companies like PBS, Sony Pictures, LinkedIn, and Yahoo! have all suffered from these types of attacks. In fact, the same can even be said for the CIA. While you may have heard that in the news, what you might not know is that the same type of attack was used each time: a SQL injection.
What Is a SQL Injection Attack?
Given how valuable databases are and how common SQL is as a programming language, SQL injection attacks have become progressively more common amongst hackers.
Thanks to improper coding, a savvy hacker can identify a weakness where they can “inject†SQL commands of their own. If they do this correctly, the database is now wide open and so is something like your website. Far from taking valuable information, many mischievous hackers simply want to use your site to make your company look foolish in front of the whole world.
While that’s pretty scary, it’s not all bad news. There are actually some very easy provisions you can take to keep the worst from occurring. Keep in mind that no defense is going to be guaranteed in the ever-evolving world of cybercrime, but the below are definitely going to challenge a hacker.
Sanitize All Data Provided
If your website has data forms, you may not look at them as a serious threat to your relational database’s security. After all, they’re just forms for collecting things like email address and phone numbers, right?
To you and me, you’re correct. To someone who wants to gain access to your database, they’re potential locks to pick. This is why you have to be sure that these forms only accept specific characters. No phone number is going to have a letter in it, for example, so simply don’t allow people to type one in. It’s not enough to just instruct users to put in their number, don’t let letters or other characters even appear.
This is one method a hacker could use for SQL injections. They could enter a code that your website then goes on to process thereby inserting it and allowing the hacker to wreak havoc.
Take this a step further by supplying prepared statements or some other type of stored procedure to greatly limit a would-be hacker’s ability to slip any code in a data form.
Use a Firewall
Everyone should be using a web application firewall for their website. Not doing so opens you up to all kinds of threats, for one thing, plus there is a number that you can get for free these days no matter what kind of web server you use.
You want to pick a version that is constantly being updated though. As we mentioned earlier, cybercrime is always evolving; you want a firewall that can keep up.
Limit Exposure to Possible Breaches
No matter what you do, it’s possible someone is going to figure out a way to pull off their SQL injection and breach your website. That being said, you can still limit your exposure to a problem by limiting database privileges.
For example, your login page’s code should query your company’s database using an account that is only able to access the relevant table of credentials. This way, even if someone breaks through, they’ll only get so far.
ServerPronto offers the best affordable and secure hosting service in all dedicated server packages.
Source:
How to Prevent SQL Injection Attacks
Photo cred: Flickr /Â cyberhades
Comments are closed.