Insufficient data from Andrew Fryer

The place where I page to when my brain is full up of stuff about the Microsoft platform

SQL Injection, still there after all these years

Security is a thankless task, your best work goes unnoticed and if you let down your guard for a minute you can be front page news, like the Daily Telegraph (interestingly on the Guardian web site).  In this case the method of attack is old chestnut, SQL Injection which dates back to 1998.

As a DBA there  isn’t been much you can do to stop this as it is the code in the application run by an authenticated user that is doing the work.  There are lots of tools and advice to help developers write secure code which include the following from Microsoft:

As a DBA you can at least track what’s going on to help mitigate future attacks of this type. In SQL Server 2008 Enterprise edition you can use the audit feature which is  much easier to enable than setting up trace and takes less overhead.  It can also if necessary output to the application or security log as well to to file for later analysis.  For more on audit check this TechNet Article by the SQL Customer Advisory Team (SQLCAT).

This is just one area where database are under threat and so I will continue this theme throughout the week to cover some of the other things you can do to keep your data secure (and possibly your careers as well!).