Securing Networked Databases from SQL Injection attacks

Though SQL Injection has been a common database and attack on web application & vendors of RDBMS (Relational Database Management System) are familiar with these type of attacks, it is still very difficult to be find out and prevent these attacks without disturbing the organization's operations. So, every events in the database has to be checked thoroughly inm detail.
For this, Database Activity Monitoring (DAM) systems can be deployed for finding out any suspicious activities in the RDBMS.
DAM systems provide advanced security platforms that analyze database queries and find out the normal operations and database attacks. This system collects information and provides several forms of advaced analysis that alerts or even the half malicious activities which no other security products provides this level of security.
For deploying DAM, first you'll need to prioritize data or transactions to be protected as it is impractical to monitor each and every database events, so you can follow the three steps provided below,
1. First interview database administrators and application developers because they know where the senstitive data resides and databases that support critical business functions.
2. Secondly, Inspect database contents using data discovery and database crawlers. Some tools of inspection are provided by vendors for searching database content as an add on option which locates sensitive information through meta data and content analysis techniques.
3. Lastly, Observe SQL statements and database transactions. As, most DAM systems are used in monitor-only mode for the first week, fromwhich the organization can develop an understanding of database operations and also have an idea of applications that use the database and format of a typical query. Then, policies can be developed and implemented for detecting misuse of database.
Now, database events have to captured which also has to be specified.
- Like Native audit features collect events but not always gather original SQL queries and cost performance overhead.
- Network collectors collect most of SQL activities though miss some transactions and activity performed by administrators working at the console.
- And, Agents are de facto delployment for security of critical databases. Native auditing for compliance and network monitoring of non-critical databases is common, but used in more special cases.
Then, basic database security should be defined for implementing security policies as DAM works by analyzing database queries and the fundamental features a DAM provides are:
1. Monitoring and discovery,
2. Alerts and reports,
3. Verification of work orders,
4. Catching misuse &
5. SQL capture for auditing.
With the advancing technologies, DAM systems also have advanced features like,
1. SQL injection detection,
2. Blocking & Virtual patching,
3. Identifying specifig application users,
4. Session termination,
5. Behavioral monitoring and insider threat detection.
For advanced features of DAM, advanced policies have to be definedspecific to your environment & you need to define legitimate SQL queries.
For the advanced features, you need to customize policies as the DAM vendors provide templates and tools from which policies can be developed.
Lastly, for deploying DAM, several points should be kept inmind to save time and trouble inthe long run and these include,
1. Separation of duties,
2. Long-term storage and
3. Scalability.

Posted by : D. Bishal
REFERENCE:
- Adrian Lane.