Depending on a hacker’s goal, an application’s data may be his or her primary target. In general, the back end of the application is where all the personal, sensitive, and often desirable data is stored—from credit card numbers to medical information. Most Web application use some kind of data storage. This chapter describes how easy it is to compromise a database and demonstrates the problems that plague many current Web applications. However, after you read the solutions in this chapter, your own Web application will not have to be one of them.
To secure your database, we will take a bottom-up approach by first discussing how to secure drivers that an application uses to communicate with a database. Next, we’ll examine how to secure the database as a whole by tightening the default installation and using policies such as least privileges. We will cover firewalls and other means to protect your application as well as monitor intrusion attempts. Finally, we’ll have an in-depth discussion of how to write secure code that safely connects to your database. This discussion will include specific details of the ways attackers crack systems using SQL injections and the multiple layers of security you can use to protect your application.
The threats discussed in this chapter are:
Data compromise An attacker gains access to read or modify private data.
Database compromise An attacker gains access to modify the database structure itself.
SQL injection Manipulating user input to construct SQL statements that execute on the database server.
Buffer overflows Overwriting a buffer by sending more data than a buffer can handle, resulting in the application crashing or executing code of the attacker’s choice.
Privilege escalation Accessing system resources or executing code within the security context of a privileged user account.
Information leakage Revealing sensitive information or private user data.