New study conducted by the Ponemon Institute reveals that 65% of organizations have been targeted by successful SQL injection attacks in the last year alone – attacks that were able to completely evade any perimeter defenses in place.
“We believe this is the first study to survey the risks and remedies regarding SQL injection attacks, and the results are very revealing,“ said Dr. Larry Ponemon. “It is commonly accepted that organizations believe they struggle with SQL injection vulnerabilities, and almost half of the respondents said the SQL injection threat facing their organization is very significant, but this study examines much deeper issues.”
“The SQL Injection Threat Study“ also found that only about one-third of believe that their organization has the technology or tools available to enable the detection of SQL injection attacks, and 52% of respondents said that their organizations don’t even test or validate third-party software they use to see if it’s vulnerable to SQL injection.
Other findings in the study include:
- Nearly half (46 percent) were familiar with the term “WAF Bypass” 56 percent agreed or strongly agreed that determining the root cause of SQL injection is becoming more difficult because of the trend for employees to use their personally owned mobile devices in the workplace (BYOD)
- 52 percent of respondents indicated that they don’t test or validate any third party software to ensure it’s not vulnerable to SQL injection
- 44 percent utilize professional penetration testers to identify vulnerabilities in their IT systems; but only a third (35 percent) of those penetration tests included testing for SQL injection vulnerabilities
- 88 percent of respondents had a favorable or very favorable opinion of the use of behavioral analysis technology for detecting SQL injection attacks
- 52 percent indicated they either had begun replacing or would be replacing their signature-based IT security systems with behavioral analysis based IT security systems within the next 24 months
- 49 percent said they would be using behavioral analysis based systems specifically for database transaction security
“It’s well known that SQL injection attacks are rampant and have proven to be devastating to organization of all sizes. This study delves into both the scope and many of the root causes of SQL injection breaches,“ said Brett Helm, Chairman and CEO of DB Networks, a sponsor of the study.
“Signature-based perimeter defenses simply cannot keep up with the sophistication of today’s complex SQL injection attacks. It’s interesting that this study indicates security professionals are now recognizing this and overwhelmingly had a favorable opinion of applying behavioral analysis technologies to address the SQL injection threat.“
Read More Here…