Database Protection System For The Security Of The Database And Web Application

SQL Injection – an input validation attack specific to database applications where SQL code is inserted into application queries to manipulate the database.

If we turn the clock backwards about 10 or 15 years, we find that people do not care much for the security of the web due to the lack of trying to exploit web applications for personal interests. But more recently, the issues related to the security of the Web began to grow, but unfortunately, there are many Web applications that have been developed, but these applications are started without any design for security.

The majority of web application attacks occur through three avenues Cross-site scripting (XSS), SQL injection attacks and Phishing.

Abstract - SQL injection is a technique where malicious users can inject SQL commands into an SQL statement through user input. It is among the most common application layer attack techniques used normally. SQL Injection is among topmost attack mechanisms used by malicious user to steal data from organizations. This is one of the types of attack which takes advantage of improper coding to inject SQL commands into form through user input to allow them to gain access to the data.

Our IT department has to place a firewall on the web application such as Mod Security that is free and open sourced this is available for Apache, Microsoft and nginx web servers. This web application firewall will defend the users by catching the SQL injection before they can attack. I will recommend that the IT staff to apply any software patches on the database, so we would minimize the vulnerabilities on the server. Furthermore, they should use SQL variable binding with statements on the web application instead of constructing full SQL queries. Also, minimize the error messages when the student user is logging in with their credentials and get the password wrong then is displays that the password was wrong, but not the username. Above all, this plan will help the Aim Higher college prevent any SQL injection attacks in the future, so the users will feel safe in our when exchanging private data with our school information

Firstly I will like to talk about the Microsoft SQL Server. According to Vincent (July 2010) Microsoft SQL Server is a relational database managing software developed by Microsoft. Since many years back (1989) the SQL Server has been experiencing a lot attacks. For example

The first area to control is user authorization, this refers to granting rights or privileges to an end user or a group of users to legitimately access the database and its objects (data). When a user tries to log into the database, SQL tells the system who is trying to access the system and authenticates them if they have proper access. Each object in the database also has its own security class and rules associated with them. This helps individual sets of data remain hidden from certain users regardless of their access to the server and database. User account passwords should be stored in an encrypted format that can be located in the server, database, or an external network

Some web developers use “blacklist” of words and characters, but some words like delete and semicolons should be allowed in many types of input. I think the best way to prevent is combination of protection. I would recommend to use SQL parameters. SQL parameters are values that are added to an SQL query at execution time, in a controlled manner. I would use patches and updates in exploited database and application as soon as possible. The firewall should be in place to help to filter out malicious data. Adding new rules regarding SQL injections to firewall will help to detect and patch. Also, use appropriate privileges and keep password hash and encrypted. Password should be change regularly, which overlook most of the time. In addition, I would not display a lot information about database architecture from error messages and use the “Remote Only” custom Errors mode, so external hacker will not get any additional information. After all, SQL injection is most popular tool for hackers to obtain and manipulate data, because it is easy to use. However, combination of the protections can keep secure and monitor

However, another important security aspect of the cloud computing is SQL injection attacks (SQLIA) which needs to be improved. According to the cloud hosting company Firehost, SQLIA have increased from 18% to 20% from the first quarter to the second quarter of 2013. Computer hackers try to insert malicious codes to get unauthorized access to database systems which will eventually give access to steal the contents of the databases. The cloud network should implement and improve on parameterized SQL queries, input validation, and stored procedures which will secure the system from exploiting the database. To retrieve, alter, or insert any data from the database system, SQL queries are required. SQL queries should separate the logic from data which

Data systems such as the web application and data servers are faced by a number of threats, some of these threats are discussed below:

With advances in technology constantly happening, it can be hard to keep up with all of the latest trends. If organizations cannot keep up with the latest trends, it can lead to flaws in their security. Any flaws in security can have a detrimental effect on an organization’s database. Almost every organization has some sort of database, whether it is for maintaining customers, inventory, or vital information.

Safety of information is the most valuable asset in any organization particular those who provide financial service to others. Threats can come from a variety of sources such as human threats, natural disasters and technical threats. By identifying the potential threats to the network, security measure can be taken to combat these threats, eliminate them or reduce the likelihood and impact if they should occur.

IJCSNS International Journal of Computer Science and Network Security, VOL.11 No.1, January 2011 197 An Approach to Detect and Prevent SQL Injection Attacks in Database Using Web Service IndraniBalasundaram 1 Dr. E. Ramaraj2 1 Lecturer, Department of Computer Science, Madurai Kamaraj University, Madurai 2 Director of Computer Centre Alagappa University, Karaikudi. Abstract SQL injection is an attack methodology that targets the data residing in a database through the firewall that shields it. The attack takes advantage of poor input validation in code and website administration.

Our plan will include network security, which will protect the network. It will protect the usability, reliability, integrity, and safety of the network and data. Plan will also include host based security system. These will include applications to monitor detect, and counterattack against the hosts networks and systems. There are many types of security methods can be used to secure a network.

1. Damage the integrity of information: attackers may damage the information integrity in different aspects: changing the order and form of information. Deleting the information and inserting some other content.