The Cyber Security Risks Report

SQL Injection – an input validation attack specific to database applications where SQL code is inserted into application queries to manipulate the database.

Attack: An assault on the system security that is derived from an intelligent threat. An attack is any action that violated security.

Since the onset of the first packet switching event that many believe to be beginning of the internet, no other technology besides the printing press has ever transformed the ability to deliver information. Although the internet is used by a large percentage of the civilized world, few Americans realize how vital cyberspace is to our national infrastructure. Today, we are faced with even more threats although it has been a recognized problem since 2009, when President Barrack Obama said “The cyber threat is one of the most serious economic and national security challenges we face as a nation. It’s also clear that we’re not as prepared as we should be, as a government or as a country (Obama, 2009).” Every industry that operates in the United States is dependent on the internet for some aspect of their business. Commerce, transportation, financial institutions, military, as well as industrial control systems are all interconnected. This interconnectedness has created vulnerabilities within their infrastructure that have increasingly become targets of terrorists, script kiddies, foreign governments and hackers of all types.

Introduction: - for my research project, I would like to explore about the cyber security measures. Cybersecurity covers the fundamental concepts underlying the construction of secure systems from the hardware to the software to the human computer interface, with the use of cryptography to secure interactions. These concepts are easily augmented with hands-on exercises involving relevant tools and techniques. We have different types of computer related crimes, cybercrimes, computer related offenses, federal approaches defenses. The information resources management has the technical matters for which IT are widely known. Cyber resources and cyber power as well as cyber security. We have spent a lot of time talking about many different high level critical infrastructure protection concepts we have general rule stayed away from cyber security explaining the ins and out of how the NIPP and NRF work together to ensure that we can live our daily live in relative comfort.

As I stated before there are many different types of security vulnerabilities out there which can affect the integrity, availability and confidentiality of a resource. So the question still remains what exactly are these types of vulnerabilities? Especially since they range from software, hardware, networks and the people that use them. Firstly I will discuss the software vulnerabilities, more specifically in terms of web applications. This is because more than half of the current computer security threats and vulnerabilities today affect web applications and that number is ever increasing. (Fonseca, Seixas, Vieira, Madeira, 2014). When considering the programming language used to develop web applications you have PHP which is considered a weak language, on the other hand you have Java, C# and Visual Basic which are considered strong languages. It is important to note that the language used to develop the web applications is very important because although the different programming languages are similar overall, each one has different rules of how data is stored, retrieved, the execution methods, tables and so on. For example when I say how data is stored and retrieve, I am basically regarding to data types and data structures and how the programming language that is being used maps their values into type fields like strings for names, Int for numbers, or even Boolean for true and false statements.

The majority of web application attacks occur through three avenues Cross-site scripting (XSS), SQL injection attacks and Phishing.

The common vulnerabilities in a CMS are unpatched or poorly patched plug-ins rather than the core system. Poor patch management represents a large

Firstly I will like to talk about the Microsoft SQL Server. According to Vincent (July 2010) Microsoft SQL Server is a relational database managing software developed by Microsoft. Since many years back (1989) the SQL Server has been experiencing a lot attacks. For example

SQL means Structured Query Language: almost all databases provide an SQL interface. It's a standardised and restricted set of keywords which can be used to query, create and update databases.

“Branch Locator” page is vulnerable to SQL injection attacks. This is a serious vulnerability which involves inserting malicious SQL statements into an input field for execution. By appending SQL statements to the URL of the Branch Locator page, information about the structure of the underlying database was collected. This information was then used to generate further malicious statements. The list of database objects, tables and columns were returned. The

Cyber security breaches have shown a spike in 2015, with large-scale compromises on companies like Target, Sony and Home Depot. There is a strong demand to deploy more robust cyber security tools to prevent future attacks. FireEye, a cyber-security firm, has started to fill the void and is reaping the rewards.

Web applications are nowadays serving as a company’s public face to the internet. This has created the need to identify threats and attacks directed to data servers and web applications. Hackers exploit vulnerabilities in input validation and authentication affecting the web application in order to gain illegal access and disclose sensitive data or manipulate it to their benefits.

SQL Injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker) [13]. SQL Injection must exploit a security vulnerability in an application's software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL Injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database. SQL Injection vulnerability can occur in all languages, including high-level, strongly typed languages such as PHP and Python.

SQL injection or SQLi is a common technique used to hack into a website. Using this below code can help you prevent or stop the hacking. Shown below is a sequence of code snippets, which relate to preventing SQL injection with its use. It is a common technique that hacks into the site to see the contents of it, use of the code snippet is necessary when you are in the beginning process avoiding the hack.

SQL Injection is a web application security vulnerability that an attacker can submit a database SQL command which is executed by web applications in order to expose the back-end database. SQL injection have been described as one of the most critical threats for Web applications as they are vulnerable to allow an attacker to gain complete access to the underlying database as well as organizations being breached by SQL injection attacks that slip through the firewall over ports such as port 80 (HTTP) or 443 (SSL) to internal networks and vulnerable databases. These databases often contain sensitive user information which can result in security violations such as loss of confidential information, identify theft