Structured Query Language (SQL) Injection and its Background

SQL Injection
Student’s Name
Institution
Course Number and Name
Instructor’s Name
Date
SQL Injection
Introduction
The advancement of technology has brought it with itself numerous cyber risks that threaten the operations of modern companies. Having a comprehensive defense mechanism is an essential practice for modern firms given that the collection and storage of data, some of which may be personal, is part of the business. Given that the data stored by such companies are of value, it can be vulnerable to numerous forms of cyberattacks. It is therefore essential that an organization is not only aware of all the cyber threats it faces but it also puts in place relevant defense mechanisms. One type of cyber threat that an organization can be susceptible to is Structured Query Language (SQL) injection, which is characterized by attackers inserting malicious SQL statements in databases in order to exploit and take advantage of the vulnerabilities that exist in a website (Malwarebytes, n.d.). This paper examines the background of the attack, how an organization can be susceptible to it, and mitigation strategies that can be employed to stop it.
Background of SQL Injection
SQL injection is a type of cyber-attack where hackers enter predefined commands into web forms such as the log-in field and search field on vulnerable websites (Malwarebytes, n.d.). When an SQL injection becomes successful, the attacker can access sensitive data from the website, update, insert, or delete database data, perform administrative tasks, and even recover the content of files present in a database management system (Nicholson, 2017). SQL injection has quite an extensive history. It is important to recognize first that while the SQL programming language was created in the early 1970s, it is still being used presently in the management of databases online. While SQL came to light in the 1970s, SQL injection attack was first documented by a hacker and cyber security expert, Jeff Forristal, in 1998, in an article in a digital periodical called Phrack (Malwarebytes, n.d.). In the article, Forristal described how a person with basic coding skills can set up malicious commands into SQL commands that are legitimate and retrieve information from the database of a vulnerable website. When the author informed Microsoft how the vulnerability could affect the company’s product, the company did not see it as a problem. As pointed out by Nicholson (2017), the article by Forristal became the starting point for research surrounding SQL injection. With Microsoft denying the vulnerability of its product, writing under the name Rainforest Puppy, Forristal sought to prove the company wrong and demonstrated in an article how he circumvented barriers to SQL injection. As noted by Nicholson (2017), the article by Rainforest Puppy was the first to demonstrate a successful attack through SQL injection and it showed that it was quite easy to bypass the security features of databases.
While SQL injection attack came to light in 1998, it still poses a major threat to organizations and many companies in the recent past have been its victims. As reported by Cox (2015), SQL injection was used in 2015 to attack TalkTalk and gain access to the pe...