210k views
5 votes
An SQL database is no longer accessible online due to a recent security breach. An investigation reveals that unauthorized access to the database was possible due to an SQL injection vulnerability.

To prevent this type of breach in the future, which of the following security controls should be put in place before bringing the database back online? (Choose two.)

A. Secure storage policies
B. Browser security updates
C. Input validation
D. Web application firewall
E. Secure coding standards
F. Database activity monitoring

User Ethouris
by
8.7k points

1 Answer

4 votes

Final answer:

To prevent SQL injection vulnerabilities, it is recommended to implement input validation and a web application firewall before bringing an SQL database back online. Additionally, employing secure coding standards and database activity monitoring can enhance the overall security posture.

Step-by-step explanation:

To prevent future breaches due to an SQL injection vulnerability, it is essential to implement the right security controls when bringing the SQL database back online. The key security controls that should be put in place are:

  • Input validation: This involves ensuring that all input received from users or external systems is validated before processing. It minimizes the chances of malicious SQL code being injected into the database, thus preventing SQL injection attacks.
  • Web application firewall (WAF): A WAF can help detect and block SQL injection attacks and other threats by filtering out malicious web traffic before it reaches the web application or database.

Additionally, implementing secure coding standards can provide long-term protection against SQL injection and other vulnerabilities. This includes using prepared statements and parameterized queries to interact with the SQL database securely.

Monitoring database activity using tools designed for database activity monitoring (DAM) provides insight into unauthorized or suspicious activities, enabling quick response to potential security incidents. While not directly preventing SQL injection, it complements the security strategy by providing early detection of anomalies.

User Joao Figueiredo
by
7.6k points