Study: Companies Vulnerable to SQL Injection Attacks

Independent security research firm Ponemon Institute has released the details of a new study that found 65 percent of respondents had experienced SQL injection attacks that had successfully evaded perimeter defenses within the past 12 months. The news is especially alarming givien the recent discovery of the Heartbleed OpenSSL bug, which is estimated to have affected more than two-thirds of the Internet.

The Ponemon Institute found that SQL injection attacks were prevalent among the 595 U.S. IT security practitioners surveyed for the study. Each attack took organizations nearly 140 days on average to discover and an additional 68 days to remediate. The study, which was conducted in conjunction with database security firm DB Networks, shows that a majority of organizations are wholly unprepared for a cyberattack.

“We believe this is the first study to survey the risks and remedies regarding SQL injection attacks, and the results are very revealing,” said Larry Ponemon, founder and chairman of the Ponemon Institute, in a prepared statement. “It is commonly accepted that organizations believe they struggle with SQL injection vulnerabilities, and almost half of the respondents said the SQL injection threat facing their organization is very significant, but this study examines much deeper issues. For example, only a third of those surveyed (34 percent) agreed or strongly agreed that their organization presently had the technology or tools to quickly detect SQL injection attacks. And more than half (52 percent) of respondents indicated that they don’t test or validate any third-party software to ensure it’s not vulnerable to SQL injection.”

Structured query language, or SQL, injections commonly exploit a security flaw in an application’s software to attack websites or databases. While SQL injection attacks are nothing new, what is shocking is the frequency with which they occur. In 2012, Imperva conducted a similar study that found web applications on European servers are hit with an average of four attacks a month, with retailers receiving the most attacks of any industry.

“It’s well-known that SQL injection attacks are rampant and have proven to be devastating to organization of all sizes. This study delves into both the scope and many of the root causes of SQL injection breaches,” said Brett Helm, chairman and CEO of DB Networks. “Signature-based perimeter defenses simply cannot keep up with the sophistication of today’s complex SQL injection attacks. It’s interesting that this study indicates security professionals are now recognizing this and overwhelmingly had a favorable opinion of applying behavioral analysis technologies to address the SQL injection threat.”

The report also found that 56 percent of the respondents said pervasive BYOD trends in the IT world have made it more difficult to pinpoint the origin of these attacks, while 52 percent also said they don’t bother to validate third-party applications to ensure protection from these kinds of attacks. And more than half of respondents said they are working to replace their current signature-based IT security systems with more efficient behavioral analysis-based systems, which could be good news for VARs with a security heavy portfolio.

While BYOD policies certainly have made it much easier for employees to get work done anytime and anywhere, there are problems due to the inherently open nature of BYOD networks. And as anyone in the channel knows by now, if there is a way to exploit a system, there will always be someone there to take advantage of the situation.