I reviewed the National Institute of Standards and Technology’s vulnerability report for the week of December 29, 2008. It’s a good document to receive regularly, if you don’t already receive it. See NIST’s mailing lists and RSS feeds to keep abreast of the latest security vulnerabilities.
Returning to the vulnerability report last week, over two-thirds of the “high” vulnerability scores focused on SQL injection vulnerabilities in various applications. Law firm IT departments most likely have layered defenses working at the network layer, but they should not ignore the application layer where these SQL injection attacks occur.
SQL injection attacks exploit security vulnerabilities in a database at the application layer. They persist when user input is incorrectly filtered or when user input is not “strongly typed” in SQL statements embedded in script language, e.g., PHP or Perl.
This is not the-sky-is-falling post at the end of the universe. Although I do like a cup of tea now and again. But if you run extranets and intranets with back-end databases, it’s high time to put an SQL injection vulnerability assessment on your list of things to do in 2009. And remember, in a competitive marketplace, who you know and what they and you know make rain.