Security Development Lifecycle: SQL Injection Attacks

| 0 comments

In an earlier post titled Security Development Lifecycle: Introduction I begun introducing what the Security Development Lifecycle (SDL) represents and as I continue this series I will focus on the SDL model that Microsoft has so graciously provided to the community. Introduction In part 2 of this series I want to focus of SQL Injection and for those of you just getting started it is important to understand what a SQL Injection attack is. Here is what Microsoft has stated: SQL injection is an attack in which malicious code is inserted into strings that are later passed to an instance of SQL Server for parsing and execution. Any procedure that constructs SQL statements should be reviewed for injection vulnerabilities because SQL Server will execute all syntactically valid queries that it receives. Even parametrized data can be manipulated by a skilled and determined attacker. The primary form of SQL injection consists of direct insertion of code into user-input variables that are concatenated with SQL commands and executed. A less direct attack injects malicious code into strings that are destined for storage in a table or as metadata. When the stored strings are subsequently concatenated into a dynamic SQL command, the malicious …

Continue reading

Ten Most Critical Web Application Security Risks

| 0 comments

I thought it was time to sit down and begin writing a series of articles on the subject of application security for a number of reasons. First, because security should and must be foremost in everyone’s mind and second I have decided to return to school to obtain a Master’s Degree in CyberSecurity. I can think of no better reasons to both educate myself and other surrounding to topic of security. Introduction If you’re not familiar with The Open Web Application Security Project (OWASP) then I strongly urge you to take time to visit them. The amount of information you will find there can be a little overwhelming at first but if you continue to soak up the material that they provide you will soon find yourself becoming much more knowledgeable about security than you may have ever wish to have learned. A great starting point is what OWASP has coined as the Top 10. For a number of years know they research the industry and report to the general public the top ten security risk that they find. I must admit that the really frightening part is a number of vulnerabilities remain on the list year after year and …

Continue reading

Browser Fuzzing And What It Means

| 0 comments

In today’s day and age a great many individuals conduct daily business via web based applications and it is extremely important to understand the risk with web based applications. For example, banking, insurance, and various cloud services that we all hold near and dear to our heart. While vulnerabilities are exist both inside the browser and the application you’re using, it is important to understand that no single party should be held responsible over the other. In fact each party must work together to provide the most secure experience as possible. Mozilla, Chrome, Internet Explorer all work hard to identify exploits and release patches to address the exploit. While this is a step in the right direction you should understand you application could be at risk. This is especially true when software is not developed with security in mind and I have seen entirely too many applications that have what I term basic exploits that are easily corrected, but unfortunately are not. Fuzzing is a software testing mechanism which involves serving malformed input to an interpreter or parser with the purpose of triggering crashes. Fuzzing often may be the simplest tool to uncover flaws because you don’t have to worry …

Continue reading