Who's to Blame for SQL Threat?
SQL injection attacks stir up concerns over weaknesses in databases and
Database developers have found themselves in an unwelcome spotlight in recent weeks, thanks to reports that the latest SQL injection exploit may have impacted hundreds of thousands of sites running Internet Information Services (IIS) and SQL Server.
There are no new vulnerabilities in SQL Server or IIS, wrote Bill Sisk, a communications manager for Microsoft's Security Response Center, in a blog posting. "To protect against SQL injection attacks the developer of the Web site or application must use industry best practices," Sisk wrote.
So is Microsoft passing the buck by blaming developers? Many are pointing out that while SQL injections can be extremely destructive and costly, any database left vulnerable will execute anything it determines is valid SQL-be it SQL Server, Oracle, IBM's DB2 or others.
"To suggest that the database vendor should somehow know and choose which SQL should or should not be executed, outside of security and data quality constraints, is way out of bounds," says Wayne Snyder, president of the user group Professional Association for SQL Server (PASS) in an e-mail. "It would be great if all software could do what we intend, instead of what we say."
Snyder, who's also a managing consultant at Mariner LLC, a Charlotte, N.C.-based consultancy and Microsoft business partner, believes threats like this are universal.
"I can't recall the last time I saw any software which spent any effort at all in denying this kind of attack," he adds. "Lack of money, lack of time, lack of interest, difficulty in deciding what to do-all contribute to the fact that most apps and programmers don't defend against this."
Will this latest exploit be the one to lead IT organizations to put more priority-and money-into secure coding practices?
"Unfortunately many discussions and project plans don't even have this as an item on the risk assessment," Snyder notes. "The sad truth is that we, as developers, DBAs and project managers, are left holding the bag on this-because it's our bag!"
Jeffrey Schwartz is editor of Redmond magazine and also covers cloud computing for Virtualization Review's Cloud Report. In addition, he writes the Channeling the Cloud column for Redmond Channel Partner. Follow him on Twitter @JeffreySchwartz.