Reference no: EM133459377

Question: help with need more than 110 words comment of the discussion below: I enjoyed learning about SQL Injection this week because it's one of the most common cyber attacks.

What steps would you take to prevent an SQL injection attack?
I would create a whitelist with other security measures such as the POLP to enforce parameter inquiries and input validation. Organizations can secure their databases from an SQL attack in multiple ways; usually, it's a pretty simple process. I would also consider using the honey pot strategy to detect an intruder, divert attackers and just to upset the attackers when they've collected large amounts of false and inaccurate data.

What are the advantages and disadvantages of dynamic SQL statements?
Per our study guides a dynamic SQL statement is essentially an SQL statement with a string of characters made on the fly by users in runtime. One of the benefits of using dynamic SQL statements is that it's really good for web-based applications because of the flexibility it also provides convenience on certain tasks. However, when using dynamic SQL statements over static SQL statements you're usually less secure not to mention it can be more complex at times depending on the user's coding experience. I would recommend using parameterized SQL statements for those higher-level security scenarios.

What types of databases are more vulnerable to SQL injections?
I think the most vulnerable types of databases or web-based databases are those that don't have provide validation for user input. Not meeting certain security standards prior to implementation within the SQL statement can endanger the database. It's also important to ensure the security configuration is up to date on the database before implementing any major changes. As far as vendors go I would say that MySQL could be considered "the most vulnerable" not the least secure but the most vulnerable. Simply because of its popularity and user-friendly interface.