Nearly two-thirds (65 percent) of respondents had experienced SQL injection attacks that successfully evaded their perimeter defenses in the past 12 months, according to a report from security research firm Ponemon Institute and database security analyst DB Network.
Furthermore, each SQL injection breach took an average of nearly 140 days to discover and required an additional 68 days on average to remediate.
The study, which analyzed responses from 595 IT security practitioners in the United States working across a broad spectrum of industries and also the public sector, was conducted to determine the challenges facing organizations around the pervasiveness of SQL injection attacks, and opinions on how to stop these threats.
“We believe this is the first study to survey the risks and remedies regarding SQL injection attacks, and the results are very revealing,” Larry Ponemon, founder and chairman of the Ponemon Institute, said in a statement. “It is commonly accepted that organizations believe they struggle with SQL injection vulnerabilities, and almost half of the respondents said the SQL injection threat facing their organization is very significant, but this study examines much deeper issues.”
For example, the report found that only one-third of those surveyed (34 percent) agreed or strongly agreed that their organization presently had the technology or tools to quickly detect SQL injection attacks.
More than half (52 percent) of respondents indicated that they don’t test or validate any third-party software to ensure it’s not vulnerable to SQL injection, the survey revealed.
The study found 44 percent utilize professional penetration testers to identify vulnerabilities in their IT systems; but only one-third (35 percent) of those penetration tests included testing for SQL injection vulnerabilities.
The majority (52 percent) said they either had begun replacing or would be replacing their signature-based IT security systems with behavioral analysis based IT security systems within the next 24 months.
Nearly half (49 percent) of respondents said they would be using behavioral analysis based systems specifically for database transaction security.
“It’s well known that SQL injection attacks are rampant and have proven to be devastating to organization of all sizes,” Brett Helm, chairman and CEO of DB Networks, said in a statement. “This study delves into both the scope and many of the root causes of SQL injection breaches. Signature-based perimeter defenses simply cannot keep up with the sophistication of today’s complex SQL injection attacks. It’s interesting that this study indicates security professionals are now recognizing this and overwhelmingly had a favorable opinion of applying behavioral analysis technologies to address the SQL injection threat.”
