Preventing SQL Injections When WAF’s Not Enough • Hacker News Board

Re: Preventing SQL Injections When WAF’s Not Enough

#11

Post by liveoneggs » Thu, Feb 14, 2019, 12:17 AM UTC

henvic wrote: post #8

wil421 wrote: post #5

Earlier quoted context omitted.

The company I work at has many PCI compliant systems. I asked a security officer why they were still doing certain things the old way. He explained they very well know it’s the old way but in order to be compliant they must do it.

I'm curious by what do you mean 'old way' for the very reason exposed above. Would you mind to give some examples?

do you have mod_security and the standard rules? Yes

do you write custom rules based on your actual application? <- not a real question

Re: Preventing SQL Injections When WAF’s Not Enough

#12

Post by wil421 » Thu, Feb 14, 2019, 2:36 AM UTC

henvic wrote: post #8

wil421 wrote: post #5

Earlier quoted context omitted.

The company I work at has many PCI compliant systems. I asked a security officer why they were still doing certain things the old way. He explained they very well know it’s the old way but in order to be compliant they must do it.

I'm curious by what do you mean 'old way' for the very reason exposed above. Would you mind to give some examples?

A simple example would be changing passwords every 90 days. It’s been proven users will choose less secure passwords.

Here is an article from the FTC and one about NIST guidelines.

https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-r...

https://qz.com/981941/the-us-standards-office-wants-to-do-aw...

Re: Preventing SQL Injections When WAF’s Not Enough

#13

Post by moutix » Thu, Feb 14, 2019, 9:22 PM UTC

That's why we now have RASP. It's better than SQL proxy and WAF, because you have both the SQL query and the HTTP parameters and you can correlate them to be super accurate

Re: Preventing SQL Injections When WAF’s Not Enough

#14

Post by ninegunpi » Fri, Feb 15, 2019, 11:02 AM UTC

moutix wrote: post #13

That's why we now have RASP. It's better than SQL proxy and WAF, because you have both the SQL query and the HTTP parameters and you can correlate them to be super accurate

Isn't RASP just slapping the WAF-like signature detection into your application data streams directly? How would RASP prevent:

1. Insiders having access to database front?

2. Same SQL bypass techniques as employed to bypass WAFs?

3. Mitigate developer errors in query logic which enable custom injections?