SQL Injection - Are Developers to Blame for Data Security Breaches?
Of course, this is a bold statement, but for those who deal with security issues from mobile applications, they can pinpoint where the flaw occurred with developers not taking security into account when developing mobile apps. Security takes the back seat to app functionality and remains as a second thought.
Companies who develop mobile apps think about the security of the app after the coding is done. Seriously we can’t expect to adequately ensure the security of the data, app, the communication between the app and the servers by patching here and there afterward. One common security breach is done via SQL injection due to flaws in the code. Fierce IT Security "estimates that 97 percent of data breaches are the result of an SQL injection attack somewhere along the line.” According to Mashable, "a British hacker used an SQL injection attack to breach the United States Federal Reserve, steals confidential data and posts it online." The Federal Reserve is a huge financial company with millions, if not billions at its disposal and it was still unable to stop a "straightforward SQL injection attack."
Another breach in security was the hacker who used an SQL injection attack to steal 150,000 user emails and passwords from an Adobe database. This type of attack can "be prevented by app developers adhering to security best practices during the app development and testing phases." At this time, many companies are open to hacker attacks. In 2013, two-thirds of US companies were breached by an SQL inject attack. Even Wall Street is not safe from an SQL injection attack.
Most of these flaws can be prevented by using best practices when developing mobile apps, spending more time thinking, designing and embedding security into the apps in addition to testing rather than pushing them out as fast as they can.
Some hackers say they break into these databases to show companies where the flaw is, to raise public awareness and make companies take security seriously. But many hackers do that for their 5-minutes (sometimes longer due to the severity of the breach) of fame on the news. Their fame is someone else nightmare. Not only it costs companies to fix the damage (some can take 140 days), it also cost them in customers for burdening them with the hassles to change credit card information, emails, and addresses and so on. We are very interested to know what developers think about this.
How To Avoid SQL Injection Types of Attacks with SeaCat Mobile Secure Gateway?
The SeaCat-enabled mobile application communicates with the SeaCat Gateway, the only visible point. The Gateway authorizes, authenticates and re-interprets traffic before passing it to the app’s backend. This scheme shields the backend from exposing itself the Internet and protects it from SQL injection attacks, buffer overflows, and zero-day vulnerabilities.
Mobile application security includes not only protection at the application level but also protection at the backend. Failing to secure the backend, where company's data is most vulnerable, is a recipe for disastrous consequences.
Photo Credit: imcreator
Most Recent Articles
- From State Machine to Stateless Microservice
- Entangled ways of product development in the area of cybersecurity #3 - LogMan.io
- Entangled ways of product development in the area of cybersecurity #2 - BitSwan
- Entangled ways of product development in the area of cybersecurity #1 - Asynchronous or parallel?
- State machine miracle
You Might Be Interested in Reading These Articles
What seems to be a Sci-Fi movie with “talking” vehicles and “flying” machines has now become a reality. Automotive companies, seeing huge opportunity and wanting to entice their customers, are rushing to produce more car features so drivers can avoid traffic congestion, plan the next route, check the status of the car, find an available parking space, request for road assistance, or notify friends/family members/business contacts of news.
Published on May 10, 2016
TalkTalk, one of the largest providers of broadband and phone service in the UK, has recently admitted to being the victim of a large cyberattack. For those in the United States or in another country where TalkTalk’s influence isn’t as widespread, it could be considered on the same level as a Verizon or an AT&T data breach.
Published on November 10, 2015
Connected vehicles that talk to each other, increase road safety, and rely on automation all seem like a plot from a sci-fi movie. When does the robot takeover come in? As outlandish as all of this might seem, we’re closer than ever to connected vehicles being the new normal on our roadways. In fact, by 2025, every car on the road is expected to be connected in some way, shape, or form.
Published on June 15, 2019