MOVEit: An Avoidable SQL Injection Disaster

Cybersecurity: Addressing the Persistent Problem of SQL Injection

The Persistence of SQL Injection Vulnerabilities

In the realm of cybersecurity, certain vulnerabilities persist even as technology continues to evolve. One such example is SQL injection, a flaw that allows attackers to manipulate a web application’s database by inserting malicious SQL queries. It is alarming that despite being identified as one of the lowest hanging fruits in terms of security vulnerabilities, SQL injection is still prevalent today, even making its way into the Open WorldWide Application Security Project (OWASP) Top 10 list.

A quarter of a century after the venerable Phrack magazine highlighted the issue, SQL injection remains a viable attack vector. Its long-standing prevalence is a stark reminder of the challenges organizations face in effectively addressing security vulnerabilities. While progress has been made in many areas, incidents like the 2008 Heartland Payment Systems breach and the 2023 Cl0p ransomware attack on MOVEit from Progress Software highlight the ongoing risks posed by SQL injection vulnerabilities.

Secure by Construction: A Viable Solution

Given the persistence of SQL injection vulnerabilities, it is evident that organizations need to adopt a proactive approach to software development and security. One approach is to focus on producing code that is “secure by construction.” This means incorporating secure coding practices and techniques that prevent vulnerabilities like SQL injection from being introduced in the first place.

One effective method is the use of stored procedures instead of directly passing SQL queries. By utilizing stored procedures, developers can ensure that the code adheres to a predefined set of rules and prevents the injection of malicious queries. Additionally, incorporating software libraries that sanitize input can further enhance the security of the code, eliminating the need for extensive quality control measures or bug hunts post-development.

Shifting Left: Education and Support

The key to achieving secure by construction code lies in education and collaboration between developers and security teams. “Shifting left” refers to the concept of integrating security into the earliest stages of the software development life cycle (SDLC) – essentially, embedding security as an integral part of code quality rather than a mere checkpoint.

This approach requires developers to be educated about secure software development practices from the beginning. Initiatives like the OpenSSF’s Secure Software Development Fundamentals Courses provide valuable resources for developers to enhance their understanding of secure coding practices. By promoting education and emphasizing the importance of secure coding, organizations can empower developers to prioritize security alongside speed.

However, education alone cannot fully address the issue. Developers must also feel supported within their organizations to take the time necessary to code securely. If organizations prioritize speed at the expense of security, developers may revert to insecure practices, disregarding the education they received. It is essential for organizational cultures to encourage secure coding practices and reward developers for prioritizing security over rapid development.

Furthermore, security teams have a role to play in supporting developers. Providing vulnerability information to developers without sufficient context can impede progress and add unnecessary burdens. Security teams should strive to be better software engineers themselves, delivering actionable and concise findings that help developers make informed decisions. By bridging the gap between security and development, organizations can create a collaborative environment conducive to producing secure code.

Planning for the Future

While striving to achieve secure by construction code is vital, organizations must also plan for the inevitable breaches that may occur despite their best efforts. Understanding the software supply chain is of utmost importance, as illustrated by the MOVEit vulnerability incident. Maintaining an accurate inventory of software and infrastructure assets enables organizations to respond effectively to cybersecurity events before they escalate into full-fledged breaches.

Incident response plans should be in place, with well-documented run books and procedures, helping teams address issues promptly and efficiently. Regular tabletop exercises and practice drills can help both engineering and security teams become more adept at handling security incidents. Following each incident, whether real or simulated, an after-action report should be prepared to identify areas for improvement and strengthen future response efforts.

The Power of Diversity

In addressing cybersecurity challenges, it is crucial to recognize that good security is a team effort. Organizations should foster multidisciplinary teams with diverse backgrounds and perspectives. Homogenous thinking often perpetuates existing issues, while diversity of thought brings fresh ideas and innovative solutions to the table. Encouraging collaboration and inclusivity will empower organizations to overcome security vulnerabilities and strengthen their resilience in the face of evolving threats.

In conclusion, the persistence of SQL injection vulnerabilities underscores the need for organizations to adopt a proactive approach to cybersecurity. By focusing on secure by construction code, prioritizing education and support for developers, planning for incident response, and fostering diverse teams, organizations can mitigate the risks posed by SQL injection and other security vulnerabilities. It is our hope that in the future, discussions about persistent vulnerabilities like SQL injection will be a thing of the past, replaced by a renewed emphasis on secure coding practices across the industry.