Retail breaches and the SQL injection threat

Continuous monitoring of database networks is the best approach to avoid breaches such as the high-profile attacks against major U.S. retailers, according to a Ponemon Institute and DB Networks study.

More than half (57 percent) of respondents believed that the attacks against the U.S. retailers involved SQL injection as one of the components of the attacks.

The research was conducted to gain a deeper insight into the recent U.S. retailers breaches, including to better understand why these retailers were so vulnerable, what security countermeasures could have been employed, and who was likely responsible for the attacks.

The study analyzed responses from 595 IT security experts in the United States working across a broad spectrum of industries and also the public sector. Study respondents are very familiar with the security compliance requirements for retailers who accept payment cards, and 69 percent of the respondents indicated their organization must comply with PCI DSS.

“While details of the recent retailers breach haven’t yet been fully disclosed by the retailers who were breached or the U.S. Secret Service in charge of breach investigations, this study offers some interesting industry insight into these events from IT security professionals and experts familiar with PCI DSS,” said Dr. Larry Ponemon, founder and chairman of the Ponemon Institute.

Additional key findings of the study include:

• Fifty-three percent of respondents in total indicated that breach notification should occur within a month
• Initial reports were that a Russian teenager was the perpetrator of the Target breach, however half the respondents felt that it was actually the work of a cyber criminal syndicate. Only 15 percent responded that a lone wolf hacker was the likely culprit, while 11 percent responded that nation-state actors were likely responsible.
• While most respondents believed that the attacks against the retailers databases involved SQL injection, almost half of the respondents said the SQL injection threat also facing their own organization is very significant.
• Nearly two-thirds of respondents (64 percent) felt that their organization presently does not have the technology or tools to quickly detect SQL injection database attacks.
• Only one-third of respondents either scan continuously or daily for active databases. However, 25 percent reported they scan irregularly and 22 percent do not scan at all.
• Only 48 percent of respondents indicated that they test or validate third party software to ensure it’s not vulnerable to SQL injection.
• Forty-four percent utilize professional penetration testers to identify vulnerabilities in their IT systems; but 65 percent of those penetration tests do not include testing for SQL injection vulnerabilities.