You can take advantage of Perl's compatible regular expressions (pcre), which are supported by Snort, to write...
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
your own concise signatures that cover your particular Web application. Various Snort signatures are also available on the Internet for both SQL injection and XSS protection. Visit Network Intelligence for some good examples. Depending upon how your Web site is structured, signature-based detection can lead to a high number of false positives. For that reason, you may have to tune these signatures to your own requirements. Unfortunately, since most SQL statements are created dynamically by a Web application, each one may be different. This diversity makes it difficult to implement effective signatures. Although Snort can be deployed as a full-blown network intrusion prevention system, with real-time alerting capabilities, it can't stop a sophisticated SQL injection or XSS attack. So even though Snort can add an important layer of defense for your application, it doesn't fix the underlying problem of poorly written applications.
A more efficient and effective technique is to try to eliminate SQL injection and XSS holes in-house. Firstly, implement a secure software development lifecycle methodology for your Web applications. Better programming practices such as code reviews, input validation and SQL parameter binding will all make your applications more robust. On larger projects, you may want to use automatic source code scanning tools.
Next, ensure that your Web server and your database server have been hardened. Never use root access when connecting to the database. It's important to ensure that users do not have privileged access to tables and views. Certainly deny them access to special system utilities and system-stored procedures.
Finally, before launching a Web application, carry out a penetration test to assess whether your methodologies have been implemented correctly. Depending on your budget and the value of your data, you may want to augment your defenses with a database extrusion-prevention (DBEP) product. Often referred to as database firewalls, they function more like a network behavior anomaly detection (NBAD) system than a simple firewall or IDS, preventing unauthorized access based on user roles and detecting abnormal user activity.
Dig Deeper on Application Attacks (Buffer Overflows, Cross-Site Scripting)
Related Q&A from Michael Cobb
What is BGP hijacking or IP hijacking and how do cybercriminals pull off the attacks? Expert Michael Cobb explains how enterprises can mitigate these...continue reading
Is the Dell eDellRoot security threat a serious problem and, if so, can it be prevented with self-signed root certificate authorities? Expert Michael...continue reading
What does FIPS 140-2 Level 2 certification for devices cover? Expert Michael Cobb explains the FIPS 140-2 security standard and how vendors use it in...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.