Concept - SQLi Countermeasures

Layer	What it does (s.20)
Defensive coding	stronger data validation; insufficient input validation leads to SQLi; e.g. check that numeric inputs contain only digits
Detection: signature based	match specific attack patterns
Detection: anomaly based	define normal behaviour, detect abnormal ones
Detection: code analysis	generate a wide range of SQLi attacks and assess the system’s response
Runtime prevention	check queries at runtime against a model of expected queries

Khaled Notes