LONDON — SQL injection attacks have been around for more than ten years, and security professionals are more than capable of protecting against them; yet 97 percent of data breaches worldwide are still due to an SQL injection somewhere along the line, according to Neira Jones, head of payment security for Barclaycard.
Speaking at the Infosecurity Europe Press Conference in London this week, Jones said that hackers are taking advantage of businesses with inadequate and often outdated information security practices. Citing the most recent figures from the National Fraud Authority, she said that identity fraud costs the UK more than £2.7 billion every year, and affects more than 1.8 million people.
“Data breaches have become a statistical certainty,” said Jones. “If you look at what the public individual is concerned about, protecting personal information is actually at the same level in the scale of public social concerns as preventing crime.”
Microsoft has been offering ASP.Net programmers information on how to protect against SQL injection attacks since at least 2005. However, the attack still managed to affect around 180,000 pages.
Jones said that, with the number of interconnected devices on the planet set to exceed the number of humans by 2015, cybercrime and data protection need to take higher priority on the board’s agenda. In order for this to happen, however, the Chief Information Security Officer (CISO) needs to assess the level of risk within their organisation, and take one step at a time.
“I always say, if anyone says APT [advanced persistent threat] in the room, an angel dies in heaven, because APTs are not the problem.,” said Jones. “I’m not saying that they’re not real, but let’s fix the basics first. Are organisations completely certain they’re not vulnerable to SQL injections? And have they coded their web application securely?”