CSSLP: Certified Secure Software Lifecycle Professional

By ISC · Question Mode

QuestionQ215

VerifiedSecure Software Implementation

You are a Security Manager for Tech Perfect Inc. and want to protect all data from a SQL injection attack, which can read sensitive database data and modify database data by using commands such as Insert, Update, and Delete. Which of the following tasks will you perform? Each correct answer represents a complete solution.

Choose three
Explanation

SQL injection risk is mitigated by separating data values from SQL code through typed, bound parameters; parameterized stored procedures provide the same protection when they do not construct dynamic SQL unsafely. An encapsulated database-access library can consistently enforce safe parameterized access. Database permissions should follow least privilege, because excessive permissions increase the data and operations an injected command could access.

Community Discussion

No comments yet. Be the first to start the discussion!