Scenario

Recently, Aim Higher College has seen several cases of sensitive information being stolen from a student information system and posted on the Web. After reviewing Web server and database logs, you believe that the source of the problem is a SQL injection vulnerability. The vulnerability appears to exist in a Web application used by students to register for courses. Your manager asks you to provide a detailed report about this type of vulnerability, how an attacker might exploit it, and methods of detection and removal.

Required Resources

• Access to the Internet

Tasks

Research SQL injection attacks on the Internet to supplement your existing knowledge. Using the information you discovered during this research, in conjunction with what you learned in class, write a complete incident response report for Aim Higher Colleges management detailing the following information:

• A non-technical description of SQL injection vulnerabilities intended for college management
• The threat that SQL injection poses to the colleges data. Include three possible scenarios that describe how an attacker might conduct this type of attack, the information that they may be able to obtain, and how they might use it maliciously.
• An implementation plan to fortify the colleges Web applications against SQL injection attacks
• A monitoring plan that will provide:
  • Early warning to developers and security administrators that a SQL injection vulnerability exists in a Web application
  • Detection of successful and unsuccessful attempts to conduct SQL injection attacks against college systems

Submission Requirements

• Format: Microsoft Word (or compatible)
• Font: Arial, 10-point
• Line Spacing: Double
• Length: 1 to 2 pages