Security Portal: SQL: Friend and FoeApr 20, 2000, 16:57 (0 Talkback[s])
(Other stories by Ronald Mendell)
"SQL, the lingua franca for databases, converts data into information and knowledge. A skeleton key to the most widely used databases, Standard Query Language may protect or may breach security. Its double-edged nature arises from SQL's ease of use, its power to uncover hidden relationships among data, and its occasionally neglected security features."
"SQL, improperly implemented, poses two security threats: one at the database level and the other at the server. With the trends of data warehousing as an operational tool and database access via the Web, understanding SQL's vulnerabilities is critical. A corporate spy exploring your information reservoir with SQL will make them a clear rival of Sherlock Holmes."
"Amrit Tiwana advises in Web Security (Digital Press, 1999) doing careful configuration of an SQL Server that publishes to a Web Server. He recommends reverse proxying of SQLNET (TCP Port 1521). As an alternative, given adequate memory and processing power, he suggests hosting the SQL Server and the Web Server on the Proxy Server. Secure Web interfacing, however, does not resolve all the problems at the server level."