“SQL, the lingua franca for databases, converts data into
information and knowledge. A skeleton key to the most widely
used databases, Standard Query Language may protect or may breach
security. Its double-edged nature arises from SQL’s ease of use,
its power to uncover hidden relationships among data, and its
occasionally neglected security features.”
“SQL, improperly implemented, poses two security threats: one at
the database level and the other at the server. With the trends of
data warehousing as an operational tool and database access via the
Web, understanding SQL’s vulnerabilities is critical. A corporate
spy exploring your information reservoir with SQL will make them a
clear rival of Sherlock Holmes.”
“Amrit Tiwana advises in Web Security (Digital Press, 1999)
doing careful configuration of an SQL Server that publishes to a
Web Server. He recommends reverse proxying of SQLNET (TCP Port
1521). As an alternative, given adequate memory and processing
power, he suggests hosting the SQL Server and the Web Server on the
Proxy Server. Secure Web interfacing, however, does not resolve all
the problems at the server level.”