We present a practical protection mechanism against SQL injection attacks. Such attacks target databases that are accessible through a web front-end, and take advantage of flaws in the input validation logic of Web components such as CGI scripts. We apply the concept of instruction-set randomization to SQL, creating instances of the language that are unpredictable to the attacker. Queries injected by the attacker will be caught and terminated by the database parser. We show how to use this technique with the MySQL database using an intermediary proxy that translates the random SQL to its standard language. Our mechanism imposes negligible performance overhead to query processing and can be easily retrofitted to existing systems.
Read the rest of this entry »

• 0 Comments

In this paper we present experiences with the .NET Framework and Visual Studio.NET which we won in two big projects. Thereby we give hints for the practical use in .NET projects.
We designed and implemented two systems:
• A database maintenance system for the internet risk assessor “MIRA” for the Munich Re. Up to 10 developers were included and the project had a size of 8 man years.
• The core application of the real estate investment company Real I.S. of the Bayerische Landesbank Group. The system was build by a team of up to 14 developers in 20 man years.
Read the rest of this entry »

• 0 Comments

Although traditional firewalls have effectively prevented network-level attacks, most future attacks will be at the application level, where current security mechanisms are woefully inadequate. Application-level security vulnerabilities are inherent in a Web application’s code, regardless of the technology in which the application is implemented or the security of the Web server and backend database on which it is built. A recent advisory published by Internet Security Systems (see the “Internet Resources” sidebar, p. 44) claims that 11 widely deployed shopping cart applications are vulnerable to a simple attack that lets hackers pur- chase goods for much less than their listed price. Worryingly, the attack does not require particular technical skill; it suffices to save the shopping cart’s HTML confirmation form to disk, use a text editor to modify the price of the goods (stored in a hidden form field), and load the HTML form back into the browser.
Read the rest of this entry »

• 0 Comments

Despite significant efforts in the field of Autonomic Computing, system operators will still play a critical role in administering Internet services for many years to come. However, very little is know about how system operators work, what tools they use and how we can make them more efficient. In this paper we study the practices of operators in a large-scale Internet service Amazon.com and propose a new set of tools for operators. The first tool lets the operators explore the health of system components and dependencies between them; the other monitors the actions of operators and automatically suggests solutions to recurring problems.
Read the rest of this entry »

• 0 Comments

So - you are wrapping up development of yet another Web app. The database is in place, CRUD functions are working, user interface and reports have been signed off. Now your thoughts are turning to access control. Just enough time to splice in that trusty user authentication and roles module, make a few tweaks and move on to the next project. Wait! Do you really want to contribute yet another authorization stovepipe to the growing forest? We all curse the proliferation of authentication and authorization “solutions” on the Web. Yet we continue to treat access control as an after thought.
Read the rest of this entry »

• 0 Comments

In 2004, we realized that the Web was on the cusp of a new era, one that would finally let loose the power of network effects, setting off a surge of innovation and opportunity. To help usher in this new era, O’Reilly Media and CMP launched a conference that showcased the innovators who were driving it. When O’Reilly’s Dale Dougherty came up with the term “Web 2.0”during a brainstorming session, we knew we had the name for the conference. What we didn’t know was that the industry would embrace the Web 2.0 meme and that it would come to represent the new Web.
Read the rest of this entry »

• 0 Comments

Microsoft Access is a powerful data-management tool that allows you to input, store, and report data in an attractive and efficient way. Although Access has templates and “wizards” to help you easily set up a database that can suit simple purposes, it can also run extremely advanced functions. This handout is intended to introduce new users to the basic functions of Access.
Read the rest of this entry »

• 0 Comments

A MySQL Enterprise subscription is the most comprehensive offering of MySQL database software, services and support; it ensures that your business achieves the highest levels of reliability, security, and uptime. An Enterprise Subscription includes:
1. The MySQL Enterprise Server – the most reliable, secure, and up-to-date version of the world’s most popular open source database
2. The MySQL Enterprise Monitor – An automated virtual DBA assistant that monitors all your MySQL Servers around-the-clock, identifies exceptions to MySQL best practices, and provides expert advice on fixing any problems discovered
3. MySQL Production Support – Technical and consultative support when you need it, along with regularly scheduled service packs, hot-fixes, and more.
Read the rest of this entry »

• 0 Comments