Modeling a SQL injection attack

Day in day out, the online security attacks are consistently increasing. According to OWASP Top Ten Cheat sheet-2013, SQL Injection (SQLI) is at peak among online attacks. This can be attributed primarily to lack of awareness on software security; skill set shortage, non-availability of right tools to evaluate security as a metric across various phases of SDLC. With the looming deadlines and tight budgets implementing security viewed as a handicap. Many organizations direct their application security efforts on automated detective solutions such as application scans, penetration testing, web application firewalls and patch management rather than preventing the defects from occurring in the first place i.e. during development of web application. The dominating idea, `Secure Software Engineering' saves time as well as cost for mitigating vulnerabilities. Keeping in line with the context of security in software development, this paper focused on mitigating SQL Injection vulnerability in SDLC. The process of SQLI attack is discussed with the help of suitable example. The paper primarily focuses on security actions performed in Requirement Phase for extenuating SQLI. A methodical way of modeling SQLI attacks by using attack trees, VCG, Misuse cases is presented for eliciting security requirements.