Which of the following technologies would reduce the risk of a successful SQL injection attack?

A Web Application Firewall (WAF) is a security technology specifically designed to protect web applications by operating at the application layer (Layer 7). It inspects incoming HTTP/HTTPS traffic for malicious patterns characteristic of web-based attacks. For a SQL injection (SQLi) attack, the WAF analyzes user input within requests for malicious SQL syntax, such as ' OR '1'='1'. By using a set of predefined rules and signatures, it can identify and block these malicious requests before they reach the web server and its database, thereby reducing the risk of a successful attack. This makes it the most direct and effective technology among the choices for mitigating SQLi.

A. Reverse proxy: Primarily manages traffic flow and can hide backend server identity but does not inherently perform deep inspection of application-layer attack payloads.

C. Stateful firewall: Operates at the network and transport layers (L3/L4), tracking connection states, but cannot inspect application-layer data to detect SQLi code.

D. Web content filtering: Is an outbound control used to restrict users from accessing certain websites; it does not protect inbound traffic to a web server.

---

1. OWASP Foundation. (n.d.). Web Application Firewall. OWASP. Retrieved from https://owasp.org/www-community/WebApplicationFirewall. The document states

"A web application firewall (WAF) is an application firewall for HTTP applications. It applies a set of rules to an HTTP conversation... These rules cover common attacks such as cross-site scripting (XSS) and SQL injection."

2. National Institute of Standards and Technology (NIST). (2007). Guide to Secure Web Services (NIST Special Publication 800-95). Section 4.3.2

"Web Application Firewalls

" p. 4-6. The guide explains that WAFs "can be used to protect Web services from many different application-level attacks" and function by "intercepting and inspecting all incoming traffic."

3. Halfond

W. G.

Viegas

J.

& Orso

A. (2006). A classification of SQL-injection attacks and countermeasures. Proceedings of the IEEE International Symposium on Secure Software Engineering

13-22. https://doi.org/10.1109/ISSSE.2006.20. This academic paper discusses countermeasures

including application-level firewalls (WAFs) that "filter requests based on a security policy" to detect and prevent SQL injection attacks (Section 4.2).