Average SQL Injection Breach Takes 140 Days to Discover: Ponemon Institute Report


A new study released on Wednesday shows that SQL injection breaches take an average of nearly 140 days to discover, and require an additional 68 days on average to fix.

The report, “The SQL Injection Threat Study,” released by Ponemon Institute and DB Networks, a provider of behavioral analysis in database security, found that 65 percent of respondents had experienced SQL injection attacks in the past 12 months.

The research looked at responses from 595 IT security practitioners in the US to determine challenges faced by organizations in terms of detecting and stopping SQL injection attacks.

“We believe this is the first study to survey the risks and remedies regarding SQL injection attacks, and the results are very revealing,” Dr. Larry Ponemon, founder and chairman of the Ponemon Institute said. “It is commonly accepted that organizations believe they struggle with SQL injection vulnerabilities, and almost half of the respondents said the SQL injection threat facing their organization is very significant, but this study examines much deeper issues. For example, only a third of those surveyed (34 percent) agreed or strongly agreed that their organization presently had the technology or tools to quickly detect SQL injection attacks. And more than half (52 percent) of respondents indicated that they don’t test or validate any third party software to ensure it’s not vulnerable to SQL injection.”

A report earlier this year by FireHost identified SQL injection as one of the most popular types of attack on cloud provider networks.

According to the survey, more than half of the respondents (56 percent) agreed that determining the root cause of SQL injection is becoming more difficult because employees are using more of their own personal mobile devices in the workplace.

Fifty-two percent of respondents said that they don’t test or validate third-party software to ensure it is not susceptible to SQL injection, though 44 percent use professional penetration testers to identify vulnerabilities in their IT systems. However, only 35 percent of those penetration tests include testing for SQL injection vulnerabilities.

“It’s well known that SQL injection attacks are rampant and have proven to be devastating to organization of all sizes,” said Brett Helm, Chairman and CEO of DB Networks. “This study delves into both the scope and many of the root causes of SQL injection breaches. Signature-based perimeter defenses simply cannot keep up with the sophistication of today’s complex SQL injection attacks. It’s interesting that this study indicates security professionals are now recognizing this and overwhelmingly had a favorable opinion of applying behavioral analysis technologies to address the SQL injection threat.”

Behavioral analysis technology is a preferred approach for detecting SQL injection attacks, with 88 percent of respondents reporting to have a favorable or very favorable opinion of the technology. Fifty-two percent of respondents have begun replacing or plan to replace their signature-based IT security systems with behavioral analysis over the next two years.

Add Your Comments

  • (will not be published)


  1. using an IDS/IPS it is quite tough to fend of these attacks, yeah I agree with this

  2. Absolutely right, it is almost undetectable and there's little done to check SQL Integrity and look for suspicious attack patterns. Unless you're using an IDS/IPS it is quite tough to fend of these attacks. One way of doing is to put a redirection for any unfamiliar URL's, request to /dev/null or to another 404 page. A quick Yahoo search returned this article that shows how easily it can be done. http://www.blackmoreops.com/2014/05/07/use-sqlmap-sql-injection-hack-website-database/