Certified Incident Handler (CIH) Practice Ecam

Which practice should not be followed by incident responders to mitigate SQL injection attacks on the server?

1. Validate user inputs rigorously

2. Utilize prepared statements for database queries

3. Enable commands like xp_cmdshell

4. Implement error handling techniques

The correct answer is: Enable commands like xp_cmdshell

In the context of mitigating SQL injection attacks, the practice of enabling commands like xp_cmdshell is detrimental. xp_cmdshell is a stored procedure in SQL Server that allows the execution of operating system commands directly from the SQL environment. This significantly increases the potential attack surface, as if an attacker successfully exploits an SQL injection vulnerability, they could gain elevated privileges and execute arbitrary commands on the server, leading to severe consequences such as data breaches or complete system compromise. Validating user inputs rigorously is a fundamental best practice in application security. It helps ensure that the data received by the server conforms to expected formats and types, thereby preventing malicious input from being processed. Utilizing prepared statements for database queries is another effective method, as it separates query structure from data. This means that even if an attacker tries to inject SQL code, it won't be executed as part of the query, significantly reducing the risk of SQL injection. Implementing error handling techniques is also crucial; appropriate error handling can prevent detailed error messages from being returned to web applications, which can give attackers insight into the database structure or further vulnerabilities. In summary, while thorough input validation, prepared statements, and proper error handling are essential defenses against SQL injection attacks, enabling commands like xp_cmdshell weakens security measures