BlueTech Innovations: Navigating SQL Injection Risks and Security Constraints Case Study

Introduction- BlueTech Innovations: Navigating SQL Injection Risks and Security Constraints

Rapid Assignment Help ensures every assignment reflects your academic potential with our reliable Assignment Help in the UK.

Part1–CaseStudy

Based in Manchester, UK, BlueTech Innovations Ltd. is a dynamic small and medium-sized enterprise (SME) that specialises in developing cutting-edge digital solutions and e-commerce platforms for small and medium-sized enterprises across multiple industries. Since its founding in 2015, BlueTech has made a reputation for itself with creative solutions that blend cutting-edge technology and aesthetically pleasing design.

Company Details:

Size: 150 employees

Turnover: £18 million (as of the last financial year)

Location: Manchester, UK

Operation Areas: Primarily within the UK, but they have some clients and partners in the EU and North America.

Technological Infrastructure:

Devices in Use:

Workstations: Dell OptiPlex Series (Running Windows 10)

Servers: HPE ProLiant DL Series (Hosting the database and website)

Laptops: MacBook Pro (For senior management & remote employees)

Mobile Devices: Company-issued iPhones for specific roles like sales and customer support.

Networking Equipment:

Switches: Cisco Catalyst 2960 Series

Routers: Cisco ISR 4000 Series

Wireless Devices: Aruba Wireless Access Points

Firewalls: Palo Alto PA-3200 Series

Software and Database:

Database System: PostgreSQL (For hosting the customer database)

CRM Software: Salesforce (For managing customer interactions)

E-commerce Platform Backend: Built on PHP using Laravel Framework

Web Server: Apache HTTP Server

Security Protocols & Measures:

Web Application Firewall (WAF): Cloudflare, to protect against common web threats

Intrusion Detection System (IDS): Snort

Endpoint Security: Symantec Endpoint Protection

VPN for Remote Access: Cisco AnyConnect

Regular Patching: Monthly patch cycles for all software to ensure they are updated against known vulnerabilities.

Network Infrastructure

The Palo Alto firewall guards a secure gateway at the beginning of BlueTech's network.

Three VLANs, one for workstations, one for servers, and one for management—are divided into the main office network.

Through the Cisco VPN, remote workers may connect safely and securely, guaranteeing encrypted communication and a secure connection.

Threat Overview

BlueTech faces a serious risk from the possibility of indirect links given the IS1 document reference, particularly given their integrated e-commerce platforms and custom digital solutions. SQL injections are especially dangerous because PostgreSQL is used for their database. Attackers are reported to be able to take advantage of SQL databases with inadequate security. Hackers might use this vulnerability as a point of entry, compromising consumer data or causing service disruptions.

Part2–Threat Identification

Injection Attacks (Specifically SQL Injection)

Database software is considered as an utility used or software program for maintaining, editing and creating different types of records and data of various organisations. Database software helps to save numerous data in suitably structured forms fields, columns and tables for all users. All the saved files of different users are accessible with the help of a programmatic process (Rouse, 2023). Numerous types of database software are available such as Improvado, PostgreSQL, My SQL, Microsoft SQL Server, Oracle RDBMS and many more. However, PostgreSQL software is used by BlueTech Innovations Ltd. Injection process of SQL server for maintenance of numerous data of the company is a dangerous level of data maintenance system under the part of PostgreSQL software.

Security vulnerabilities in PostgreSQL are considered as the major issues for the overall security system, because it provides data accessible possibilities for every user to access arbitrary code under data management through the PostgreSQL process. This database software's security team and coding process does not consider any type of reporting process for data hamper or breach-related activity (Postgresql.org, 2023). This type of superuser activity increases the vulnerabilities of this database software. In today’s era, database technology advances at a breakneck pace with integrity, innovation, progression and enhancements of developers, and devoted engineers. However, breaching of highly sensitive data of the organisation under HPE ProLiant DL Series increases unauthorised access and attacking level.

Part 3–Business Constraints

BlueTech Innovations Ltd., a small and medium-sized enterprise (SME) with an annual revenue of £18 million and a workforce of 150 individuals, encounters specific economic and operational limitations while implementing comprehensive information security protocols (Postgresql.org, 2023). In light of the recognition of SQL Injection assaults as a prominent security concern, it is imperative to comprehend the accompanying limitations in order to adopt a comprehensive approach.

Infrastructure Overhaul: Replacing outdated systems or spending money on cutting-edge network security solutions are frequently necessary to address vulnerabilities. These kinds of projects are expensive and could be seen as unnecessary expenses, particularly if the vulnerabilities have not been used yet1.

Ongoing Monitoring: Sufficient mitigation necessitates continuous observation. This results in ongoing expenses because it calls for both tools and human oversight (PGDG, 2019).

Laws and Regulations:

Significant fines may be incurred for breaking ever-changing legislation like the GDPR. In addition, it is frequently necessary to make investments in audits, training, and tools in order to ensure total adherence2. **3. Staff Time and Talent:

Vulnerabilities require experience to address. It's possible that the present IT team lacks the knowledge necessary to handle complex threats (Daskevics and Nikiforova, 2021). There are time and budgetary limits when it comes to training them or employing fresh staff.

Vulnerabilities in Networks:

Device Vulnerabilities: Outdated or incorrectly configured switches, routers, and firewalls can serve as entry points for online criminals. Patching them or upgrading them frequently requires downtime, which affects how businesses operate.

User Vulnerabilities: Since workers are frequently the weakest link, they may unintentionally assist breaches. Even a system with strong security can be compromised by phishing attempts or bad password practices3 (Walkowski et al., 2020). Although it takes money and occasionally encounters resistance because of operational pressures, training them is vital.

Vulnerabilities in Databases:

It needs both tools and knowledge to guarantee that the database is well-defended against attacks such as SQL Injections. Although they have expenses, tools like Web Application Firewalls (WAF) can stop these kinds of attacks[^4^] (Zhong et al., 2020). Furthermore, maintaining an encrypted and segregated database can affect operating efficiency and requires skill.

Economic Constraint Controls:

Costs associated with risk mitigation: Although the ISL technology detects risks, mitigating them comes at a cost. Capital is needed to purchase intrusion detection systems, threat intelligence platforms, or even basic firewalls (Postgresql.org, 2022). Sometimes, until a breach happens, it is difficult to demonstrate the tangible return on these investments.

Opportunity Costs: It might be difficult to convince people to switch funding from growth projects to security. Every dollar directed towards non-revenue-generating tasks like security may be seen as a missed opportunity, particularly in competitive environments[^5^].

Part 4–Human Constraints

1. Category of Dangerous Indirect Connections:

Information security is severely hampered by the "Indirect Connections" threat category. It covers a range of threat types, including insider threats, social engineering, and network and database vulnerabilities.

2. Vulnerabilities in Human Social Engineering:

Attacks using social engineering mostly rely on human weaknesses. Attackers might try to coerce staff members into revealing private information or granting unauthorised access. For instance, phishing emails or phone calls may deceive staff members into divulging login information (Enterprisedb, 2023). Human limitations, such as inadequate knowledge and instruction, may render workers vulnerable to these strategies.

3. Employee Restraints and Insider Threats:

Workers having access to the network and database may be the source of insider threats. Employee privilege abuse can occur through purposeful or inadvertent ignorance, which can result in security breaches. An organisation's capacity to identify and stop insider threats may be hampered by reluctance to change and a failure to adhere to existing security procedures.

4. Vulnerabilities in Databases and Networks:

Important components of the organisation's information architecture are the network and database. These assets have vulnerabilities that could be used against them, resulting in system compromises or data breaches (FORTRA, 2021). These vulnerabilities may arise as a result of human limitations such as user error, inexperience, and a lack of resources for security.

5. Particular Flaws in the Database and Network:

It is crucial to take into account potential vulnerabilities in network devices, such as unpatched software, incorrect setups, and lax access controls, even though they weren't mentioned in the original response (Akhtar, 2022). Furthermore, exploitable vulnerabilities can be produced by database vulnerabilities such as insufficient encryption or improper access constraints.

6. Measures to Reduce Dangers Associated with Humans:

Organisations can put in place a variety of measures to manage these human limitations and lessen the hazards and vulnerabilities that go along with them:

Employee Education and Awareness: Educating staff members about social engineering techniques and offering in-depth training on security best practices can enable them to identify and fend off threats (PGDG, 2019).

Frequent Security Audits: Regular security audits are carried out to find vulnerabilities in database and network assets and to quickly fix them.

User error mitigation is the process of putting controls in place to reduce user error, such as validation checks and task automation. Increasing the strength of authentication procedures and access controls will help to thwart insider threats and unauthorised access. Creating and implementing security rules that require adherence to security protocols and guidelines is known as security policy and enforcement (Akhtar, 2022). Creating clear incident response plans will help you deal with security breaches quickly and efficiently.

In the context of information security, human limitations are crucial, especially when addressing the "Indirect Connections" threat category. It is critical to understand that human behaviour and awareness are key factors in network and database security vulnerabilities as well as risk mitigation. It is imperative to strengthen the organisation's overall security posture by addressing these limitations through rules, training, and efficient controls.

Part 5–Risk Identification

Risk	Vulnerability	Control
Unauthorized Data Access	Poor input validation in web forms, weak database authentication mechanisms (OWASP, 2021).	Implement input validation techniques, use parameterized SQL queries, strong authentication & authorization (Vermeer, 2021).
Data Manipulation	Absence of real-time monitoring, outdated database management software (Bucko et al., 2023).	Real-time intrusion detection systems (IDS) for database, apply regular software patches.
Data Loss	Lack of backup procedures, SQL commands leading to deletion of records (OWASP, 2021).	Maintain regular database backups, deploy data recovery plan, restrict deletion permissions (Vermeer, 2021).
System Compromise	Extended privileges to users, compromised administrator credentials.	Implement the principle of least privilege (PoLP), two-factor authentication, regular password changes (Bucko et al., 2023).
Spread of Malware	SQLi attacks introducing malicious scripts/software into the network (OWASP, 2021).	Real-time monitoring, deploy endpoint security solutions, regular malware scans across the network.
Operational Disruption	Successful SQLi causing system downtimes.	Robust incident response plan, frequent system monitoring, and timely patches & updates (Vermeer, 2021).

Part6–Risk Assessment

Asset	Threat	Vulnerability	Likelihood	Potential Impact	Calculated Risk	Recommended Control
Online Customer Database	SQL Injection	Poor input validation on web forms	High	High (Unauthorized data access)	High	Implement rigorous input validation techniques
Online Customer Database	SQL Injection	Weak database authentication mechanisms	Medium	High (Data manipulation)	Medium	Employ strong password policies and multi-factor authentication
Online Customer Database	SQL Injection	Outdated database management software	Low	Medium (Data loss)	Low	Schedule regular software updates and patches

Part6–Risk Assessment

Asset	Threat	Vulnerability	Likelihood	Potential Impact	Calculated Risk	Recommended Control
Online Customer Database	SQL Injection	Poor input validation on web forms	High	High (Unauthorized data access)	High	Implement rigorous input validation techniques
Online Customer Database	SQL Injection	Weak database authentication mechanisms	Medium	High (Data manipulation)	Medium	Employ strong password policies and multi-factor authentication
Online Customer Database	SQL Injection	Outdated database management software	Low	Medium (Data loss)	Low	Schedule regular software updates and patches

Asset: Customer database online

One of BlueTech Innovations Ltd.'s most important assets is its online client database. It probably contains important client data, order specifics, transaction histories, and maybe payment data. Maintaining the trust of clients and running a business both depend heavily on its security.

Danger: Injection of SQL

The main threat has been determined to be SQL Injection. This is a frequent yet dangerous danger to databases that are accessible via online interfaces. Malicious actors may get unauthorised access to or influence over the database by manipulating database queries with carefully constructed input (Bluetechresearch, 2023). Because the information in the online customer database is sensitive, a successful SQL Injection attack could have dire consequences.

Deficiencies:

A vulnerability with a high probability is poor input validation. SQL Injection attacks can occur in web programmes that do not adequately validate or sanitise inputs. As a result, malicious SQL code that is entered into forms by attackers has the potential to be executed in the database and grant unauthorised users access to data. Weak Database Authentication: A vulnerability with a medium probability. An attacker's chances of gaining unauthorised access to the database are increased if it has weak passwords or does not have multi-factor authentication. Older database management software presents a little risk of attack. It's possible that known flaws in outdated software can be exploited by attackers (Bluetechresearch, 2023). There is a window of vulnerability between the discovery of a flaw and the application of a fix, even with routine updates.

Possible Effect:

Unauthorised Data Access is a serious problem. Attackers could steal sensitive client data and cause identity theft, financial fraud, and loss of trust if they are able to access the database because of inadequate input validation (Raj, 2022).

Data Manipulation: An attacker may modify prices, order specifications, or even payment records if they are able to manipulate the data stored in the database. This can have negative financial effects and jeopardises the data's integrity.

Data Loss: Should an attacker utilise SQL Injection to erase data from the database and regular backups are not performed, important data may be irreversibly lost.

Computed Danger:

Danger from Inadequate Input Validation: This poses a high risk due to its high probability and significant possible consequences. It should be our first priority to address this issue.

Weak Database Authentication danger: This presents a medium level of danger. Although there is a medium chance, there is still a high potential impact (Raj, 2022).

Outdated Software danger: Although this is a minor danger, it is nevertheless significant. Even a low likelihood danger cannot be disregarded due to the severity of potential consequences.

Suggested Controls:

The controls indicated in the table are appropriate and ought to be put into place right once. Thorough input validation is a useful tool for reducing the risk of SQL Injection. Robust password regulations and consistent programme upgrades additionally mitigate the danger, preserving the authenticity and privacy of the virtual client database.

Furthermore, despite the significant dangers that BlueTech Innovations Ltd. may face, they may protect their customer database and maintain their company's reputation if they put the proper mitigation measures in place (BluetechResearch, 2023). The company's cybersecurity posture will be greatly strengthened by fixing the vulnerabilities that have been found and providing a plan for improvement.

Part 7–Critical Analysis

Reflection On Risk Assessment

The scope of the risk evaluation was extensive, taking into account both prospective threats and system weaknesses. But when you stop to think about it, you realise that simply identifying dangers is insufficient. Additionally, we should regularly reevaluate the changing threat scenario. Cyberthreats are dynamic; attackers create new strategies and new vulnerabilities appear.

Employing the IS1 Risk Assessment standard provided an organised method for determining and assessing hazards. Consistency is guaranteed by its structured nature, but its possible rigidity poses a constraint. Since every company is different, relying just on a tool could leave out details unique to BlueTech Innovations Ltd (Bcs.org, 2023). Maybe the best strategy would be to combine a more flexible, individualised approach with an organised tool.

The risk assessment made clear how crucial it is to take commercial and financial restrictions into account. These limitations influence not just possible mitigation techniques but also the structure of the system's inherent vulnerabilities. Budgetary restrictions, for example, may result in out-of-date software, which presents a vulnerability (Satoricyber, 2023). This important discovery—that cybersecurity is intertwined with economic factors—emphasizes that cybersecurity is not merely an IT problem but a fundamental business matter.

The interconnection of assets and weaknesses is one feature that jumps out. A flaw in one area, like the network infrastructure, can have repercussions and put other resources, like the customer database, at risk. Because of this interdependence, cybersecurity must be approached holistically, considering each asset, vulnerability, and threat in light of the ecosystem as a whole.

While technological advancements are crucial, human interaction is still a key component of cybersecurity (Kure, Islam and Razzaque, 2020). Staff awareness and training programmes are just as important as any firewall or intrusion detection system. This human element was not thoroughly examined in the risk assessment, which is a drawback. Subsequent evaluations must to give greater weight to the human factor, examining possible dangers from social engineering, insider threats, and other sources.

Risk assessment need to be an ongoing procedure rather than a one-time event. The demands of business, the external environment, and the digital landscape are ever-changing. It is possible that the risk assessment completed today will not be entirely applicable in a few months or perhaps a year (Knowles, 2021). One important lesson is that risk assessment is an iterative process.

Reflection On The use of 1

The IS1 framework offers a systematic approach to conducting risk assessments. The implementation of this systematic approach guarantees a constant evaluation of risks, hence minimising the possibility of overlooking any crucial elements. The structure provided by BlueTech Innovations Ltd. is of great value as it enables the company to effectively manage its online presence while also prioritising data protection.

The utilisation of the IS1 tool facilitated the comprehensive coverage of all critical domains within the evaluation, encompassing both physical assets and information assets (Zola, 2021). The meticulousness of this approach is crucial in guaranteeing that every possible vulnerability is thoroughly examined and accounted for.

The concepts of standardisation and benchmarking are crucial in various academic and professional fields. Standardisation refers to the process of establishing and implementing uniform practises, procedures, or criteria

By employing a widely acknowledged standard such as IS1, BlueTech Innovations Ltd. is able to assess its security protocols in comparison to the most effective practises prevalent in the industry. Benchmarking plays a crucial role in comprehending the position of the organisation within the cybersecurity domain and serves as a potent instrument for effectively conveying our security stance to stakeholders.

Although the systematic method employed by IS1 offers advantages, it can occasionally be perceived as excessively inflexible. Each organisation possesses distinct characteristics, and employing a standardised technique may not adequately account for the specific intricacies exhibited by BlueTech Innovations Ltd (Agyepong et al., 2023). In order to enhance future assessments, it may be advantageous to use IS1 inside a flexible assessment framework.

There exists a possible risk associated with over dependence on IS1 or any other technology. It is imperative to bear in mind that tools should serve as facilitators of the risk assessment process, rather than exerting control over it (Bcs.org, 2023). The human element, characterised by intuition and critical thought, continues to be of utmost importance.

Although IS1 is a comprehensive system, its outcomes and outputs may provide challenges for non-technical stakeholders due to its technical nature and difficulty in interpretation. The process of converting the findings of IS1 into practical insights and comprehensible language for all relevant parties is an aspect that requires careful consideration.

The digital and cybersecurity domain is characterised by constant evolution (De Groot, 2023). Although IS1 provides a strong basis, it is crucial to ensure its continuous updating and potential integration with additional tools or approaches that tackle novel and evolving threats.

Reflection On The CaseStudy

The provision of comprehensive background information was of utmost importance. The aforementioned factor facilitated a more comprehensive examination at a later stage, underscoring the significance of a meticulous preliminary foundation. Nonetheless, achieving a harmonious equilibrium between pertinent particulars and an overwhelming abundance of information proved to be a formidable task.

The interconnection between many aspects of the corporation, including its network infrastructure and commercial activities, became apparent (postgresql, 2023). The presence of a vulnerability or threat in a particular domain can have an indirect influence on another domain, hence emphasising the necessity of adopting a comprehensive security strategy.

The case study underscored the dynamic nature of threats. As the organisation undergoes transformation, it also encounters a corresponding array of possible risks. The inherent dynamism of cybersecurity necessitates the adoption of a proactive and adaptive approach.

The case study made an effort to address all conceivable vulnerabilities; nonetheless, the dynamic nature of the technological landscape implies that certain vulnerabilities may have been inadvertently omitted or could arise in the future (Walkowski et al., 2020). This serves as a humbling reminder of the significance of ongoing monitoring and evaluation.

The economic and business constraints refer to the limitations and restrictions that affect the operations and activities of businesses within the economic context. These constraints can arise from several factors such as market conditions, government regulations, financial limitations,

The disclosure of the considerable interconnection between economic variables and cybersecurity has emerged (Vermeer, 2021). This observation underscores the fact that cybersecurity is not solely an information technology (IT) matter, but rather a critical component intricately linked to corporate strategy and financial planning.

The case study provided more support for the notion that although technology plays a crucial role, it is imperative to acknowledge the significance of the human factor. The implementation of training programmes, the cultivation of awareness, and the establishment of a strong company culture are essential factors in effectively mitigating potential hazards.

The Significance of External Tools and Standards:

The utilisation of tools such as IS1 proved to be of great value. Nevertheless, the case study underscored the need of not only depending on external criteria (PGDG, 2019). The process of tailoring and incorporating these solutions to align with the specific requirements of the organisation is of utmost importance.

The Significance of Feedback Loops in Academic Contexts

The significance of feedback loops is underscored by a rigorous examination of the case study. The findings derived from this investigation ought to be integrated into the company's operations, guaranteeing that acquired knowledge is applied and results in ongoing enhancement. In addition to addressing the technological and operational components, the case study highlights the ethical considerations surrounding cybersecurity, particularly with regard to the protection of client data (Satoricyber, 2023). The aforementioned increase in responsibility emphasises the significance of implementing strong cybersecurity protocols, not alone for the sake of adhering to regulations or financial considerations, but also as a moral imperative.

References

Agyepong, E., Cherdantseva, Y., Reinecke, P. and Burnap, P. (2023). A systematic method for measuring the performance of a cyber security operations centre analyst. Computers & Security, 124(2), p.102959. doi:https://doi.org/10.1016/j.cose.2022.102959.

Akhtar, H. (2022). 10 common PostgreSQL mistakes and how to avoid them. [online] InfoWorld. Available at: https://www.infoworld.com/article/3681655/10-common-postgresql-mistakes-and-how-to-avoid-them.html [Accessed 26 Oct. 2023].

Bcs.org (2023). Cyber risk assessment in a post-IS1 world | BCS. [online] www.bcs.org. Available at: https://www.bcs.org/articles-opinion-and-research/cyber-risk-assessment-in-a-post-is1-world [Accessed 26 Oct. 2023].

BluetechResearch (2023). Innovation Tracker Archive. [online] BlueTech Research. Available at: https://www.bluetechresearch.com/tools/innovation-tracker/ [Accessed 26 Oct. 2023].

Bluetechresearch (2023). Water Technology Digest. [online] BlueTech Research. Available at: https://www.bluetechresearch.com/ [Accessed 26 Oct. 2023].

Bucko, A., Vishi, K., Krasniqi, B. and Rexha, B. (2023). Enhancing JWT Authentication and Authorization in Web Applications Based on User Behavior History. Computers, [online] 12(4), p.78. doi:https://doi.org/10.3390/computers12040078.

Daskevics, A. and Nikiforova, A. (2021). IoTSE-based open database vulnerability inspection in three Baltic countries: ShoBEVODSDT sees you. [online] ieeexplore.ieee.org. Available at: https://ieeexplore.ieee.org/document/9704952/ [Accessed 26 Oct. 2023].

De Groot, J. (2023). What is Cyber Security? Definition, Best Practices & Examples. [online] Digital Guardian. Available at: https://www.digitalguardian.com/blog/what-cyber-security.

Enterprisedb (2023). How to Monitor PostgreSQL Connections. [online] EDB. Available at: https://www.enterprisedb.com/postgres-tutorials/how-monitor-postgresql-connections [Accessed 26 Oct. 2023].

FORTRA (2021). Insider Threat: 74% of security incidents come from the extended enterprise, not hacking groups | Press Release. [online] www.clearswift.com. Available at: https://www.clearswift.com/resources/press-releases/insider-threat-74-security-incidents-come-extended-enterprise-not-hacking-groups.

Knowles, M. (2021). Cybersecurity Risk Management: Frameworks, Plans, & Best Practices. [online] Hyperproof. Available at: https://hyperproof.io/resource/cybersecurity-risk-management-process/.

Kure, H., Islam, S. and Razzaque, M. (2020). An Integrated Cyber Security Risk Management Approach for a Cyber-Physical System. Applied Sciences, [online] 8(6), p.898. doi:https://doi.org/10.3390/app8060898.

OWASP (2021). SQL Injection Prevention · OWASP Cheat Sheet Series. [online] Owasp.org. Available at: https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html.

PGDG (2019). PostgreSQL: The world’s most advanced open source database. [online] Postgresql.org. Available at: https://www.postgresql.org/.

postgresql (2023). CREATE DOMAIN. [online] PostgreSQL Documentation. Available at: https://www.postgresql.org/docs/current/sql-createdomain.html [Accessed 26 Oct. 2023].

Postgresql.org (2022). 5.4. Constraints. [online] PostgreSQL Documentation. Available at: https://www.postgresql.org/docs/current/ddl-constraints.html.

Postgresql.org (2023). PostgreSQL: Security Information. [online] www.postgresql.org. Available at: https://www.postgresql.org/support/security/.

Raj, A. (2022). Unauthorized access the biggest cause of data breaches. [online] Tech Wire Asia. Available at: https://techwireasia.com/2022/07/unauthorized-access-the-biggest-cause-of-data-breaches/.

Rouse, M. (2023). What is Database Software? - Definition from Techopedia. [online] Techopedia.com. Available at: https://www.techopedia.com/definition/1190/database-software.

Satoricyber (2023). 3 Pillars of PostgreSQL Security. [online] Satori. Available at: https://satoricyber.com/postgres-security/3-pillars-of-postgresql-security/.

Vermeer, B. (2021). SQL injection cheat sheet: 8 best practices to prevent SQL injection | Snyk. [online] snyk.io. Available at: https://snyk.io/blog/sql-injection-cheat-sheet/.

Walkowski, M., Krakowiak, M., Oko, J. and Sujecki, S. (2020). Efficient Algorithm for Providing Live Vulnerability Assessment in Corporate Network Environment. Applied Sciences, 10(21), p.7926. doi:https://doi.org/10.3390/app10217926.

Zhong, R., Chen, Y., Hu, H., Zhang, H., Lee, W. and Wu, D. (2020). SQUIRREL: Testing Database Management Systems with Language Validity and Coverage Feedback. Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, 3(11). doi:https://doi.org/10.1145/3372297.3417260.

Zola, A. (2021). What is a risk assessment framework, and how does it work? [online] SearchCIO. Available at: https://www.techtarget.com/searchcio/definition/risk-assessment-framework-RAF.