Best Options to Avoid SQL Injection Attacks

Answer - C.

AWS WAF is a web application firewall that helps protect your web applications from common web exploits that could affect application availability, compromise security, or consume excessive resources.

AWS WAF gives you control over which traffic to allow or block to your web applications by defining customizable web security rules.

You can use AWS WAF to create custom rules that block common attack patterns, such as SQL injection or cross-site scripting, and rules that are designed for your specific application.

New rules can be deployed within minutes, letting you respond quickly to changing traffic patterns.

For more information on WAF, please visit the below URL:

SQL injection attacks are one of the most common types of attacks against web applications. AWS offers various services that can be used to protect against such attacks. Let's review the options provided in the question and see which one is the best option to avoid SQL injection attacks against your infrastructure in AWS.

Option A: Create a DirectConnect connection so that your have a dedicated connection line. This option is not relevant to preventing SQL injection attacks, as DirectConnect is a service that provides a dedicated network connection between your on-premises infrastructure and AWS. While this can provide additional security benefits, it does not directly address SQL injection attacks.

Option B: Create NACL rules for the subnet hosting the application. Network Access Control Lists (NACLs) are used to control traffic at the subnet level. While NACLs can be used to block traffic from known malicious IP addresses or block specific ports, they are not effective in preventing SQL injection attacks. SQL injection attacks are typically carried out over HTTP(S) and therefore cannot be effectively blocked by NACLs.

Option C: Add a WAF tier by creating a new ELB and an AutoScaling group of EC2 Instances running a host-based WAF. This option involves creating a Web Application Firewall (WAF) tier using AWS Elastic Load Balancer (ELB) and EC2 instances running a host-based WAF. This is a good option as WAFs can help to prevent SQL injection attacks by inspecting incoming requests and blocking those that contain malicious SQL code. The WAF tier acts as a buffer between the internet and the web tier, providing an additional layer of security.

Option D: They would redirect Route 53 to resolve to the new WAF tier EL. Option D involves redirecting Route 53 to resolve to the new WAF tier EL. This is not a security measure but rather a DNS configuration. While it is important to have proper DNS configuration, it does not directly address SQL injection attacks.

Option E: The WAF tier would pass the traffic to the current web tier. The web tier Security Groups would be updated to only allow traffic from the WAF tier Security Group. Option E builds on Option C by configuring the web tier Security Groups to only allow traffic from the WAF tier Security Group. This is a good option as it provides an additional layer of security by limiting traffic to the web tier to only those requests that have been inspected by the WAF.

Option F: Remove all but TLS 1 & 2 from the web tier ELB and enable Advanced Protocol Filtering. This will enable the ELB itself to perform WAF functionality. Option F involves configuring the ELB to only allow TLS 1 and 2 and enabling Advanced Protocol Filtering. While this can help to prevent SQL injection attacks by blocking known attack vectors, it is not as effective as using a dedicated WAF.

In conclusion, the best option to avoid SQL injection attacks against your infrastructure in AWS is to add a WAF tier by creating a new ELB and an AutoScaling group of EC2 Instances running a host-based WAF (Option C). This provides a dedicated layer of security that is specifically designed to prevent SQL injection attacks. Option E is also a good option as it provides an additional layer of security by limiting traffic to the web tier to only those requests that have been inspected by the WAF.