Building an SQL Firewall: Insights from Developers
summary
A SQL firewall implemented as a proxy parses incoming SQL into ASTs, matches queries against policy trees to block or rewrite them, and provides logging, TLS, and modular handlers. The implementation extends a Go SQL parser (adding an "ignore parse errors" flag) and uses pattern-based allow/deny lists; adapting grammars was needed for Postgres vs MySQL. Measured throughput dropped from 2345 to 1375 to 1217 req/s, with an overall claimed security overhead of about 7%.
AI-written summary · about
chapters (11)
- 0:00SQL Firewall intro
- 1:29SQL injection problems
- 3:33Standard injection defenses
- 5:02Firewall limits
- 8:36Firewalls vs load balancers
- 11:11Akrasecure goals
- 15:23Dev challenges
- 19:03Akrasecure demo
- 21:59Performance results
- 23:26Conclusion
- 23:48Q&A
related talks
25mProtect Against Common Database Attacks with SQL Firewall
51mInexpensive Datamasking for MySQL with ProxySQL
35mAutoSpear: Towards Automatically Bypassing and Inspecting Web Application Firewalls
45mSecurity Attacks on PostgreSQL
40mPostgreSQL Security for Application Developers
50mUsing language-theoretics and runtime visibility to align AppSec with DevOps
16mInfrastructure security, visibility and cost-optimization
19mMicrosoft Defender for SQL: Advanced Threat Protection