Your company decides to start the business of selling toys online and shipping globally. The E-Commerce system that supports the new business will be developed in-house. In a threat modeling meeting, the development team identified a design flaw that might result in SQL injection attacks. The solution is a typical 3-tier architecture, the webserver farms for front-end presentation, elastic application server clusters for business logic, and database cluster for data persistence. The risk shall be addressed at the first priority after evaluation. As a security professional, which of the following is the best suggestion?
A. For front-end UX programmers to validate user inputs
B. For back-end web programmers to validate user inputs
C. For the solution architect to design a secure architecture
D. For back-end web programmers to authenticate and authorize every HTTP request

Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications.

My suggested answer is C. For the solution architect to design a secure architecture.

There are two primary ways to execute SQL queries: raw SQL string and parameterized SQL. The root cause of SQL injection is “malicious raw SQL strings”.

It helps for front-end UX programmers to validate user inputs, but it’s not sufficient, because hackers can submit HTTP requests with your own weapons.

It is even more effective than the solution implemented by front-end UX programmers that back-end web programmers validate user inputs. However, not every programmer has the same level of skill and odds are bug might happen.

It doesn’t help at all for back-end web programmers to authenticate and authorize every HTTP request because it will not examine the content for “malicious raw SQL strings.”

With a secure system architecture, the architect will address security concerns in every architectural component. It reduces the loading of programmers so that they can focus on developing the code supporting the business. For junior developers without security concerns or skills, they can deliver codes with adequate security on the bases of a secure architecture that provides a fool-proof design.