SQL Injection Incident Response (Web Application Breach)
NIST SP 800-61 aligned response steps for an initial access and potential data exfiltration incident via SQL injection in a web application.
Prepare
6 steps- Verify log coverage
Confirm that web server access logs (nginx/IIS/Apache) are flowing to a central SIEM and retained for at least 90 days; if not, open an escalation to the relevant team
- Enable DB audit log
Verify that SQL Server Audit (MSSQL), `general_log=ON` (MySQL), or the `pg_audit` extension (PostgreSQL) is active; if not, enable it immediately with the DBA
- Verify WAF status
Confirm WAF is operating in "prevention (blocking)" mode; if in "detection only" mode, temporarily switch it to prevention during the incident
- Prepare DB account inventory
List application DB accounts, their privileges, and connected applications (using `SHOW GRANTS FOR 'app_account'@'localhost'` or MSSQL sys.database_principals query)
- Obtain access to application code repository
Verify that the IR team has read access to the affected application branch (including commit history)
- Prepare communication matrix
Have contact details ready for SOC manager, application security team, development lead, DPO/legal, and CISO; ensure DPO is informed in case of personal data breach for KVKK notification