Howdy all,
We're using Postgres 8.3 with all of our apps connecting to the database
with Hibernate / JPA.
Our security team is concerned about SQL Injection attacks, and would
like to implement some mod_security rules to protect against it.
From what I've read Postgres vanilla is pretty robust when it comes to
dealing with SQL Injection attacks, and when you put an abstraction
layer like Hibernate on top of it, you're basically rock solid against them.
Does anyone have experience here? One of our security people found a
generic mod_security config file that had a couple of postgres entries
in it. Is there a full Postgres config for mod_security that the
community recommends?
Can anyone give me a good pros or cons of using mod_security when you
have Postgres + Hibernate?
At this stage in our project I'm trying to avoid making decisions based
on statements like "PostgreSQL is 100% secure" or "More security can't
hurt" any change like this impacts our delivery schedule, if we are
going to do it we need to understand why and what benefits it brings.
Thanks
Dave