3 ms·
You do not appear to understand the difference between "necessary" and "sufficient". Process isolation is not sufficient (i.e. adequate on its own) to make a S
by Veserv 2y ago
You do not appear to understand the difference between "necessary" and "sufficient".
Process isolation is not sufficient (i.e. adequate on its own) to make a SQL server secure against maliciously crafted inputs intended to cause SQL injection for the purpose of undesired database access because it does not sprinkle magical security pixie dust on it.
Process isolation is necessary (in practice) to make a SQL server secure against maliciously crafted inputs intended to cause SQL injection for the purpose of undesired database access because otherwise a attacker can just modify the code of the SQL server to directly do the undesired database accesses. Without process isolation your SQL server security/design can be bypassed.
The amazing thick walls of your castle do not matter if you built it on sand. The amazing solid bedrock is not sufficient to claim your castle is defensible if your castle is a wooden shack, but it is necessary for building a defensible castle.
- ryao 2y agoA lack of process isolation does not allow your SQL server security to be bypassed when the adversary is not on the machine in the first place. The adversary would usually fill out a field on a form, which is where SQL injection attacks usually occur: https://xkcd.com/327/ https://xkcd.com/327/ OSv for example does not have process isolation, yet applications on it are not considered insecure.