Limiting database security A number of texts signify that the most important aspects offered by a DBMS are availability, integrity and secrecy. As part of a homework assignment I have been tasked with mentioning attacks which would affect each aspect.  This is what I have come up with - are they any good?


Availability - DDOS attack Integrity 
Secrecy - SQL Injection attack 
Integrity - Use of trojans to gain access to objects with higher security roles
SQL Injection would be straightforward if scripting code was not properly sanitizing its inputs.

Here is a good post on SQL Injection Prevention via Stored Procedures : Do stored procedures prevent SQL injection?

Interestingly, even in the book MySQL 5.0 Certification Study Guide, Chapter 33 is all about using Stored Procedures and Triggers for Administration. In it are three bulletpoints on Page 470:


  For the tables in question, disallow direct access to by ordinary
  users for INSERT, UPDATE, and DELETE statements. (You can do this be
  granting the appropriate privileges to administrative users only.)
  
  Implement a procedural interface for modifying each table. That is,
  using an administrative account that has access to the table, write
  stored procedure that have DEFINER security and that perform the
  required modifications to the table, giving appropriate data values as
  parameters. Grant the EXECUTE privilege for these routines to the
  appropriate users.
  
  Require users to perform table modifications by calling the stored
  procedures and passing column values for the rows to be modified as
  parameters. Each procedure examines its arguments and verifies that
  they satisfy whatever constraints are deemed necessary. If the
  arguments are suitable, the procedure performs the requested
  modification. If they are not, the procedure aborts the operation.


In another mysql aspect, you have to secure user authentication. The most overlooked aspect is looking for the mysql schema tables. I wrote about this before in terms of how user authentication works and how to clean it up at install time and later afterwards:


What is the mysql.db table used for?
MySQL : Why are there &quot;test&quot; entries in mysql.db?
Is this a normal set of MySQL privileges?
Secure method beside phpMyAdmin for remote mysql