When introducing new technologies, the first step is to recalculate the risk profile to identify any new or changed risks.
"The implementation of new technologies should trigger a review of the risk profile to identify and address new exposures."
- CISM Review Manual 15th Edition, Chapter 2: Risk Management, Section: Risk Assessment and Analysis*

According to the CISM Review Manual, one of the best ways to contain an SQL injection attack that has been detected by a web application firewall is to reconfigure the web application firewall to block the attack.
This means that the web application firewall should be updated with the latest detection patterns and rules that can identify and prevent SQL injection attacks. By doing so, the web application firewall can reduce the impact and damage of the attack, and prevent further exploitation of the vulnerable database1 The other options are not as effective as reconfiguring the web application firewall to block the attack. Force password changes on the SQL database is a reactive measure that does not address the root cause of the problem, and may cause data loss or corruption if not done properly. Updating the detection patterns on the web application firewall is a preventive measure that can help to detect SQL injection attacks, but it does not stop them from happening in the first place. Blocking IPs from where the attack originates is a defensive measure that can limit or stop some SQL injection attacks, but it does not protect all possible sources of malicious traffic, and may also affect legitimate users or applications1 References = 1: CISM Review Manual, 16th Edition, ISACA, 2020, pp. 32-33...

In CISM governance, data ownership is a business accountability, not an IT/technical one. The most helpful person to identify the correct data owner is the individual who manages the business process supported by the application (B), because they are closest to the business purpose, outcomes, and decision- making authority tied to that information. Data owners are typically accountable for data classification, access authorization, acceptable use, retention requirements, and protection needs aligned with business and regulatory obligations. By contrast, the person with the most privileges (A) is often an admin and may only reflect technical access, not accountability. Application support (C) manages operational upkeep, and user management (D) may administer accounts but does not define business responsibility for the information.
Assigning the right owner is critical to enable proper governance controls such as access approvals, risk acceptance, and compliance decisions-especially for legacy systems where responsibilities can drift over time.
References: ISACA CISM Review Manual (Governance-roles and responsibilities, information asset ownership, accountability model); CISM Exam Content Outline (Domain 2).