Software is important thing that needed by enterprises to support business. When developers build software, security must be concerned as important element. In bad condition, security incidents can make financial loss to organizaion so it need mitigation actions to minimize risk. Security testing and risk analysis become base process to choose good mitigation method. Implementation of database privilege become one of mitigation methods that can be used in SQL injection attack case. Based on DREAD analysis, it can decrease risk of SQL injection attack from high to medium ranking.