Python Security

Training Materials

All attendees receive comprehensive courseware.

Software Requirements

Attendees will not need to install any software on their computers for this class. The class will be conducted in a remote environment that Ascendient Learning will provide; students will only need a local computer with a web browser and a stable Internet connection. Any recent version of Microsoft Edge, Mozilla Firefox, or Google Chrome will work well.

Outline

• Introduction
• Cyber Security Basics
  • What is security?
  • Threat and risk
  • Cyber security threat types – the CIA triad
  • Cyber security threat types – the STRIDE model
  • Consequences of insecure software
• Input Validation
  • Input validation principles
  • Denylists and allowlists
  • What to validate – the attack surface
  • Where to validate – defense in depth
  • When to validate – validation vs transformations
  • Validation with regex
  • Regular expression denial of service (ReDoS)
  • ReDoS in Python
  • Dealing with ReDoS
  • Injection
    • Injection principles
    • Injection attacks
    • SQL injection
    • SQL injection best practices
    • Code injection
  • Integer handling problems
    • Representing signed numbers
    • Integer visualization
    • Integers in Python
    • Integer overflow
    • Integer overflows in ctypes and numpy
    • Other numeric problems
  • Files and streams
    • Path traversal
    • Path traversal-related examples
    • Additional challenges in Windows
    • Virtual resources
    • Path traversal best practices
    • Path canonicalization
  • Format string issues
  • Unsafe native code
    • Native code dependence
    • Lab – Unsafe native code
    • Best practices for dealing with native code
• Security Features
  • Authentication
    • Authentication basics
    • Multi-factor authentication
    • Time-based One Time Passwords (TOTP)
    • Authentication weaknesses
    • Password management
    • Outbound password management
  • Information exposure
    • Exposure through extracted data and aggregation
    • Case study – Strava data exposure
    • System information leakage
  • Platform security
    • Python platform security
• Using Vulnerable Components
  • Assessing the environment
  • Hardening
  • Malicious packages in Python
  • Case study – The British Airways data breach
  • Vulnerability management
    • Patch management
    • Vulnerability databases
    • DevOps, the build process, and CI/CD
    • Dependency checking in Python
    • Detecting vulnerable components
• Cryptography for Developers
  • Cryptography basics
  • Cryptography in Python
  • Elementary algorithms
    • Random number generation
    • Hashing
  • Confidentiality protection
    • Symmetric encryption
    • Asymmetric encryption
    • Combining symmetric and asymmetric algorithms
    • Key exchange and agreement
    • Message Authentication Code (MAC)
    • Digital signature
    • Certificates
• Common Software Security Weaknesses
  • Time and state
    • Race conditions
  • Errors
• Conclusion
  • Secure coding principles
    • Principles of robust programming by Matt Bishop
    • Secure design principles of Saltzer and Schroeder
  • And now what?
    • Software security sources and further reading
    • Python resources