Visão Geral

Esta Curso Python Security, ensina aos participantes como lidar com os problemas de código de segurança mais críticos ao desenvolver aplicativos Python. Os participantes aprendem sobre as 10 principais vulnerabilidades do OWASP e como abordá-las em seus códigos. O curso também cobre questões de segurança significativas para o código Python em geral e explora a segurança JSON e os testes de segurança.

Objetivo

Após realizar este Curso Python Security, você será capaz de:

• Entenda os problemas de segurança de aplicativos da Web
• Analise os dez principais elementos do OWASP
• Coloque a segurança do aplicativo da Web no contexto do Python
• Vá além dos frutos mais fáceis
• Lide com desafios de segurança em seu código Python
• Identifique vulnerabilidades e suas consequências
• Aprenda as melhores práticas de segurança em Python
• Compreenda a metodologia e as abordagens dos testes de segurança
• Familiarize-se com as técnicas e ferramentas comuns de teste de segurança

Pre-Requisitos

• Ter experiência geral de desenvolvimento Python.
  

Informações Gerais

• Carga horaria, 24h
• Se noturno este curso e ministrado de segunda-feira a sexta-feira das 19h às 23h, total de 6 noites,
• Se aos sábado este curso e ministrado das 09h às 18h, total de 3 sábados,

Formato de entrega:

• On-line ao vivo na presença de um instrutor via plataforma Microsoft Teams
  

Materiais

Conteúdo Programatico

Introduction

1. Cybersecurity Basics
2. What is security?
3. Threat and risk
4. Cybersecurity threat types
5. Consequences of insecure software
6. Constraints and the market
7. The dark side

The OWASP Top Ten (Part I)

1. OWASP Top 10 – 2017

Injection

1. Injection principles
2. Injection attacks
3. SQL injection

SQL injection best practices

1. Input validation
2. Parameterized queries
3. Additional considerations
4. Case study – Hacking Fortnite accounts
5. Testing for SQL injection

SQL injection and ORM

1. Parameter manipulation
2. CRLF injection
3. Code injection
4. Injection best practices

Broken authentication

1. Authentication basics
2. Authentication weaknesses
3. Spoofing on the Web
4. Testing for weak authentication
5. Case study – PayPal 2FA bypass
6. User interface best practices
7. Password management

The OWASP Top Ten (Part II)

1. Broken authentication
2. Password management
3. Session management
4. Cookie security

Sensitive data exposure

1. Information exposure
2. Exposure through extracted data and aggregation
3. Case study – Strava fitness app data exposure
4. System information leakage

Information exposure best practices

1. Error and exception handling principles
2. Information exposure through error reporting
3. Information leakage via error pages

XML External Entities (XXE)

1. DTD and the entities
2. Entity expansion
3. Attribute blowup
4. External Entity Attack (XXE)

Broken access control

1. Access control basics
2. Failure to restrict URL access
3. Testing for authorization issues
4. Confused deputy

File upload

1. Unrestricted file upload
2. Good practices
3. Testing for file upload vulnerabilities

Security misconfiguration

1. Configuration principles
2. Configuration management
3. Server misconfiguration
4. Python configuration best practices

Cross-Site Scripting (XSS)

1. Cross-site scripting basics
2. Cross-site scripting types

XSS protection best practices

1. Protection principles – escaping
2. XSS protection APIs in Python
3. XSS protection in Jinja2
4. Additional protection layers
5. Client-side protection principles
6. Blacklisting-based XSS protection evasion
7. Testing for XSS

The OWASP Top Ten (Part III)

1. Insecure Deserialization
2. Serialization and deserialization challenges
3. Deserializing untrusted streams
4. Deserialization with pickle
5. Deserialization with PyYAML
6. Deserializing best practices
7. Testing for insecure deserialization

Using Components with Known Vulnerabilities

1. Using vulnerable components
2. Assessing the environment
3. Hardening
4. Untrusted functionality import
5. Malicious packages in Python
6. Importing JavaScript
7. Case study – The British Airways data breach
8. Vulnerability management

Insufficient Logging & Monitoring

1. Logging and monitoring principles
2. Insufficient logging
3. Plaintext passwords at Facebook
4. Logging best practices
5. Monitoring best practices

Web Application Security Beyond the Top Ten

1. Client-side security
2. Same Origin Policy
3. Frame Sandboxing
4. Cross-Frame Scripting (XFS) attack
5. Clickjacking beyond hijacking a click
6. Clickjacking protection best practices

Common Software Security Weaknesses

1. Input validation
2. JSON Security
3. JSON injection
4. Dangers of JSONP
5. JSON/JavaScript hijacking
6. Best practices
7. ReactJS vulnerability in HackerOne

Security Testing

1. Security testing vs functional testing
2. Manual and automated methods
3. Security testing techniques and tools
4. Code analysis
5. Dynamic analysis

Wrap Up

1. Secure coding principles
2. Principles of robust programming by Matt Bishop
3. Secure design principles of Saltzer and Schröder

And now what?

1. Further sources and readings
2. Python resources