Live stream: https://youtu.be/tHlMw9zFgQE Popular programming language index websites (TIOBE index) and developer surveys (Stack Overflow) place Python as one of the fastest-growing programming languages. However, this popularity also puts in the target range of attackers. The attackers perform malicious dependency attacks and use misconfiguration tools to reveal confidential information. In this talk, we will discuss identifying common security issues in Python code and handling malicious dependency attacks using safety.
Popular programming language index websites (TIOBE index) and developer surveys (Stack Overflow) place Python as one of the fastest-growing programming languages. However, this popularity also puts in the target range of attackers. The attackers perform malicious dependency attacks and use misconfiguration tools to reveal confidential information. Jukka Ruohonen, Kalle Hjerppe, and Kalle Rindell in their research paper "A Large-Scale Security-Oriented Static Analysis of Python Packages in PyPI" claimed that they scanned PyPI for security issues in Python packages and found the presence of at least one security issue in about 46% of the Python packages. In addition, security vulnerabilities can be present in the source code of the package. In this talk, we will address the security issues related to python packaging and possible solutions to make python packages secure. The talk begins with the importance of a secure package and vulnerabilities in the Python package index. Then, I will discuss Python packages such as Bandit for identifying common security issues in Python code and “safety” for dependency check. Next, I will discuss verifying and signing Python packages using GPG. Finally, I will discuss general guidelines for secure coding practices in Python. Outline 1. Importance of a secure package and vulnerabilities in python package index. (05 Minutes) 2. Bandit for identifying common security issues in Python code (03 Minutes) 3. safety for dependency check (04 Minutes) 4. Verifying and signing PyPI and conda packages using GPG and Twine(05 Minutes) 5. General guidelines for secure coding practices in Python (05 Minutes) 6. Summary and Questions (03 Minute )
Speakers: Gajendra Deshpande