Highlights
- Core Python Security Fundamentals
- Cryptography and Data Security
- Authentication and Authorization
- Secure Coding Practices
- Network Security
- Infrastructure Security
- Security Tools and Testing
- Operational Security
Course Details
Core Python Security Fundamentals
- Security principles and defence in depth strategies with Python frameworks
- Implementing OWASP Top 10 protections in Django and Flask applications
- Security principles and defence in depth strategies
- Principles from The OWASP Web Security Testing Guide
- Threat modelling and the security requirements document
- The principles of least privilege and deny by default
- Zero trust architecture fundamentals
- Building zero trust architecture with OpenZiti's Python SDK
Cryptography and Data Security
- Hashing, encryption, and digital signatures
- Symmetric encryption and public key encryption
- Secure password storage and management
- Using Python's hashlib and hmac modules for secure hashing
- Using Python's cryptography libraries correctly
- Data encryption at rest and in transit
- Data encryption at rest using Django's encrypted model fields and SQLAlchemy StringEncryptedType
Authentication and Authorization
- Secure session management
- OAuth 2.0 and JWT for authentication
- Oauth2 with the Python library authlib
- JWT handling with PyJWT and managing token lifecycles
- Role-based access control (RBAC), plus alternatives
- Multi-factor authentication
- Managing access tokens and permissions
Secure Coding Practices
- Proven security with modern cryptography algorithms
- Protection against SQL injection
- Input validation and sanitisation
- Using secrets vs random for cryptographic operations
- Sanitizing logs in Python applications
- Django template escaping and Flask/Jinja2 for XSS prevention
- Preventing timing attacks and token prediction attacks
- Cryptographically secure randomness
- Cross-site scripting (XSS) prevention
- Cross-site request forgery (CSRF) protection
- Secure file handling and upload validation
- Preventing TLS downgrade attacks
Network Security
- Networking fundamentals
- TLS/SSL implementation and certificate management
- Secure API design and implementation
- WebSocket security
- Network architecture and segmentation
- Firewalls, routers, network interfaces
- Protocols, HTTP & TLS, with the Python standard library
- Application deployment
- Software Defined Networking
Infrastructure Security
- Container security best practices
- Secure deployment patterns
- Network interfaces and routing
- Building DMZ architectures for Python web applications
- Virtual private networks (VPN)
Security Tools and Testing
- Static analysis with bandit and ruff
- Dependency scanning using pip-audit
- Automated security testing integration
- Container scanning and runtime protection
- Code review practices for security
Operational Security
- Live security alerts
- Statutory duties around security
- Monitoring Python applications for security issues
- Security patch management for Python applications
- Updating and patching strategies
Who should attend
- Python Developers
- Software Engineers
- Security Professionals (SecDevOps)
- Software Architects
- Data Scientists & Machine Learning Engineers
- Quality Assurance Engineers
- Developers Transitioning to Security
- Ethical Hackers and Penetration Testers
- Project Managers and Product Owners
Feedback
4.8 out of 5 average
"Our tailored course provided a well rounded introduction and also covered some intermediate level topics that we needed to know. Clive gave us some best practice ideas and tips to take away. Fast paced but the instructor never lost any of the delegates"
Brian Leek, Data Analyst, May 2022
“JBI did a great job of customizing their syllabus to suit our business needs and also bringing our team up to speed on the current best practices. Our teams varied widely in terms of experience and the Instructor handled this particularly well - very impressive”
Brian F, Team Lead, RBS, Data Analysis Course, 20 April 2022
