Event Details

This workshop is appropriate for any developer who wants to write secure code. No security knowledge is assumed but Python knowledge is needed to run and modify code. For command injection, SQL injection, and temporary file attacks we will do the following:

1. Run the code with malicious input to see and understand exactly how the vulnerable code is exploited to gain unauthorized access to the system
2. Discuss safe coding practices to avoid the vulnerabilty
3. Fix the code and run it again to show how the corrected code can no longer be used to access the system

Additional secure coding principles are discussed including safe library and function usage, file permissions, least privilege, defense in depth, input validation, and how to defend against path and symlink attacks. Pointers to online resources and books which have been vetted by several security professionals and are considered to be among the best available are included so attendees can continue to grow their knowledge.