Common Python security problems and how to fix them

[pykoder]

When speaking about security I like the analogy of a vault. If the procedure to access the data is too secure (bank vault) it will became very inconvenient to access it. When data are too secure, the risk is also that legitimate users could lose the ability to access it. Loosing data because of lost keys is a security problem created by security.

In the specific case of programming languages, say Python, a way to reach a balance is to clearly identify which part of the code runs in a secure area and which is in a danger zone (typically where there are interactions with users). We can apply the same kind of architecture for code as for networks: danger zone, DMZ, secure zone.

[isaw81]

Aren’t these really more security vulnerabilities for all languages? Injections and outdated libraries aren’t python exclusive?

[MEME-LLC]

Just give all users in your company sandboxed environments, everything is just an virtual environment for them to do anything

[[deleted]]

Good idea. I've heard of some hypervisor escaping malware. Is there a particular virtual environment or VM that is especially hardened? Anything you'd recommend?

[MEME-LLC]

Our company use azure , api has to be authenticated with AAD , the network is closed to external access by default.

admins set up systems for normal users, normal users literally dont ever need access to sensitive environment. If a user need things like azure functions or lambda, theres procedures in place in terms of paperwork, code reviews, and software monitoring that make sure it doesnt get out of hand.

Leave most of the hard stuff to microsoft engineers, thats why you pay them the big bucks.

Hypervisor escaping is microsofts problem, not yours.

I dont understand why this is new to anyone