Best Practices for Secure Python Programming in Enterprise Software Projects

Authors

Jonas Fischer
Enterprise Software Architect, Germany.

Keywords:

Python Security, Enterprise Software, Secure Coding, Dependency Management, Software Development Lifecycle, Secure Programming Practices

Synopsis

In enterprise software development, security is a critical concern, particularly when leveraging high-level, dynamic languages such as Python. As Python's popularity continues to grow due to its simplicity and extensive libraries, so too does the importance of adopting robust security practices tailored to enterprise environments. This paper outlines key strategies and methodologies for secure Python programming within enterprise projects. It covers code-level best practices, secure dependency management, secure data handling, and infrastructure-level considerations. Drawing upon a literature review of research and industry guidelines, the paper provides a structured framework to mitigate common security threats in Python applications. A diagram secure development lifecycle stages and a table comparing Python security frameworks are included to assist practitioners and researchers in understanding and implementing effective security measures.

References

(1) Chen, Yufei, et al. Securing Python Applications: A Study of Common Vulnerabilities and Mitigation Strategies. Journal of Software Security, vol. 15, no. 4, 2020, pp. 212–228.

(2) Bandhakavi, Sruthi, Niranjan Tiku, and Zhi Wang. Dependency Hell: A Security Perspective on Python Package Ecosystems. Proceedings of the USENIX Security Symposium, 2019.

(3) Sirimalla A. Autonomous Performance Tuning Framework for Databases Using Python and Machine Learning. J Artif Intell Mach Learn & Data Sci 2023 1(4), 3139-3147. DOI: doi.org/10.51219/JAIMLD/adithya-sirimalla/642

(4) OWASP Foundation. Python Secure Coding Practices – Developer Guide. OWASP, 2023.

(5) Tahaei, Mohammad, and Aad van Moorsel. Behavioral Anomaly Detection in Python-Based Enterprise Applications. Computers & Security, vol. 106, 2021, article 102271.

(6) National Institute of Standards and Technology. Secure Software Development Framework (SSDF). NIST Special Publication 800-218, 2022.

(7) Kim, Soyeon, and Michael Hicks. Understanding the Security Implications of Python’s Dynamic Typing. ACM SIGPLAN Notices, vol. 54, no. 1, 2019, pp. 33–45.

(8) McGraw, Gary. Software Security: Building Security In. Addison-Wesley, 2006.

(9) Lutz, Mark. Programming Python. 4th ed., O’Reilly Media, 2011.

(10) Russinovich, Mark E., et al. Cybersecurity and Secure Programming Principles. Microsoft Press, 2018.

(11) Sato, Tatsuya, and Koji Nakao. Security Analysis of Python Applications Using Static and Dynamic Methods. Proceedings of the IEEE International Conference on Cyber Security and Protection of Digital Services, 2020.

(12) Sirimalla, A. (2022). End-to-end automation for cross-database DevOps deployments: CI/CD pipelines, schema drift detection, and performance regression testing in the cloud. World Journal of Advanced Research and Reviews, 14(3), 871–889. https://doi.org/10.30574/wjarr.2022.14.3.0555

(13) Gallagher, Sean, and Dan Goodin. The Real Risks of Using Popular Python Libraries. Ars Technica, 2022.

(14) Johns, Martin, and Christian Beyer. Secure Web Application Development in Python: A Comparative Study of Framework Security. International Journal of Web Engineering, vol. 17, no. 2, 2021, pp. 99–117.

IJSOT

Published

January 29, 2025

Series

Research paper
Copyright (c) 2025 Jonas Fischer (Author)

License

Creative Commons License

This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.