GH-500: GitHub Advanced Security

GH-500 Course: GitHub Advanced Security

GitHub Advanced Security (GHAS) plays a crucial role in improving the security of software development projects on GitHub. It provides a comprehensive set of tools and features designed to identify and address security vulnerabilities throughout the development lifecycle. By integrating security directly into the development process with GHAS, your team can create more secure and reliable software. The course will explore how to use GHAS to maximize its security impact and understand its role in the security ecosystem.

Course Intended For

This course is intended for students who want to understand and implement advanced security practices with GitHub Advanced Security (GHAS).

• They will learn to significantly optimize software development processes and create a more resilient and secure development ecosystem using developer-focused solutions to ensure the security of code, the supply chain, and secrets before production release.
• They will discover how GHAS provides security teams with visibility into the security posture and supply chain of the entire organization, as well as unparalleled access to security intelligence selected from millions of developers and security researchers worldwide.

Course Objectives

By the end of this course, students will be able to:

• Understand the features of GitHub Advanced Security
• Recognize, apply, and evaluate these features in their own GitHub environment

GH-500 Training Elements

• GitHub Advanced Security, Part 1 of 2 (8 Modules)
• GitHub Advanced Security, Part 2 of 2 (4 Modules)

GH-500 Course Content

Module 1: Introduction to GitHub Advanced Security

• Definition of GHAS and the importance of its comprehensive features
• Procedures for using GHAS to achieve the greatest impact
• Overview of GHAS and its role in the security ecosystem

Module 2: Configuring Dependabot Security Updates in the GitHub Repository

• Managing dependencies on GitHub
• Dependabot Alerts
  
• Dependabot Security Updates
  
• Managing Dependabot notifications and reports
  
• Dependency review
  
• Exercise: Configuring Dependabot Security Updates

Module 3: Configuring and Using Secret Scanning in the GitHub Repository

• What is secret scanning?
• Configuring secret scanning
• Using secret scanning
• ExerciseModule 4: Using advanced GitHub Copilot features

Module 4: Configuring Code Scanning on GitHub

• What is code scanning?
• Enabling code scanning with third-party tools
  
• Configuring code scanning
  
• Code scanning configuration exercise

Module 5: Identify Security Vulnerabilities in Your Codebase Using CodeQL

• Preparing a database for CodeQL
  
• Running CodeQL on a database
  
• Information about CodeQL results
  
• Troubleshooting CodeQL results

Module 6: Code Scanning with GitHub CodeQL

• What is CodeQL?
  
• How does CodeQL analyze code?
  
• What is QL?
  
• Code scanning and CodeQL
  
• Customizing the code scanning workflow with CodeQL: Part 1
  
• Exercise: Referencing a CodeQL query
  
• Customizing the code scanning workflow with CodeQL: Part 2
  
• Using the CodeQL CLI
  
• Customizing languages and builds for code scanning.
  
• Exercise: Configuring a CodeQL language matrix

Module 7: GitHub Administration for GitHub Advanced Security

• What is GitHub Advanced Security?
• Enabling GitHub Advanced Security
  
• Managing access to GitHub Advanced Security
  
• Managing GitHub Advanced Security features and alerts

Module 8: Managing Sensitive Data and Security Policies within GitHub

• Enabling security policies
  
• Creating and managing repository rule sets.
  
• Generating reports and logs
  
• Exercise

Prerequisites

Students must have:

• A GitHub account
• Knowledge of the basics of GitHub

Language

• Course: English

• Labs: English

Microsoft Associate Certification: GitHub Advanced Security

Microsoft Certified: GitHub Advanced Security

This exam is designed for professionals with experience in software development and security. This certification is intended for individuals with in-depth knowledge of GitHub and its security features, as well as practical experience in protecting software development workflows.

Level: Intermediate
Role: Administrator, Developer, DevOps Engineer, Solutions Architect, Student
Product: Digital and App Innovation - GitHub
Subject: DevOps