GH-500: GitHub Advanced Security

Course GH-500: GitHub Advanced Security

GitHub Advanced Security (GHAS) plays a crucial role in enhancing the security of software development projects on GitHub. It provides a comprehensive set of tools and features designed to identify and address security vulnerabilities throughout the entire development lifecycle. By integrating security directly into the development process with GHAS, your team can create more secure and reliable software. The course will explore how to use GHAS to maximize security impact and understand its role in the security ecosystem.

Course aimed at

This course is aimed at students who want to understand and implement advanced security practices with GitHub Advanced Security (GHAS).

• They will learn how to significantly optimize software development processes and create a more resilient and secure development ecosystem through developer-centric solutions to ensure code, supply chain, and secret security before release to production.
• They will discover how GHAS provides security teams with visibility into the security posture and supply chain of the entire organization, as well as unparalleled access to curated security intelligence from millions of developers and security researchers worldwide.

Course objectives

Upon completion of this course, students will be able to:

• Understand the features of GitHub Advanced Security
• Recognize, apply, and evaluate these features in their own GitHub environment

Elements of GH-500 training

• GitHub Advanced Security, Part 1 of 2 (8 modules)
• GitHub Advanced Security, Part 2 of 2 (4 modules)

GH-500 Course Content

Module 1: Introduction to GitHub Advanced Security

• Defining GHAS and the importance of its comprehensive features
• Procedures for using GHAS to achieve the greatest impact
• Description of GHAS and its role in the security ecosystem

Module 2: Configuring Dependabot security updates in the GitHub repository

• Managing dependencies on GitHub
• Dependabot alerts
  
• Dependabot security updates
  
• Managing Dependabot notifications and reports
  
• Dependency review
  
• Exercise: Configuring Dependabot security updates

Module 3: Setting up and using secret scanning in the GitHub repository

• What is secret scanning?
• Configuring secret scanning
• Using secret scanning
• ExerciseModule 4: Using advanced GitHub Copilot features

Module 4: Configuring code scanning in GitHub

• What is code scanning?
• Enabling code scanning with third-party tools
  
• Configuring code scanning
  
• Code scanning configuration exercise

Module 5: Identify security vulnerabilities in your codebase using CodeQL

• Preparing a database for CodeQL
  
• Running CodeQL on a database
  
• Understanding CodeQL results
  
• Troubleshooting CodeQL results

Module 6: Code Scanning with GitHub CodeQL

• What is CodeQL?
  
• How does CodeQL analyze code?
  
• What is QL?
  
• Code scanning and CodeQL
  
• Customizing the code scanning workflow with CodeQL: Part 1
  
• Exercise: Referencing a CodeQL query
  
• Customizing the code scanning workflow with CodeQL: Part 2
  
• Using the CodeQL CLI
  
• Customizing languages and builds for code scanning
  
• Exercise: Configuring a CodeQL language matrix

Module 7: Administering GitHub for GitHub Advanced Security

• What is GitHub Advanced Security?
• Enabling GitHub Advanced Security
  
• Managing access to GitHub Advanced Security
  
• Managing GitHub Advanced Security features and alerts

Module 8: Managing sensitive data and security policies within GitHub

• Enabling security policies
  
• Creating and managing repository rule sets
  
• Reporting and logging
  
• Exercise

Prerequisites

Students should have:

• A GitHub account
• Knowledge of GitHub basics

Language

• Course: English

• Labs: English

Microsoft Certified Associate: GitHub Advanced Security

Microsoft Certified: GitHub Advanced Security

This exam is designed for professionals with experience in software development and security. This certification is aimed at individuals with a deep understanding of GitHub and its security features, as well as practical experience in securing software development workflows.

Level: Intermediate
Role: Administrator, Developer, DevOps Engineer, Solutions Architect, Student
Product: Digital and App Innovation - GitHub
Subject: DevOps