GH-500: GitHub Advanced Security

GH-500 Course: GitHub Advanced Security

GitHub Advanced Security (GHAS) plays a crucial role in improving the security of software development projects on GitHub . It provides a comprehensive set of tools and features designed to identify and address security vulnerabilities throughout the development cycle. By integrating security directly into the development process with GHAS , your team can build more secure and reliable software. The course will explore how to use GHAS to maximize security impact and understand its role in the security ecosystem.

Intermediate - GitHub - Administrator, DevOps Engineer

Course aimed at

This course is intended for students who want to understand and implement advanced security practices with GitHub Advanced Security (GHAS) .

• They will learn how to significantly optimize software development processes and create a more resilient and secure development ecosystem through developer-centric solutions to ensure the security of code, supply chain, and secrets before their release to production.
• They will discover how GHAS provides security teams with visibility into the entire organization's security posture and supply chain, as well as unparalleled access to curated security intelligence from millions of security developers and researchers around the world.

Course objectives

Upon completion of this course, students will be able to:

• Understanding GitHub Advanced Security Features
• Recognize, apply, and evaluate these features in your own GitHub environment

Elements of the GH-500 formation

• Advanced GitHub Security, Part 1 of 2 (8 modules)
• Advanced GitHub Security, Part 2 of 2 (4 modules)

GH-300 Course Content

Module 1: Introduction to GitHub Advanced Security

• Definition of GHAS and the importance of its comprehensive characteristics
• Procedures for using GHAS for maximum impact
• Description of GHAS and its role in the security ecosystem

Module 2: Configuring Dependabot security updates on the GitHub repository

• Managing dependencies on GitHub
• Dependabot Alerts
  
• Dependabot security updates
  
• Managing Dependabot Notifications and Reports
  
• Dependency Review
  
• Exercise: Configuring Dependabot Security Updates

Module 3: Configuring and Using Secret Scanning in Your GitHub Repository

• What is the secrets exam?
• Configuring Secret Scanning
• Using the secrets exam
• ExerciseModule 4: Using advanced GitHub Copilot features

Module 4: Setting Up Code Review on GitHub

• What is code testing?
• Enabling code review with third-party tools
  
• Setting up code scanning
  
• Code Exam Setup Exercise

Module 5: Identify security vulnerabilities in your codebase using CodeQL

• Preparing a database for CodeQL
  
• Running CodeQL on a database
  
• Information about CodeQL results
  
• Troubleshooting CodeQL results

Module 6: Scanning Code with GitHub CodeQL

• What is CodeQL?
  
• How does CodeQL parse code?
  
• What is QL?
  
• Code Review and CodeQL
  
• Customizing Your Code Review Workflow with CodeQL: Part 1
  
• Exercise: Referencing a CodeQL query
  
• Customizing Your Code Review Workflow with CodeQL: Part 2
  
• Using the CodeQL CLI
  
• Customizing languages ​​and builds for code review.
  
• Exercise: Setting up a CodeQL language array

Module 7: GitHub Administration for GitHub Advanced Security

• What is GitHub Advanced Security?
• Enable GitHub Advanced Security
  
• Managing Access to GitHub Advanced Security
  
• Managing GitHub Advanced Security features and alerts

Module 8: Managing sensitive data and security policies within GitHub

• Enabling security policies
  
• Creating and managing repository rule sets.
  
• Reporting and logging
  
• Exercise

Prerequisites

Students must have:

• A GitHub account
• Knowledge of GitHub basics

Language

• Course: English

• Labs: English

Microsoft Certification (To be released in May 2025)

It will be published in May 2025

Level:
Role:
Product:
Subject: Digital & App Innovation