GitHub Advanced Security (GHAS) plays a crucial role in enhancing the security posture of software development projects on GitHub. It provides a comprehensive set of tools and features designed to identify and address security vulnerabilities throughout the development lifecycle. By integrating security directly into the development process with GHAS, your team can build more secure and reliable software. The course will explore how to utilize GHAS to maximize security impact and understand GHAS and its role in the security ecosystem.
Learning objectives:
- Understand and configure GitHub Advanced Security features.
- Implement Dependabot for automated dependency updates.
- Set up and manage secret scanning to protect sensitive information.
- Configure code scanning using CodeQL for vulnerability detection.
- Analyze and interpret CodeQL scan results.
- Administer security policies and manage sensitive data within GitHub.
Course modules:
Introduction to GitHub Advanced Security
- Define GHAS and the importance of the integral features such as Secret scanning, Code scanning, and Dependabot
- Know how to utilize GHAS to maximize security impact
- Understand GHAS and its role in the security ecosystem
Configure Dependabot security updates on your GitHub repo
- Describe the available tools for managing vulnerable dependencies on GitHub.
- Enable and configure Dependabot alerts.
- Identify the permissions and roles required to view and enable Dependabot alerts.
- Enable and configure Dependabot security updates.
- Identify, review, and address vulnerable dependencies.
- Explain how to use GraphQL API to retrieve vulnerability information.
- Explain how to configure notifications for vulnerable dependencies.
- Lab: Configure Dependabot security updates
Configure and use secret scanning in your GitHub repository
- Describe secret scanning.
- Configure secret scanning.
- Use secret scanning.
Configure code scanning on GitHub
- Describe code scanning.
- List the steps for enabling code scanning in a repository.
- List the steps for enabling code scanning with third-party analysis.
- Contrast how to implement CodeQL analysis in a GitHub Actions workflow versus a third-party continuous integration (CI) tool.
- Explain how to configure code scanning on a repository using triggering events.
- Contrast the frequency of code scanning workflows (scheduled vs triggered by events).
Identify security vulnerabilities in your codebase by using CodeQL
- Create a database by using CodeQL to extract a single relational representation of each source file in the codebase.
- Run CodeQL in a database to find problems in your source code and find potential security vulnerabilities.
- Understand CodeQL scan results by using GitHub-created queries or your own custom queries.
Code scanning with GitHub CodeQL
- Understand CodeQL and how it analyzes code.
- Understand QL, a unique logic programming language.
- Set up CodeQL based code scanning in a GitHub repository.
- Reference a custom CodeQL query.
- Configure the language matrix in a CodeQL workflow.
- Learn how to use the CodeQL CLI to generate code scanning results and upload them to GitHub.
- Implement custom build steps.
- Lab: Reference a CodeQL query
- Lab: Configure a CodeQL language matrix
GitHub administration for GitHub Advanced Security
- Understand what GitHub Advanced Security is and how to use it in the software development lifecycle.
- Identify which GitHub Advanced Security features are available for open-source projects and which are available on enterprise products.
- Enable the different features of GitHub Advanced Security on different enterprise products.
- Determine who should get access to GitHub Advanced Security features in an organization and grant the correct permissions.
- Set security policies at the organization and repository levels.
- Understand how to respond to a security alert.
- Use the Security Overview to monitor security alerts.
- Use the GitHub Advanced Security API endpoints to manage the GitHub
- Advanced Security features and alerts.
Manage sensitive data and security policies within GitHub
- Create documentation that details security guidelines and useful information for collaborators.
- Set permissions and other rules.
- Automate processes that prevent security breaches.
- Respond to security breaches.
This course leads to the GH-500: GitHub Advanced Security certification. See studyguide. Passing score 700 points. The exam can be conducted online from anywhere or in one of our testcenters in Oslo or Trondheim.
FAQ – GH-500: GitHub Advanced Security
Hva koster kurset?
Prisen er 12 000 NOK. Kurset inkluderer digital kursdokumentasjon og hands-on labs. Lunsj og forfriskninger er inkludert ved klasseromskurs.
Hvor lenge varer kurset?
Kurset går over 1 dag fra kl. 09.00 til 16.00.
Hvordan gjennomføres kurset?
Kurset gjennomføres med engelsk kursdokumentasjon og engelsktalende instruktør. Undervisningen kombinerer faglig gjennomgang med praktiske labs i GitHub Advanced Security.
Hvem passer kurset for?
Kurset passer for fagpersoner som jobber med GitHub, DevOps og sikkerhet i programvareutvikling.
- Administratorer
- DevOps Engineers
- Utviklere med ansvar for sikker kode
- Security Engineers
- Team som jobber med secure software development lifecycle
Hvilke forkunnskaper kreves?
Det er ingen formelle forkunnskaper for dette kurset.
Hva lærer jeg i løpet av kurset?
Du lærer hvordan GitHub Advanced Security kan brukes til å identifisere og håndtere sikkerhetsrisiko gjennom hele utviklingsprosessen. Etter kurset vil du kunne:
- Forstå og konfigurere GitHub Advanced Security-funksjoner
- Sette opp Dependabot for automatiserte dependency updates
- Konfigurere secret scanning for å beskytte sensitiv informasjon
- Konfigurere code scanning med CodeQL
- Analysere og tolke CodeQL scan results
- Administrere sikkerhetspolicyer i GitHub
- Håndtere sensitive data og respondere på security alerts
Er kurset praktisk rettet?
Ja. Kurset inkluderer hands-on labs hvor deltakerne konfigurerer Dependabot, secret scanning, CodeQL og GitHub Advanced Security-funksjoner i praksis.
Hvilke temaer dekkes i kurset?
Kurset dekker blant annet:
- Introduksjon til GitHub Advanced Security
- Secret scanning
- Dependabot alerts og security updates
- Dependency management og sårbare avhengigheter
- Code scanning med GitHub CodeQL
- CodeQL queries, language matrix og CLI
- GitHub-administrasjon for Advanced Security
- Security policies og sensitive data i GitHub
Får jeg sertifisering etter kurset?
Kurset gir opplæring i GitHub Advanced Security og dekker temaer som er relevante for GH-500: GitHub Advanced Security. Eventuell sertifisering oppnås ved å bestå tilhørende eksamen.
Hva er GitHub Advanced Security?
GitHub Advanced Security er en samling sikkerhetsfunksjoner som hjelper utviklingsteam med å finne og håndtere sårbarheter, secrets og dependency-risiko direkte i GitHub og utviklingsflyten.
Hva gjør dette kurset nyttig?
Kurset gir praktisk kompetanse i hvordan sikkerhet kan integreres direkte i utviklingsprosessen, slik at team kan bygge mer sikre og pålitelige applikasjoner uten å skille sikkerhetsarbeidet fra utviklingsarbeidet.
Kan kurset leveres bedriftsinternt?
Ja. Kurset kan leveres både som åpent kurs og som bedriftsinternt kurs.
GitHub, Git & DevOps
Secure development & application security
Azure & Microsoft Security
