GitHub Advanced Security Cert Prep
6h 42mAdvanced2024-06-04
Authors
Microsoft Press
Microsoft
Tim Warner
Technical Trainer and Content Developer
Course details
GitHub is a game-changing automation platform that revolutionizes DevOps and CI/CD pipelines by allowing seamless automation of code builds, tests, and deployments right within your GitHub repository. As organizations shift toward microservices and cloud-native architectures, GitHub Actions emerges as a pivotal technology for automating, customizing, and scaling workflows, thereby accelerating development cycles and achieving operational excellence.
In a world where cyber threats are escalating, mastering the advanced security features of the GitHub platform is integral to modern development workflows is non-negotiable. This course covers everything from secret scanning and dependency management to CodeQL and GitHub Enterprise configurations, ensuring you're well-prepared to pass the GitHub Advanced Security certification exam and implement top-notch security measures in your projects. No fluff, just the skills you need for real-world impact.
In a world where cyber threats are escalating, mastering the advanced security features of the GitHub platform is integral to modern development workflows is non-negotiable. This course covers everything from secret scanning and dependency management to CodeQL and GitHub Enterprise configurations, ensuring you're well-prepared to pass the GitHub Advanced Security certification exam and implement top-notch security measures in your projects. No fluff, just the skills you need for real-world impact.
Skills covered
Software Development SecurityVersion ControlGitHubSoftware Development ToolsCert PrepCybersecuritySoftware Development
Concepts
Introduction
- Introduction
Unveil GHAS Security Features
- Learning objectives
- Differentiate security features with open-source projects and the features available when GHAS pairs with GHEC or GHES
- Describe the features and benefits of a security overview
- Describe the differences between secret scanning and code scanning
- Describe how secret scanning, code scanning, and Dependabot create a more secure software development lifecycle
- Contrast a security scenario with an isolated security review and an advanced scenario
Harness GHAS Features
- Learning objectives
- Describe how vulnerable dependencies are identified
- Explain how to act on alerts from GHAS
- Explain the implications of ignoring an alert
- Explain the role of a developer when they discover a security alert
- Describe the differences in access management to view alerts for different security features
- Describe a security policy in a GitHub repository
- Identify where to use Dependabot alerts in the software development lifecycle
Implement Secret Scanning
- Learning objectives
- Describe secret scanning
- Choose when secret scanning occurs
- Contrast secret scanning availability for public and private repositories
- Enable secret scanning for private repositories
- Enable secret scanning for an organization
- Explain how to pick an appropriate response to a secret scanning alert
- Determine if an alert is generated for a given secret, pattern, or service provider
- Determine if a given user role will see secret scanning alerts
Tailor Secret Scanning
- Learning objectives
- Configure the recipients of a secret scanning alert
- Describe how to exclude certain files from being scanned for secrets
- Explain how to enable custom secret scanning for a repository
- Explain how to enable custom secret scanning for an organization
Explore Dependency Vulnerability Tools
- Learning objectives
- Define a vulnerability
- Describe Dependabot alerts
- Describe Dependabot security updates
- Define the dependency graph
- Describe how the dependency graph is generated
- Describe how alerts are generated for vulnerable dependencies
Set Up Vulnerability Management Tools
- Learning objectives
- Identify the default settings for Dependabot alerts in public and private repositories
- Identify the permissions and roles required to enable Dependabot alerts
- Identify the permissions and roles required to view Dependabot alerts
- Enable Dependabot alerts for private repositories
- Enable Dependabot alerts for organizations
- Create a valid Dependabot configuration file
- Configure notifications for vulnerable dependencies
Resolve Vulnerable Dependencies
- Learning objectives
- Identify a vulnerable dependency from a Dependabot alert
- Identify vulnerable dependencies from a pull request
- Enable Dependabot security updates
- Remedy a vulnerability from a Dependabot alert in the Security tab
- Remedy a vulnerability from a Dependabot alert in the context of a pull request
- Act on any Dependabot alerts by testing and merging pull requests
Initiate Code Scanning
- Learning objectives
- Describe code scanning
- List the steps for enabling code scanning in a repository using GitHub Actions
- Enable code scanning for use with a CodeQL analysis workflow
- Describe how code scanning relates to GitHub Actions consumption
Integrate Third-Party Code Scanning
- Learning objectives
- Enable code scanning for use with third-party analysis
- Contrast the steps for using CodeQL versus third-party analysis when enabling code scanning
- Contrast how to implement CodeQL analysis in a GitHub Actions workflow versus a third-party CI tool
Configure Code Scanning
- Learning objectives
- Describe how code scanning fits in the software development lifecycle
- Contrast the frequency of code scanning workflows
- Choose a triggering event for a given development pattern
- Edit the default template for the Actions workflow to fit an active, open-source, production repository
Discover CodeQL Scanning Capabilities
- Learning objectives
- Describe CodeQL
- Define a QL pack, code query, and code suite
- Describe the default CodeQL query suites
- Describe how CodeQL analyzes code and produces results
Apply CodeQL Scanning
- Learning objectives
- Introduce a CodeQL analysis workflow to a repository
- List the locations in which CodeQL queries can be specified for use with code scanning
- Configure the language matrix in a CodeQL workflow
- Reference a CodeQL query from a public repository within a code scanning workflow
- Reference a CodeQL query from a private repository within a code scanning workflow
- Reference a CodeQL query from a local directory within a code scanning workflow
- Reference a configuration file within the same repository
- Reference a configuration file in a remote public repository
- Execute code scanning with the CodeQL CLI
- Contrast the steps to execute code scanning in GitHub Actions vs. the CodeQL CLI
Triage CodeQL Analysis Results
- Learning objectives
- Describe how to view code scanning results from CodeQL analysis
- Troubleshoot a failing code scanning workflow using CodeQL
- Follow the data flow through code using the show paths experience
- Explain the reason for a code scanning alert given documentation linked from the alert
- Determine if and why a code scanning alert needs to be dismissed
- Describe potential shortfalls in CodeQL via a model of compilation and language support
- Optimize CodeQL analysis runtimes
Incorporate External Scanning Tools
- Learning objectives
- Explain how to upload third-party SARIF results via the SARIF endpoint
- Explain the purpose of defining a SARIF category
Implement GHAS Best Practices
- Learning objectives
- Use a CVE and CWE to describe a GitHub Advanced Security alert and list potential remediation
- Advanced security alert and list potential remediation
- Describe the decision-making process for closing and dismissing security alerts
- Determine the roles and responsibilities of development and security teams on a software development workflow
- Explain how to set a review cadence with security teams when appropriate
- Use security policies to instruct all contributors to better secure their repositories
- Compare the code scanning alert against the repository's security policy
- Align repository branch protection configuration with written security policies
Administer GitHub Advanced Security
- Learning objectives
- Explain how GitHub Advanced Security features are enabled on GitHub Enterprise Server
- Explain how GitHub Advanced Security features are enabled for an organization
- Set security policies for a repository
- Set security policies for an organization
- Describe how permissions are interpreted throughout a security workflow
- Locate API endpoints for GHAS features, like secret scanning, code scanning, and Dependabot
- List stakeholders that need to be involved in the security workflows enabled by GHAS
- Configure code scanning within a repository or organization using the default CodeQL workflow
- Identify the custom build steps necessary in a CodeQL workflow
Conclusion
- Summary