GitHub Advanced Security Cert Prep
6h 42mAdvanced2024-06-04
Authors
Microsoft Press
Microsoft
Tim Warner
Technical Trainer and Content Developer
Course details
GitHub is a game-changing automation platform that revolutionizes DevOps and CI/CD pipelines by allowing seamless automation of code builds, tests, and deployments right within your GitHub repository. As organizations shift toward microservices and cloud-native architectures, GitHub Actions emerges as a pivotal technology for automating, customizing, and scaling workflows, thereby accelerating development cycles and achieving operational excellence.
In a world where cyber threats are escalating, mastering the advanced security features of the GitHub platform is integral to modern development workflows is non-negotiable. This course covers everything from secret scanning and dependency management to CodeQL and GitHub Enterprise configurations, ensuring you're well-prepared to pass the GitHub Advanced Security certification exam and implement top-notch security measures in your projects. No fluff, just the skills you need for real-world impact.
In a world where cyber threats are escalating, mastering the advanced security features of the GitHub platform is integral to modern development workflows is non-negotiable. This course covers everything from secret scanning and dependency management to CodeQL and GitHub Enterprise configurations, ensuring you're well-prepared to pass the GitHub Advanced Security certification exam and implement top-notch security measures in your projects. No fluff, just the skills you need for real-world impact.
Skills covered
Software Development SecurityVersion ControlGitHubSoftware Development ToolsCybersecurityCert PrepSoftware Development
Concepts
0. Introduction
- 01 - Introduction
1. Unveil GHAS Security Features
- 02 - Learning objectives
- 03 - Differentiate security features with open-source projects and the features available when GHAS pairs with GHEC or GHES
- 04 - Describe the features and benefits of a security overview
- 05 - Describe the differences between secret scanning and code scanning
- 06 - Describe how secret scanning, code scanning, and Dependabot create a more secure software development lifecycle
- 07 - Contrast a security scenario with an isolated security review and an advanced scenario
2. Harness GHAS Features
- 08 - Learning objectives
- 09 - Describe how vulnerable dependencies are identified
- 10 - Explain how to act on alerts from GHAS
- 11 - Explain the implications of ignoring an alert
- 12 - Explain the role of a developer when they discover a security alert
- 13 - Describe the differences in access management to view alerts for different security features
- 14 - Describe a security policy in a GitHub repository
- 15 - Identify where to use Dependabot alerts in the software development lifecycle
3. Implement Secret Scanning
- 16 - Learning objectives
- 17 - Describe secret scanning
- 18 - Choose when secret scanning occurs
- 19 - Contrast secret scanning availability for public and private repositories
- 20 - Enable secret scanning for private repositories
- 21 - Enable secret scanning for an organization
- 22 - Explain how to pick an appropriate response to a secret scanning alert
- 23 - Determine if an alert is generated for a given secret, pattern, or service provider
- 24 - Determine if a given user role will see secret scanning alerts
4. Tailor Secret Scanning
- 25 - Learning objectives
- 26 - Configure the recipients of a secret scanning alert
- 27 - Describe how to exclude certain files from being scanned for secrets
- 28 - Explain how to enable custom secret scanning for a repository
- 29 - Explain how to enable custom secret scanning for an organization
5. Explore Dependency Vulnerability Tools
- 30 - Learning objectives
- 31 - Define a vulnerability
- 32 - Describe Dependabot alerts
- 33 - Describe Dependabot security updates
- 34 - Define the dependency graph
- 35 - Describe how the dependency graph is generated
- 36 - Describe how alerts are generated for vulnerable dependencies
6. Set Up Vulnerability Management Tools
- 37 - Learning objectives
- 38 - Identify the default settings for Dependabot alerts in public and private repositories
- 39 - Identify the permissions and roles required to enable Dependabot alerts
- 40 - Identify the permissions and roles required to view Dependabot alerts
- 41 - Enable Dependabot alerts for private repositories
- 42 - Enable Dependabot alerts for organizations
- 43 - Create a valid Dependabot configuration file
- 44 - Configure notifications for vulnerable dependencies
7. Resolve Vulnerable Dependencies
- 45 - Learning objectives
- 46 - Identify a vulnerable dependency from a Dependabot alert
- 47 - Identify vulnerable dependencies from a pull request
- 48 - Enable Dependabot security updates
- 49 - Remedy a vulnerability from a Dependabot alert in the Security tab
- 50 - Remedy a vulnerability from a Dependabot alert in the context of a pull request
- 51 - Act on any Dependabot alerts by testing and merging pull requests
8. Initiate Code Scanning
- 52 - Learning objectives
- 53 - Describe code scanning
- 54 - List the steps for enabling code scanning in a repository using GitHub Actions
- 55 - Enable code scanning for use with a CodeQL analysis workflow
- 56 - Describe how code scanning relates to GitHub Actions consumption
9. Integrate Third-Party Code Scanning
- 57 - Learning objectives
- 58 - Enable code scanning for use with third-party analysis
- 59 - Contrast the steps for using CodeQL versus third-party analysis when enabling code scanning
- 60 - Contrast how to implement CodeQL analysis in a GitHub Actions workflow versus a third-party CI tool
10. Configure Code Scanning
- 61 - Learning objectives
- 62 - Describe how code scanning fits in the software development lifecycle
- 63 - Contrast the frequency of code scanning workflows
- 64 - Choose a triggering event for a given development pattern
- 65 - Edit the default template for the Actions workflow to fit an active, open-source, production repository
11. Discover CodeQL Scanning Capabilities
- 66 - Learning objectives
- 67 - Describe CodeQL
- 68 - Define a QL pack, code query, and code suite
- 69 - Describe the default CodeQL query suites
- 70 - Describe how CodeQL analyzes code and produces results
12. Apply CodeQL Scanning
- 71 - Learning objectives
- 72 - Introduce a CodeQL analysis workflow to a repository
- 73 - List the locations in which CodeQL queries can be specified for use with code scanning
- 74 - Configure the language matrix in a CodeQL workflow
- 75 - Reference a CodeQL query from a public repository within a code scanning workflow
- 76 - Reference a CodeQL query from a private repository within a code scanning workflow
- 77 - Reference a CodeQL query from a local directory within a code scanning workflow
- 78 - Reference a configuration file within the same repository
- 79 - Reference a configuration file in a remote public repository
- 80 - Execute code scanning with the CodeQL CLI
- 81 - Contrast the steps to execute code scanning in GitHub Actions vs. the CodeQL CLI
13. Triage CodeQL Analysis Results
- 82 - Learning objectives
- 83 - Describe how to view code scanning results from CodeQL analysis
- 84 - Troubleshoot a failing code scanning workflow using CodeQL
- 85 - Follow the data flow through code using the show paths experience
- 86 - Explain the reason for a code scanning alert given documentation linked from the alert
- 87 - Determine if and why a code scanning alert needs to be dismissed
- 88 - Describe potential shortfalls in CodeQL via a model of compilation and language support
- 89 - Optimize CodeQL analysis runtimes
14. Incorporate External Scanning Tools
- 90 - Learning objectives
- 91 - Explain how to upload third-party SARIF results via the SARIF endpoint
- 92 - Explain the purpose of defining a SARIF category
15. Implement GHAS Best Practices
- 93 - Learning objectives
- 94 - Use a CVE and CWE to describe a GitHub Advanced Security alert and list potential remediation
- 95 - Advanced security alert and list potential remediation
- 96 - Describe the decision-making process for closing and dismissing security alerts
- 97 - Determine the roles and responsibilities of development and security teams on a software development workflow
- 98 - Explain how to set a review cadence with security teams when appropriate
- 99 - Use security policies to instruct all contributors to better secure their repositories
- 100 - Compare the code scanning alert against the repository's security policy
- 101 - Align repository branch protection configuration with written security policies
16. Administer GitHub Advanced Security
- 102 - Learning objectives
- 103 - Explain how GitHub Advanced Security features are enabled on GitHub Enterprise Server
- 104 - Explain how GitHub Advanced Security features are enabled for an organization
- 105 - Set security policies for a repository
- 106 - Set security policies for an organization
- 107 - Describe how permissions are interpreted throughout a security workflow
- 108 - Locate API endpoints for GHAS features, like secret scanning, code scanning, and Dependabot
- 109 - List stakeholders that need to be involved in the security workflows enabled by GHAS
- 110 - Configure code scanning within a repository or organization using the default CodeQL workflow
- 111 - Identify the custom build steps necessary in a CodeQL workflow
Conclusion
- 112 - Summary