GitHub Advanced Security (GHAS) Certification Prep - GH-500T00-A

This 1-day course prepares software developers and security experts for the GitHub Advanced Security (GHAS) certification exam.

Full Description and Outline

Upcoming Classes

Don't see a date that fits your schedule? Contact us for scheduling options at 929.777.8102

Select a learning mode button (Public, Live Virtual, etc.) for pricing, details, and a downloadable fact sheet.

Description

GitHub Advanced Security (GHAS) plays a crucial role in enhancing the security posture of software development projects on GitHub.

It provides a comprehensive set of tools and features designed to identify and address security vulnerabilities throughout the development lifecycle. By integrating security directly into the development process with GHAS, your team can build more secure and reliable software. The course will explore how to utilize GHAS to maximize security impact and understand GHAS and its role in the security ecosystem.

Key takeaways from this class include:

Understand GHAS security features and functionality
Configure and use secret scanning
Configure and use dependency management
Configure and use code scanning
Use code scanning with CodeQL
Identify GitHub Advanced Security best practices
Configure GitHub Advanced Security tools in GitHub Enterprise

Who Should Attend

Security Engineers looking to improve their organization's security posture.
Developers looking to write more secure code and utilize GHAS features effectively.
DevOps Engineers who want to incorporate GHAS into their CI/CD pipelines to automate security checks and ensure continuous security.
Security Analysts working to identify and prioritize security threats.
Anyone preparing for the GitHub Advanced Security Certification.

Prerequisites

Students must have their own personal GitHub account for use in the class. Sign up for free at github.com.
A foundational understanding of the GitHub platform and its tools and features.
Basic understanding of YAML syntax and creating GitHub actions and workflows.

GitHub Copilot Certification Exam
This course prepares you for the GitHub Advanced Security (GHAS) certification exam. The GHAS certification exam is designed for individuals who have a deep understanding of GitHub and its security features, as well as hands-on experience in securing software development workflows. Learn more about GitHub certifications here. We provide an exam voucher as an optional additional add-on with your registration.

Questions? 929.777.8102 [email protected]

Course Outline

Describe the GHAS security features and functionality
Understand GHAS and its role in the security ecosystem

Contrast GHAS features and their role in the broader security landscape
Differentiate features available to open source projects vs. those available with GHAS + GHEC/GHES
Describe the features and benefits of Security Overview
Describe the differences between secret scanning and code scanning
Describe how secret scanning, code scanning, and Dependabot contribute to a secure SDLC
Contrast isolated security reviews with integrated security across the SDLC

Use specific GHAS features effectively

Explain and use specific GHAS features
Describe how vulnerable dependencies are identified via manifest files and vulnerability databases
Choose appropriate actions in response to GHAS alerts
Explain the implications of ignoring a security alert
Explain the developer's role in addressing security alerts
Describe differences in access levels for viewing alerts across GHAS features
Identify when to use Dependabot alerts during the SDLC

Configure and use secret scanning
Set up and understand secret scanning

Configure and use Secret Scanning
Describe what secret scanning does
Describe push protection and how it works
Describe validity checks used in secret scanning
Contrast secret scanning availability in public vs. private repos
Enable secret scanning for private repositories

Respond to and customize secret scanning alerts

Choose how to respond to secret scanning alerts
Determine if an alert will be generated for a given secret, pattern, or service provider
Identify whether a user role will see alerts and how they’re notified
Configure recipients of a secret scanning alert
Provide alert access to members or teams outside of admins
Exclude specific files from secret scanning
Enable custom secret scanning for a repository

Configure and use Dependabot and Dependency Review
Understand and describe dependency management tools

Define the dependency graph
Describe how the dependency graph is generated
Describe the Software Bill of Materials (SBOM) and GitHub’s SBOM format
Define a dependency vulnerability
Describe Dependabot alerts and security updates
Describe Dependency Review and how it works
Explain how alerts are generated from the dependency graph using the GitHub Advisory Database
Describe the difference between Dependabot and Dependency Review

Configure tools for managing vulnerable dependencies

Identify default Dependabot alert settings for public and private repos
Identify permissions required to enable/view Dependabot alerts
Enable Dependabot alerts for private repos and organizations
Create a valid Dependabot config file to group updates
Create a rule to auto-dismiss low severity alerts
Create a Dependency Review GitHub Actions workflow
Configure license checks and severity thresholds in Dependency Review
Configure notifications for vulnerable dependencies

Identify and remediate vulnerable dependencies

Identify vulnerabilities from alerts or pull requests
Enable Dependabot security updates
Remedy vulnerabilities via the Security tab or pull requests
Take action on alerts by testing and merging Dependabot PRs

Configure and use Code Scanning with CodeQL
Enable and use code scanning tools

Enable code scanning with third-party analysis tools
Contrast CodeQL setup vs. third-party analysis
Implement CodeQL in GitHub Actions vs. third-party CI
Upload SARIF results via the SARIF endpoint

Understand and interpret CodeQL results

Describe how code scanning fits into the SDLC
Contrast scheduled and event-triggered workflows
Choose appropriate triggers (e.g., PRs, specific file paths)
Edit the default GitHub Actions workflow for production use
View and interpret CodeQL scan results
Troubleshoot failing workflows and customize configs
Use the "show paths" experience to follow data flow
Explain alerts using linked documentation
Determine when and why to dismiss alerts
Describe CodeQL limitations (e.g., compilation model, language support)
Explain the purpose of SARIF categories

Describe GitHub Advanced Security best practices, results, and how to take corrective measures

Apply best practices and interpret GHAS results

Use CVE and CWE references to describe alerts and recommend fixes
Explain the process for closing or dismissing alerts (with documentation)
Describe default CodeQL query suites
Explain how CodeQL analyzes compiled vs. interpreted code
Clarify dev vs. security team roles in a secure workflow
Adjust severity thresholds for pull request checks
Prioritize secret scanning alerts using filters (e.g., validity:active)
Prioritize secret scanning alerts using filters (e.g., validity:active)
Enforce CodeQL and Dependency Review via repository rulesets
Enable code scanning on PRs to catch vulnerabilities earlier
Enable push protection for secret scanning during PRs
Enable dependency review to scan dependencies earlier in the process

Don't see a date that fits your schedule? Contact us for scheduling options at 929.777.8102

Download Fact Sheet

Price: $700 USD

Course Duration: 1

Description

GitHub Advanced Security (GHAS) plays a crucial role in enhancing the security posture of software development projects on GitHub.

It provides a comprehensive set of tools and features designed to identify and address security vulnerabilities throughout the development lifecycle. By integrating security directly into the development process with GHAS, your team can build more secure and reliable software. The course will explore how to utilize GHAS to maximize security impact and understand GHAS and its role in the security ecosystem.

Key takeaways from this class include:

Understand GHAS security features and functionality
Configure and use secret scanning
Configure and use dependency management
Configure and use code scanning
Use code scanning with CodeQL
Identify GitHub Advanced Security best practices
Configure GitHub Advanced Security tools in GitHub Enterprise

Who Should Attend

Security Engineers looking to improve their organization's security posture.
Developers looking to write more secure code and utilize GHAS features effectively.
DevOps Engineers who want to incorporate GHAS into their CI/CD pipelines to automate security checks and ensure continuous security.
Security Analysts working to identify and prioritize security threats.
Anyone preparing for the GitHub Advanced Security Certification.

Prerequisites

Students must have their own personal GitHub account for use in the class. Sign up for free at github.com.
A foundational understanding of the GitHub platform and its tools and features.
Basic understanding of YAML syntax and creating GitHub actions and workflows.

GitHub Copilot Certification Exam
This course prepares you for the GitHub Advanced Security (GHAS) certification exam. The GHAS certification exam is designed for individuals who have a deep understanding of GitHub and its security features, as well as hands-on experience in securing software development workflows. Learn more about GitHub certifications here. We provide an exam voucher as an optional additional add-on with your registration.

Questions? 929.777.8102 [email protected]

Course Outline

Describe the GHAS security features and functionality
Understand GHAS and its role in the security ecosystem

Contrast GHAS features and their role in the broader security landscape
Differentiate features available to open source projects vs. those available with GHAS + GHEC/GHES
Describe the features and benefits of Security Overview
Describe the differences between secret scanning and code scanning
Describe how secret scanning, code scanning, and Dependabot contribute to a secure SDLC
Contrast isolated security reviews with integrated security across the SDLC

Use specific GHAS features effectively

Explain and use specific GHAS features
Describe how vulnerable dependencies are identified via manifest files and vulnerability databases
Choose appropriate actions in response to GHAS alerts
Explain the implications of ignoring a security alert
Explain the developer's role in addressing security alerts
Describe differences in access levels for viewing alerts across GHAS features
Identify when to use Dependabot alerts during the SDLC

Configure and use secret scanning
Set up and understand secret scanning

Configure and use Secret Scanning
Describe what secret scanning does
Describe push protection and how it works
Describe validity checks used in secret scanning
Contrast secret scanning availability in public vs. private repos
Enable secret scanning for private repositories

Respond to and customize secret scanning alerts

Choose how to respond to secret scanning alerts
Determine if an alert will be generated for a given secret, pattern, or service provider
Identify whether a user role will see alerts and how they’re notified
Configure recipients of a secret scanning alert
Provide alert access to members or teams outside of admins
Exclude specific files from secret scanning
Enable custom secret scanning for a repository

Configure and use Dependabot and Dependency Review
Understand and describe dependency management tools

Define the dependency graph
Describe how the dependency graph is generated
Describe the Software Bill of Materials (SBOM) and GitHub’s SBOM format
Define a dependency vulnerability
Describe Dependabot alerts and security updates
Describe Dependency Review and how it works
Explain how alerts are generated from the dependency graph using the GitHub Advisory Database
Describe the difference between Dependabot and Dependency Review

Configure tools for managing vulnerable dependencies

Identify default Dependabot alert settings for public and private repos
Identify permissions required to enable/view Dependabot alerts
Enable Dependabot alerts for private repos and organizations
Create a valid Dependabot config file to group updates
Create a rule to auto-dismiss low severity alerts
Create a Dependency Review GitHub Actions workflow
Configure license checks and severity thresholds in Dependency Review
Configure notifications for vulnerable dependencies

Identify and remediate vulnerable dependencies

Identify vulnerabilities from alerts or pull requests
Enable Dependabot security updates
Remedy vulnerabilities via the Security tab or pull requests
Take action on alerts by testing and merging Dependabot PRs

Configure and use Code Scanning with CodeQL

Enable and use code scanning tools

Enable code scanning with third-party analysis tools
Contrast CodeQL setup vs. third-party analysis
Implement CodeQL in GitHub Actions vs. third-party CI
Upload SARIF results via the SARIF endpoint

Understand and interpret CodeQL results

Describe how code scanning fits into the SDLC
Contrast scheduled and event-triggered workflows
Choose appropriate triggers (e.g., PRs, specific file paths)
Edit the default GitHub Actions workflow for production use
View and interpret CodeQL scan results
Troubleshoot failing workflows and customize configs
Use the "show paths" experience to follow data flow
Explain alerts using linked documentation
Determine when and why to dismiss alerts
Describe CodeQL limitations (e.g., compilation model, language support)
Explain the purpose of SARIF categories

Describe GitHub Advanced Security best practices, results, and how to take corrective measures
Apply best practices and interpret GHAS results

Use CVE and CWE references to describe alerts and recommend fixes
Explain the process for closing or dismissing alerts (with documentation)
Describe default CodeQL query suites
Explain how CodeQL analyzes compiled vs. interpreted code
Clarify dev vs. security team roles in a secure workflow
Adjust severity thresholds for pull request checks
Prioritize secret scanning alerts using filters (e.g., validity:active)
Prioritize secret scanning alerts using filters (e.g., validity:active)
Enforce CodeQL and Dependency Review via repository rulesets
Enable code scanning on PRs to catch vulnerabilities earlier
Enable push protection for secret scanning during PRs
Enable dependency review to scan dependencies earlier in the process

Instructors

Connor Owen

Connor Bottum has spent nearly a decade working on all aspects of the Software Development Lifecycle including Software Development, Quality Assurance, and Cybersecurity. As a Certified Information Systems Security Professional (CISSP) and Software Development educator, Connor's main goal is to ensure your software not only works but is robust and...Learn More

Phil LaFrance

Phil LaFrance is a software engineer very experienced in working in super fast-paced and agile environments where ambiguity is common and the need to be constantly learning is a requirement. Some of his favorite challenges are tackling difficult tasks that require learning and thought to solve. Prior to joining Coveros,...Learn More

Questions?

Get in Touch Ways To Save

GitHub Advanced Security (GHAS) Certification Prep - GH-500T00-A

Upcoming Classes

Connor Owen

Phil LaFrance

Questions?

On-Site/Private Training

Let us bring the learning to your team at your location or in an interactive virtual classroom!
Choose from more than 50 courses.

Combine World-Class Training and

Certification with a Conference

Maximize Your Learning Potential

GitHub Advanced Security (GHAS) Certification Prep - GH-500T00-A

Upcoming Classes

Connor Owen

Phil LaFrance

Questions?

On-Site/Private Training

Let us bring the learning to your team at your location or in an interactive virtual classroom!Choose from more than 50 courses.

Combine World-Class Training and

Certification with a Conference

Maximize Your Learning Potential

Never Miss a Thing.

Let us bring the learning to your team at your location or in an interactive virtual classroom!
Choose from more than 50 courses.