GitHub Advanced Security

By the end of this module, you'll be able to:

• Define GHAS and the importance of the integral features such as Secret scanning, Code scanning, and Dependabot
• Know how to utilize GHAS to maximize security impact
• Understand GHAS and its role in the security ecosystem

By the end of this module, you'll be able to:

• Describe the available tools for managing vulnerable dependencies on GitHub.
• Enable and configure Dependabot alerts.
• Identify the permissions and roles required to view and enable Dependabot alerts.
• Enable and configure Dependabot security updates.
• Identify, review, and address vulnerable dependencies.
• Explain how to use GraphQL API to retrieve vulnerability information.
• Explain how to configure notifications for vulnerable dependencies.

By the end of this module, you'll be able to:

• Describe secret scanning.
• Configure secret scanning.
• Use secret scanning.

After completing this module, you'll be able to:

• Describe code scanning.
• List the steps for enabling code scanning in a repository.
• List the steps for enabling code scanning with third-party analysis.
• Contrast how to implement CodeQL analysis in a GitHub Actions workflow versus a third-party continuous integration (CI) tool.
• Explain how to configure code scanning on a repository using triggering events.
• Contrast the frequency of code scanning workflows (scheduled vs triggered by events).

By the end of this module, you'll be able to:

• Create a database by using CodeQL to extract a single relational representation of each source file in the codebase.
• Run CodeQL in a database to find problems in your source code and find potential security vulnerabilities.
• Understand CodeQL scan results by using GitHub-created queries or your own custom queries.

By the end of this module, you'll be able to:

• Understand CodeQL and how it analyzes code.
• Understand QL, a unique logic programming language.
• Set up CodeQL based code scanning in a GitHub repository.
• Reference a custom CodeQL query.
• Configure the language matrix in a CodeQL workflow.
• Learn how to use the CodeQL CLI to generate code scanning results and upload them to GitHub.
• Implement custom build steps.

By the end of this module, you're able to:

• Understand what GitHub Advanced Security is and how to use it in the software development lifecycle.
• Identify which GitHub Advanced Security features are available for open-source projects and which are available on enterprise products.
• Enable the different features of GitHub Advanced Security on different enterprise products.
• Determine who should get access to GitHub Advanced Security features in an organization and grant the correct permissions.
• Set security policies at the organization and repository levels.
• Understand how to respond to a security alert.
• Use the Security Overview to monitor security alerts.
• Use the GitHub Advanced Security API endpoints to manage the GitHub Advanced Security features and alerts.

In this module, you'll learn how to:

• Create documentation that details security guidelines and useful information for collaborators.
• Set permissions and other rules.
• Automate processes that prevent security breaches.
• Respond to security breaches.