GitHub Advanced Security Certification

Learn what you need to know to pass the GitHub Advanced Security Certification.

Highlight your code security knowledge with the GitHub Advanced Security certification. Validate your expertise in vulnerability identification, workflow security, and robust security implementation—elevating software integrity standards.

⭐️ Course Contents ⭐️ GitHub Advanced Security Overview 00:00:00 Introduction 00:09:24 Git Overview 00:10:22 GitHub Overview 00:11:26 Git Terms 00:14:53 GitHub Repo Overview 00:15:46 Git Commit Overview 00:16:40 Git Branch Overview 00:17:52 Git Remote to Downstream or Upstream 00:18:28 Advanced Security Overview 00:19:08 GHAS Enabled Plans 00:21:02 GitHub Security 00:22:56 GHAS Use Cases 00:23:58 GHAS Components 00:25:03 Taking action on Alerts 00:26:38 How to enable GHAS 00:27:53 How to enable GHAS Automatically 00:29:14 Which GHAS do you have 00:30:13 GHAS Introduction Follow Along

Security Overview 00:41:27 What is a Security Vulnerability 00:42:41 Types of Security Vulnerabilities 00:43:54 0 Day Vulnerabilities 00:44:23 Most Common Vulnerabilities 00:44:51 Finding Vulnerabilities in GitHub 00:45:51 GitHub Advisory Database

Secret Scanning 00:46:56 Secret Scanning Overview 00:47:31 Secret Scanning Locations 00:47:58 Enabling Secret Scanning 00:48:09 Secret Scanning Partner Program 00:48:47 Partner Program Use Case 00:49:41 Starting a Scan 00:50:11 Scan Running Times 00:51:08 Secret Scanning Follow Along 00:53:45 Set Ignore Follow Along 00:57:05 Set Notifications Follow Along

Dependency Management 01:01:17 Open Source Popularity 01:01:42 Open Source Maintenance Problems 01:02:19 Dependency Graph for Open Source 01:02:36 Dependency Graph Examples 01:02:59 Dependabot Overview 01:03:19 Dependabot Use Case Example 01:04:27 Dependabot Features 01:05:10 Enabling Dependabot 01:05:40 Dependabot Licensing for Private Repos 01:05:58 Dependabot Private Repository Workflow 01:06:23 Triaging Dependabot Vulnerabilities 01:07:32 Dependabot Limitations 01:08:39 Dependabot Follow Along

Code Scanning 01:20:07 Code Scanning Overview 01:20:31 Supported Repositories 01:21:02 How Code Scanning Works 01:21:25 Starting a Scan 01:22:44 Code Scanning Setup Options 01:24:16 Where to Implement Scanning 01:25:17 Code Scanning Actions 01:25:35 Scanning Trigger Types 01:26:40 Code Scanning Follow Along

CodeQL 01:38:33 Enabling Code Scanning 01:39:00 Third Party SARIF Files Overview 01:39:39 Uploading Third Party SARIF Files 01:40:09 Third Party SARIF File Example 01:40:42 Default Code Scanning 01:41:36 Custom Code Scanning 01:41:58 Code Language Detection Scanning 01:42:34 CodeQL Database Analysis 01:43:15 CodeQL Query Analysis 01:44:10 Types of CodeQL Queries 01:44:52 CodeQL Queries DeepDive 01:45:42 Code Query Anatomy 01:47:29 Code Query Suite 01:47:52 Types of Code Query Suites 01:48:28 Code Query Findings 01:49:04 CodeQL Packs 01:50:08 Code Scanning Workflow 01:50:50 CodeQL Partner Integrations 01:51:25 Workflow Priority Order 01:51:55 Alerts Workflow 01:53:08 Alerts Security Incident Example 01:54:12 CodeQL Follow Along

GHAS Best Practices 02:17:40 Software Development Lifecycle SDLC 02:18:30 SDLC Restricting Access 02:19:11 SDLC Security Overview 02:19:54 SDLC Security Policies 02:20:28 SDLC Secret Scanning 02:21:10 SDLC Security Workflow 02:22:02 Types of Vulnerabilities 02:23:16 GitHub Advisory Database 02:24:03 Developer Roles and Responsibilities 02:25:09 Security Roles and Responsibilities 02:25:37 Admin Roles and Responsibilities 02:26:13 Additional Roles and Responsibilities 02:27:11 Notifying Responsible Parties 02:28:13 Triage Workflow based on Risk Ratings

GHAS for Enterprise 02:29:34 Should I purchase a GHAS License 02:30:08 Enabling GHAS in GitHub 02:30:49 Levels of Enablement 02:31:42 Levels of Access to Alerts 02:33:16 Required Level of Access 02:33:52 Security Overview 02:34:27 GHAS Logging 02:35:08 API Endpoints for Security