Reviews 4,2
Reviews 4,5
GH-500 GitHub Advanced Security
GitHub Advanced Security makes security a structural requirement in the development process – with integrated tools for code scanning, secrets protection, and dependency management directly in GitHub.
Key topics
- Systematically identifying vulnerabilities in source code and package dependencies.
- Reliably protecting credentials and sensitive data through automated scanning.
- Securing CI/CD pipelines with targeted security gates and policy controls.
- Implementing and anchoring compliance requirements and governance policies.
- Embedding security checks seamlessly into existing DevOps workflows.
Prerequisite
Basic knowledge of Git and software development is sufficient – familiarity with build processes makes getting started even easier.
Target group
This training is aimed at developers, DevSecOps teams, security professionals, and technical leads who want to establish security as a permanent part of their daily work.
GH-500 combines security understanding with direct practical application – all content is immediately transferable to live GitHub projects.
Course content
GHAS core features
- Applying GHAS scans for secrets, code, and dependencies in a targeted way.
- Implementing security improvements with GHAS in a structured way.
- Situating GHAS within the organisation’s wider security landscape.
Automatic security updates with Dependabot
- Detecting risks in package dependencies early.
- Setting up and customising Dependabot alerts.
- Defining access rights for security advisories.
- Switching on and controlling automatic updates.
- Closing known vulnerabilities in a structured way.
- Reading security data via the GraphQL API.
- Tailoring alert notifications and warning settings.
Secret scanning: securing repositories
- Understanding the mechanics and structure of secret scanning.
- Getting to know configuration options for covert scans.
- Activating secret scanning and using it in practice.
Configuring code scanning in GitHub
- Understanding the fundamentals and mechanics of code scanning.
- Setting up code scanning for a repository.
- Integrating third-party analysis tools.
- GitHub Actions vs. external CI solutions compared.
- Naming CI tools and placing them in context.
- Event-based configuration of code scans.
- Differentiating between scheduled and trigger-based workflows.
Code analysis and vulnerability detection
- Creating and populating a CodeQL database.
- Analysing bugs and security flaws with CodeQL in a targeted way.
- Interpreting analysis results using precise queries.
Setting up and customising CodeQL scanning
- Getting to know the concept and architecture of CodeQL analysis.
- Understanding the logic of the QL query language and its principles.
- Activating and configuring CodeQL scanning in a GitHub repository.
- Developing custom CodeQL queries and embedding them in the workflow.
- Configuring the language matrix in the CodeQL workflow precisely.
- Using the CodeQL CLI for scans and uploading results.
- Anchoring custom build steps in the workflow.
GHAS for enterprises: roles, rights, and policies
- Embedding GHAS into existing development workflows.
- Differentiating GHAS features for open source and enterprise products.
- Activating and using enterprise security features.
- Assigning access roles and permissions in a structured way.
- Defining security policies at organisation level.
- Evaluating and acting on security warnings.
- Continuously monitoring and prioritising alerts.
- Automating administrative tasks via the API interface.
Data protection and compliance with GitHub
- Briefing teams on data protection requirements and raising awareness.
- Setting access rights clearly and in a structured manner.
- Automating and monitoring compliance workflows.
- Responding appropriately and promptly to data protection incidents.
Up to 100% funding for your continuing education
Attractive funding opportunities are available for numerous continuing education programs – depending on the funding program, up to 100% funding is possible.
The requirement is that you live or work in Germany. Our funding opportunities are not available outside of Germany.
Funding opportunities are available for career starters, job seekers, career changers, startups, experienced professionals, those seeking career advancement, and specialists.
What is GitHub Advanced Security?
- GitHub Advanced Security (GHAS) extends GitHub Enterprise with integrated security features – including code scanning, secret scanning, and dependency monitoring – for a seamless security process throughout development.
What does the GH-500 training cover?
- GH-500 teaches you to use GitHub Advanced Security in practice – from automated code analysis and secrets protection to secure dependency management and DevSecOps integration.
Who is the GH-500 training suitable for?
- The training is aimed at developers, DevOps and security professionals, and IT administrators who want to implement and automate security measures in GitHub in a structured way.
What advantages does GitHub Advanced Security bring to teams?
- With GHAS, teams detect vulnerabilities earlier, resolve code issues faster, and establish a continuously automated security process throughout the entire development cycle.
What prior knowledge do I need for the GH-500 training?
- Basic knowledge of GitHub and software development is sufficient. Familiarity with security concepts makes it even easier to apply the course content directly to your own day-to-day work.
Which tools are used in the GH-500 training?
- The key focus areas are CodeQL, Dependabot, the GitHub Security Dashboard, automated security workflows, and configuring custom security rules.
Will I receive a certificate after completing GH-500?
- Participants receive a certificate of attendance upon completion. Official GitHub certification is not currently included in the course but may be added at a future date.
