GitHub Advanced Security - Results Review
GitHub Advanced Security allows you to take a "developer-first" approach to Application Security, recognizing that developers have a critical role to play in securing your applications.
This engagement walks a single development team through the process of reviewing results produced by Advanced Security. The engagement can be repeated for different teams and products. Product security and DevSecOps team members may participate to disseminate best practices in triaging and fixing security issues, as well as in Advanced Security configuration.
Offering level
Fundamentals [100]
Target audience
- Developers
- Product Security teams
- DevSecOps teams
Key features and benefits
- Review the results produced by Advanced Security with an expert on the call
- Receive a guided tour on how to effectively use the Advanced Security interface to understand and triage results
- Receive customized guidance on remediation
- Receive customized guidance on configuration changes to improve the results produced by Advanced Security
Engagement schedule
This engagement consists of one 2-hour face-to-face session, plus pre- and post-session support. Maximum session size is typically 15 people.
Syllabus
- Overview of the Advanced Security interface functionalities
- Analysis of the results obtained on 1-5 customer repositories, focusing on:
- Quantity of results and likely explanations for the absence or abundance of results
- Approaches to fixing highest severity issues
- Configuration options
Learning outcomes
After completing this workshop, participants will be able to:
- Use the GitHub Advanced Security interface to understand the reported security vulnerabilities on the selected repositories
- Triage and remediate existing vulnerabilities in their repository
- Address new vulnerabilities as they are reported in the pull request workflow
- Identify build and configuration improvements for the given repositories to reduce false positives and false negatives
- Evaluate the potential benefits of query customization
Prerequisites
- 1-5 repositories must be selected where Advanced Security is already enabled. If the repositories are not already enabled, the "Pilot Team Implementation" offering can be provided to support enabling GHAS.
- Attendees must have access to the relevant security results on the selected repositories:
- For Code Scanning, users should be assigned the "View code scanning results" permission (for example, by having write access to the repository)
- For Secret Scanning, users should be assigned the "View secret scanning results" permission (for example, by being a repository admin)
- For Dependabot, users should be assigned the "View Dependabot alerts" permission (for example, by being a repository admin)
Resources