Ensure Secure Software Development with GitLab Security Essentials

Day 1

Introduction to the Secure Stage (1 hour)

• Overview of the Secure Stage in GitLab and its key features
• Explanation of the integration of security scanning with GitLab's development flow
• Overview of the different types of security scans available in GitLab
• Explanation of the types of security reports that can be generated

SAST, Secret Detection, and DAST (2 hours)

• Introduction to Static Application Security Testing (SAST)
• Explanation of the steps for using SAST in GitLab
• Demonstration of enabling and configuring SAST
• Overview of the SAST report and how to take action on findings
• Introduction to Secret Detection
• Explanation of the steps for using Secret Detection in GitLab
• Demonstration of enabling and configuring Secret Detection
• Introduction to Dynamic Application Security Testing (DAST)
• Explanation of the steps for using DAST in GitLab
• Demonstration of enabling and configuring DAST
• Lab: Using SAST, Secret Detection, and DAST

Dependency Scanning (1 hour)

• Introduction to Dependency Scanning
• Explanation of the steps for using Dependency Scanning in GitLab
• Demonstration of enabling and configuring Dependency Scanning
• Lab: Using Dependency Scanning

Day 2

Container Scanning (1 hour)

• Introduction to Container Scanning
• Explanation of the steps for using Container Scanning in GitLab
• Demonstration of enabling and configuring Container Scanning
• Lab: Using Container Scanning

License Compliance (1 hour)

• Introduction to License Compliance
• Explanation of the steps for using License Compliance in GitLab
• Demonstration of enabling and configuring License Compliance
• Overview of the License Compliance report and how to review the results
• Lab: Enable, Configure, and Run License Compliance

Fuzz Testing (1 hour 30 minutes)

• Introduction to Fuzz Testing
• Explanation of the steps for using Fuzz Testing in GitLab
• Overview of the Fuzz Testing workflow
• Explanation of how to use a Fuzz Testing corpus
• Lab: Enable, Configure, and Run Fuzz Testing

The expected outcomes of the GitLab Security Essentials training course are:

• Comprehensive Security Understanding: Participants will gain a comprehensive understanding of GitLab's security capabilities, including Static Application Security Testing (SAST), secret detection, Dynamic Application Security Testing (DAST), dependency scanning, container scanning, license compliance, and fuzz testing.
• Hands-On Expertise: Through hands-on labs and practical exercises, attendees will learn how to configure and use GitLab's security features effectively. They will gain practical experience in setting up security scans, analyzing results, and mitigating security vulnerabilities.
• Enhanced Security Practices: The training will introduce participants to GitLab's security best practices and recommended workflows, enabling them to identify and mitigate security risks effectively.
• Tailored for Various Audiences: The course is designed to benefit a wide range of participants, including individuals or teams looking to enhance their knowledge of GitLab security, DevOps teams seeking to improve application and infrastructure security, developers and engineers responsible for application security, and anyone involved in securing software projects using GitLab.
• In-Depth Curriculum: The training covers a comprehensive range of security topics, ensuring participants have a holistic understanding of GitLab's security capabilities.
• Knowledge of GitLab Tiers: Attendees will gain insights into GitLab's three pricing tiers (Free, Premium, and Ultimate) and the benefits of upgrading to higher tiers, enabling them to make informed decisions about their toolset.
• Flexible Delivery Options: Participants can choose between remote or on-site delivery, providing flexibility to accommodate different preferences and scheduling needs.
• Small Class Size: With limited class sizes, attendees receive personalized attention and support to maximize their learning experience.

Attendee local setup (for all courses)

• Operating System: Attendees must bring their own laptop or desktop that runs either macOS, Linux, or Windows operating systems.
• Internet Access: Attendees need Internet access with the ability to reach websites via http/https.

This Course is for: Project managers, developers, DevSecOps engineers, and security specialists who are using GitLab with the Ultimate license

Individual Prerequisite knowledge:

• GitLab with Git Fundamentals course or equivalent knowledge
• GitLab CI/CD course or equivalent knowledge
• This course is not appropriate for students without any Git, GitLab, or GitLab CI/CD knowledge

Equipment/System Prerequisites:

• GitLab Lab Environment Access: Attendees require access to the GitLab lab environment to participate in the hands-on activities.
• Unique invitation codes are handed out on the first day of class by the instructors.
• Access to an instance with all paid features and capabilities turned on is provided during the training session, features are not always available with the free version (GitLab CE) of GitLab.