Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Course Outline
1. Concepts and Scope of Static Code Analysis
- Definitions: static analysis, Static Application Security Testing (SAST), rule categories, and severity levels
- Scope of static analysis in the secure Software Development Life Cycle (SDLC) and risk management for government
- Integration of SonarQube into security controls and developer workflows for government agencies
2. SonarQube Overview: Features and Architecture
- Core services, database architecture, and scanner components
- Quality Gates, Quality Profiles, and best practices for implementing Quality Gates in government environments
- Security-related features: identification of vulnerabilities, SAST rules, and Common Weakness Enumeration (CWE) mapping
3. Navigation and Use of the SonarQube Server UI
- Tour of the server UI: projects, issues, rules, measures, and governance views for government
- Interpreting issue pages, traceability features, and guidance for remediation actions
- Options for generating and exporting reports to support decision-making in public sector operations
4. SonarScanner Configuration with Build Tools
- Setting up SonarScanner for Maven, Gradle, Ant, and MSBuild in government projects
- Best practices for configuring scanner properties, exclusions, and managing multi-module projects for government
- Generating necessary test data and coverage reports to ensure accurate analysis for government applications
5. Integration with Azure DevOps
- Configuring SonarQube service connections in Azure DevOps for government agencies
- Adding SonarQube tasks to Azure Pipelines and enabling Pull Request (PR) decoration for enhanced collaboration for government
- Importing Azure Repos into SonarQube and automating analysis processes for government projects
6. Project Configuration and Third-Party Analyzers
- Project-level Quality Profiles and rule selection for Java and Angular in government applications
- Working with third-party analyzers and understanding the plugin lifecycle for government environments
- Defining analysis parameters and managing parameter inheritance for consistent results for government
7. Roles, Responsibilities, and Secure Development Methodology Review
- Segregation of roles: developers, reviewers, DevOps engineers, and security owners in government agencies
- Constructing a roles and responsibilities matrix for Continuous Integration/Continuous Deployment (CI/CD) processes in government
- Review and recommendation process for an existing secure development methodology in government operations
8. Advanced: Adding Rules, Tuning, and Enhancing Global Security Features
- Using the SonarQube Web API to add and manage custom rules for enhanced security for government
- Adjusting Quality Gates and implementing automated policy enforcement in government projects
- Hardening SonarQube server security and best practices for access control in government environments
9. Hands-on Lab Sessions (Applied)
- Lab A: Configure SonarScanner for five Java repositories (including Quarkus where applicable) and analyze results for government projects
- Lab B: Configure Sonar analysis for one Angular front-end application and interpret findings for government applications
- Lab C: Full pipeline lab—integrate SonarQube with an Azure DevOps pipeline and enable PR decoration for government workflows
10. Testing, Troubleshooting, and Report Interpretation
- Strategies for generating test data and measuring code coverage in government projects
- Common issues and troubleshooting techniques for scanner, pipeline, and permission errors in government environments
- Guidance on reading and presenting SonarQube reports to both technical and non-technical stakeholders in government agencies
11. Best Practices and Recommendations
- Rule set selection and incremental enforcement strategies for government applications
- Workflow recommendations for developers, reviewers, and build pipelines in government operations
- Roadmap for scaling SonarQube implementation in enterprise-level government environments
Summary and Next Steps
Requirements
- An understanding of the software development lifecycle for government projects
- Experience with source control and foundational CI/CD concepts
- Familiarity with Java or Angular development environments
Audience
- Developers (Java / Quarkus / Angular) for government initiatives
- DevOps and CI/CD engineers supporting government systems
- Security engineers and application security reviewers for government applications
21 Hours
Testimonials (1)
Engaging, and hands on practise.
