What's changed: New GH-500 Chapter 5 (vulnerability context & prioritization = CVE/CWE/GHSA, repo advisories, rulesets enforcing severity/SLA, CVSS+EPSS+reachability+asset criticality, campaigns/bulk management, automated dismissal with documentation; customization & governance & shift-left = CodeQL query suites [default/security-extended/custom], roles/delegated exceptions/ownership, cross-suite ruleset enforcement, Push Protection/dependency scanning/pre-merge analysis)
5.1Vulnerability Context and Prioritization
Understand CVE, CWE, and GitHub Security Advisory concepts; end-to-end remediation across alerts and advisories; defining/prioritizing/enforcing severity and remediation rulesets; campaign-based bulk management; and automated dismissal with documentation.
The core of security operations (SecOps) is to understand the flood of alerts in a common language, prioritize, and run remediation as an organization. GH-500 first establishes the standard concepts for talking about vulnerabilities: CVE (an individual vulnerability ID), CWE (a classification of vulnerability types), and GitHub’s Security Advisory.
5.1.1CVE, CWE, and GitHub Security Advisory
CVE (Common Vulnerabilities and Exposures) is a unique ID for an individual vulnerability in a specific product/version (e.g., CVE-2024-XXXXX). CWE (Common Weakness Enumeration) classifies the "type" of weakness like SQL injection or buffer overflow (e.g., CWE-89) (CVE is an "instance," CWE a "type"). A GitHub Security Advisory (GHSA) is vulnerability info in the GitHub Advisory Database backing Dependabot detection. Repo admins can also create a repository security advisory to fix privately, then publish a vulnerability in their own project.
5.1.2Prioritization and enforcement via rulesets
At scale, define response policy as rulesets and enforce code-scanning merge protection (a PR with alerts at or above a given severity can’t merge) org-wide. Remediation SLAs (deadlines) are set as policy goals (tracked via campaign due dates, etc.) to encourage compliance. Require protections like "a PR with unresolved high-severity alerts can’t merge." Prioritize by combining severity (CVSS), exploit probability (EPSS), reachability (whether it’s actually on a code path), and asset criticality—focusing limited resources on the highest risk.
5.1.3Campaigns, bulk management, and automated dismissal
Campaign-based remediation (Chapter 1) bundles like alerts across many repos for planned clearing. Bulk alert management changes status/assignment for multiple alerts at once for efficiency. Automated dismissal auto-dismisses alerts meeting clearly acceptable conditions, but with documentation so you can later trace "why it was dismissed." Careless automated dismissal misses risk, so condition design matters.
Common: (1) CVE = individual vuln ID, CWE = weakness-type classification, GHSA = Advisory Database info (repo advisories allow private fix → publish). (2) At scale, enforce severity/SLA via rulesets (e.g., Critical within X days). (3) Prioritize via CVSS + EPSS + reachability + asset criticality. (4) Campaigns/bulk management for efficiency; automated dismissal requires documentation.
Watch out: (1) Don’t confuse CVE (instance) with CWE (type). (2) Don’t prioritize by severity (CVSS) alone—factor EPSS (exploit probability) and reachability. (3) Automated dismissal without documentation makes "why dismissed" untraceable—always document. (4) Rulesets work only when enforced, not merely defined (voluntary isn’t followed).
5.1.4Section summary
- CVE = individual vuln ID; CWE = weakness-type classification; GHSA = Advisory Database info
- At scale, enforce severity-based merge protection via rulesets (SLA deadlines are tracked as policy goals)
- Prioritize by combining CVSS + EPSS + reachability + asset criticality
- Use campaigns/bulk management for efficiency; automated dismissal must be documented
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which correctly distinguishes CVE from CWE?
Q2. You want to enforce org-wide that a PR with unresolved alerts at or above a set severity cannot merge. What do you use?
Q3. For prioritizing vulnerabilities, which combination beyond severity (CVSS) is appropriate to consider?
Q4. You want to handle a vulnerability in your own project privately until fixed, then publish. What do you use?
Q5. For "automated dismissal" of alerts meeting clearly acceptable conditions, what is essential?
Q6. You want to remediate the same class of vulnerability across many repos in a planned, bulk manner. Which fits best?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.