What's changed: New GH-500 Chapter 5 (vulnerability context & prioritization = CVE/CWE/GHSA, repo advisories, rulesets enforcing severity/SLA, CVSS+EPSS+reachability+asset criticality, campaigns/bulk management, automated dismissal with documentation; customization & governance & shift-left = CodeQL query suites [default/security-extended/custom], roles/delegated exceptions/ownership, cross-suite ruleset enforcement, Push Protection/dependency scanning/pre-merge analysis)
5.1Vulnerability Context and Prioritization
Understand CVE, CWE, and GitHub Security Advisory concepts; end-to-end remediation across alerts and advisories; defining/prioritizing/enforcing severity and remediation rulesets; campaign-based bulk management; and automated dismissal with documentation.
The core of security operations (SecOps) is to understand the flood of alerts in a common language, prioritize, and run remediation as an organization. GH-500 first establishes the standard concepts for talking about vulnerabilities: CVE (an individual vulnerability ID), CWE (a classification of vulnerability types), and GitHub’s Security Advisory.
5.1.1CVE, CWE, and GitHub Security Advisory
CVE (Common Vulnerabilities and Exposures) is a unique ID for an individual vulnerability in a specific product/version (e.g., CVE-2024-XXXXX). CWE (Common Weakness Enumeration) classifies the "type" of weakness like SQL injection or buffer overflow (e.g., CWE-89) (CVE is an "instance," CWE a "type"). A GitHub Security Advisory (GHSA) is vulnerability info in the GitHub Advisory Database backing Dependabot detection. Repo admins can also create a repository security advisory to fix privately, then publish a vulnerability in their own project.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.