Security Administration - GitHub Administration¶

Overview¶

Security administration covers 15% of the exam (Advanced Security) plus aspects of Enterprise Administration (15%). This domain focuses on GitHub Advanced Security (GHAS) rollout, code scanning, secret scanning, Dependabot, and the security overview dashboard.

📖 GitHub Advanced Security - GHAS overview

GitHub Advanced Security (GHAS)¶

What GHAS Includes¶

Note: Dependabot (alerts, updates, security updates) is free for all repositories.

GHAS Licensing¶

📖 GHAS Billing - License model

• Licensed per active committer to private/internal repos with GHAS enabled
• Active committer: Anyone who authored a commit in the last 90 days
• A user counts once even if committing to multiple GHAS-enabled repos
• Enable per-repository or at organization level
• Monitor usage in enterprise billing settings

GHAS Rollout Strategy¶

📖 GHAS Rollout - Deployment guide

Phased approach (recommended): 1. Pilot: Enable on 5-10 high-risk repositories 2. Triage initial findings: Address critical alerts, tune false positives 3. Expand: Roll out to additional teams/repos incrementally 4. Enterprise-wide: Enable across all repositories 5. Enforce: Require security checks in branch protection/rulesets

Code Scanning¶

📖 Code Scanning - Static analysis

How Code Scanning Works¶

• Static Application Security Testing (SAST)
• Default tool: CodeQL - semantic analysis engine by GitHub
• Runs as a GitHub Actions workflow
• Analyzes code on push, PR, and schedule
• Results appear as alerts in the Security tab

CodeQL¶

📖 CodeQL - CodeQL analysis

• Supported languages: C/C++, C#, Go, Java/Kotlin, JavaScript/TypeScript, Python, Ruby, Swift
• Query suites: security-extended (default), security-and-quality
• Custom queries: Write organization-specific queries
• Default setup: Automatic configuration (recommended for most repos)
• Advanced setup: Customizable workflow file for complex needs

Code Scanning Policies¶

Organization-level: - Set default CodeQL configuration for all repositories - Enforce code scanning as required status check via rulesets - Configure alert severity thresholds for blocking merges

Enterprise-level: - Enforce code scanning across all organizations - Set default security configurations - Require code scanning results in rulesets

Third-Party Tools¶

• Upload SARIF (Static Analysis Results Interchange Format) files
• Integrate tools: Snyk, Checkmarx, SonarQube, Semgrep
• Results appear alongside CodeQL findings
• Use github/codeql-action/upload-sarif action

Secret Scanning¶

📖 Secret Scanning - Credential detection

How Secret Scanning Works¶

• Scans repository content (commits, issues, PRs, discussions) for known secret patterns
• Partners program: Notify service providers when their tokens are found
• 200+ secret patterns from 100+ service providers
• Custom patterns: Define organization-specific patterns (regex)

📖 Secret Scanning Patterns - Supported patterns

Push Protection¶

📖 Push Protection - Prevent secret commits

• Blocks pushes that contain detected secrets
• Developer sees the detected secret and can:
• Remove the secret and push again
• Mark as false positive
• Mark as used in tests
• Bypass with justification (if allowed)
• Admin controls:
• Enable/disable push protection per repository or organization
• Allow bypasses (with or without approval requirement)
• Delegated bypass: Require reviewer approval to bypass

Secret Scanning Administration¶

• Enable at repository, organization, or enterprise level
• Custom patterns: Define regex patterns for proprietary secrets
• Dry-run custom patterns before enforcing
• Alert notification: Repository admins, security managers, custom recipients
• Validity checks: Verify if detected secret is still active (for supported providers)

Dependabot¶

📖 Dependabot - Dependency management

Dependabot Features¶

Dependabot Alerts¶

📖 Dependabot Alerts - Vulnerability alerts

• Generated from GitHub Advisory Database
• Severity levels: Critical, High, Medium, Low
• Auto-dismiss: Configure rules to auto-dismiss low-risk alerts
• Grouped alerts: Group related vulnerabilities
• Notification: Email, web, mobile based on user preferences

Dependabot Configuration¶

📖 Dependabot Config - dependabot.yml

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    reviewers:
      - "org/security-team"
    labels:
      - "dependencies"
    open-pull-requests-limit: 10

Auto-Triage Rules¶

📖 Auto-Triage - Automated alert management

• Automatically dismiss alerts based on criteria
• GitHub-curated rules: Dismiss alerts unlikely to be exploitable
• Custom rules: Define based on severity, ecosystem, scope (runtime/dev)
• Reduce alert fatigue for security teams

Security Overview Dashboard¶

📖 Security Overview - Enterprise security view

Dashboard Features¶

• Enterprise-wide and organization-wide security posture
• Views:
• Risk: Repositories with open security alerts
• Coverage: Which repos have security features enabled
• Alert trends: Alert creation and resolution over time
• Filter by: Organization, repository, severity, tool, alert state
• Export data for compliance reporting

Key Metrics¶

• Number of open critical/high alerts
• Mean time to remediation
• Security feature enablement percentage
• Alert trends (improving or degrading)
• Repositories with no security features enabled

Audit Log¶

📖 Audit Log - Activity tracking

Audit Log Features¶

• Records admin and security events across the enterprise
• Searchable via web UI, API, and GraphQL
• Events include: Authentication, repository changes, policy changes, Actions runs
• Retention: 180 days (web), indefinite via streaming
• Audit log streaming: Send to Azure Blob, Azure Event Hubs, AWS S3, Datadog, Google Cloud, Splunk

📖 Audit Log Streaming - Log streaming

Key Audit Events¶

Common Exam Patterns¶

1. "Prevent secrets from being committed" - Push protection
2. "Auto-fix vulnerable dependencies" - Dependabot security updates
3. "Enterprise security posture" - Security overview dashboard
4. "Roll out GHAS cost-effectively" - Phased rollout, start with high-risk repos
5. "Custom secret patterns" - Organization-level custom patterns with regex
6. "Code scanning for all repos" - Default CodeQL setup + required in rulesets
7. "Audit log retention beyond 180 days" - Audit log streaming to external storage
8. "Block merges with critical vulnerabilities" - Code scanning as required status check