GHAS unbundling - adopting GitHub Advanced Security directory (#54765)

Co-authored-by: Felicity Chapman <felicitymay@github.com>
Co-authored-by: Anne-Marie <102995847+am-stead@users.noreply.github.com>

Author: 3 people

content/code-security/adopting-github-advanced-security-at-scale/index.md

@@ -1,7 +1,7 @@
 ---
-title: Adopting GitHub Advanced Security at scale
+title: 'Adopting {% data variables.product.prodname_GHAS %} at scale'
 shortTitle: Adopt GHAS at scale
-intro: A phased approach to rolling out GitHub Advanced Security at your company using industry and GitHub best practices.
+intro: A phased approach to rolling out {% data variables.product.prodname_GHAS %} at your company using industry and GitHub best practices.
 versions:
   ghes: '*'
   ghec: '*'

content/code-security/adopting-github-advanced-security-at-scale/introduction-to-adopting-github-advanced-security-at-scale.md

@@ -1,6 +1,7 @@
 ---
-title: Introduction to adopting GitHub Advanced Security at scale
-intro: 'You can adopt {% data variables.product.prodname_GH_advanced_security %} at scale in your company following industry and GitHub best practices.'
+title: 'Introduction to adopting {% data variables.product.prodname_GHAS %} at scale'
+intro: 'You can adopt {% data variables.product.prodname_GHAS %} at scale in your company following industry and {% data variables.product.github %} best practices.'
+allowTitleToDifferFromFilename: true
 versions:
   ghes: '*'
   ghec: '*'
@@ -17,11 +18,11 @@ redirect_from:
 
 ## About these articles
 
-{% data variables.product.prodname_GH_advanced_security %} (GHAS) helps teams build more secure code faster using integrated tooling such as secret scanning and code scanning using {% data variables.product.prodname_codeql %}. To understand the security features available through {% data variables.product.prodname_GH_advanced_security %}, see [AUTOTITLE](/get-started/learning-about-github/about-github-advanced-security).
+{% data variables.product.prodname_GHAS %} (GHAS) products help teams build more secure code faster using integrated tooling such as secret scanning and code scanning using {% data variables.product.prodname_codeql %}. To understand the security features available through {% data variables.product.prodname_GHAS %}, see [AUTOTITLE](/get-started/learning-about-github/about-github-advanced-security).
 
 GHAS is a suite of tools that requires active participation from developers across your enterprise. To realize the best return on your investment, you must learn how to use, apply, and maintain GHAS.
 
-We’ve created a phased approach to GHAS rollouts developed from industry and GitHub best practices. We expect most customers will want to follow these phases, based on our experience helping customers with a successful deployment of {% data variables.product.prodname_GH_advanced_security %}, but you may need to modify this approach to meet the needs of your company.
+We’ve created a phased approach to GHAS rollouts developed from industry and GitHub best practices. We expect most customers will want to follow these phases, based on our experience helping customers with a successful deployment of {% data variables.product.prodname_GHAS %}, but you may need to modify this approach to meet the needs of your company.
 
 Enabling GHAS across a large organization can be broken down into six core phases.
 
@@ -41,9 +42,9 @@ Enabling GHAS across a large organization can be broken down into six core phase
 
 If you encounter any issues or have any questions during your implementation, you can search our documentation for solutions or engage with {% data variables.contact.github_support %}. For more information, see [AUTOTITLE](/support/learning-about-github-support/about-github-support).
 
-If you prefer to have guidance throughout the rollout process, {% data variables.product.prodname_professional_services_team %} can partner with you for a successful rollout and implementation of {% data variables.product.prodname_GH_advanced_security %}. We offer a variety of {% data variables.product.prodname_professional_services %} options for guidance and support. We also have training and bootcamps available to help your company to optimize the value of {% data variables.product.prodname_GH_advanced_security %}.
+If you prefer to have guidance throughout the rollout process, {% data variables.product.prodname_professional_services_team %} can partner with you for a successful rollout and implementation of {% data variables.product.prodname_GHAS %}. We offer a variety of {% data variables.product.prodname_professional_services %} options for guidance and support. We also have training and bootcamps available to help your company to optimize the value of {% data variables.product.prodname_GHAS %}.
 
 Speak with your sales representative for more information about all the {% data variables.product.prodname_professional_services %} options available. For more information, contact {% data variables.contact.contact_enterprise_sales %}.
 
-> [!NOTE]
+>[!TIP]
 > For the first article in this series, see [AUTOTITLE](/code-security/adopting-github-advanced-security-at-scale/phase-1-align-on-your-rollout-strategy-and-goals).

content/code-security/adopting-github-advanced-security-at-scale/phase-1-align-on-your-rollout-strategy-and-goals.md

@@ -1,6 +1,6 @@
 ---
 title: 'Phase 1: Align on your rollout strategy and goals'
-intro: 'Before enabling {% data variables.product.prodname_code_scanning %} and {% data variables.product.prodname_secret_scanning %}, plan how GHAS should be rolled out across your enterprise.'
+intro: '{% ifversion ghas-products %}Before enabling {% data variables.product.prodname_GH_code_security %} and {% data variables.product.prodname_GH_secret_protection %} features, plan how these GHAS products should be rolled out across your enterprise.{% else %}Before enabling {% data variables.product.prodname_code_scanning %} and {% data variables.product.prodname_secret_scanning %}, plan how GHAS should be rolled out across your enterprise.{% endif %}'
 versions:
   ghes: '*'
   ghec: '*'
@@ -10,20 +10,20 @@ topics:
 shortTitle: 1. Align on strategy
 ---
 
-> [!NOTE]
-> This article is part of a series on adopting {% data variables.product.prodname_GH_advanced_security %} at scale. For the introduction to this series, see [AUTOTITLE](/code-security/adopting-github-advanced-security-at-scale/introduction-to-adopting-github-advanced-security-at-scale).
+> [!TIP]
+> This article is part of a series on adopting {% data variables.product.prodname_GHAS %} at scale. For the introduction to this series, see [AUTOTITLE](/code-security/adopting-github-advanced-security-at-scale/introduction-to-adopting-github-advanced-security-at-scale).
 
 ## Set clear goals for your company’s rollout
 
 To build a foundation for the direction of your company's rollout, outline goals for GHAS within your company, and communicate those goals to your team. Your goals can be simple or complex, as long as your team is aligned. If you need assistance with your goals, {% data variables.product.prodname_professional_services %} can provide recommendations based on our experience with your company and other customers.
 
 Here are some high-level examples of what your goals for rolling out GHAS might look like:
 
-* Reducing the number of vulnerabilities: This may be in general, or because your company was recently impacted by a significant vulnerability that you believe could have been prevented by a tool like GHAS.
-* Identifying high-risk repositories: Some companies simply want to target repositories that contain the most risk, enabling them to reduce risk by remediating vulnerabilities.
-* Increasing remediation rates: To prevent the accumulation of security debt, you may wish to drive developer adoption of findings and ensure these vulnerabilities are remediated in a timely manner.
-* Meeting compliance requirements: For example, many healthcare companies use GHAS to prevent the exposure of PHI (Personal Health Information).
 * Preventing secrets leakage: Many companies want to prevent critical information from being leaked, such as software keys or financial data.
+* Meeting compliance requirements: For example, many healthcare companies use GHAS to prevent the exposure of PHI (Personal Health Information).
+* Reducing the number of vulnerabilities: This may be in general, or because your company was recently impacted by a significant vulnerability that you believe could have been prevented by a tool like GHAS.
+* Identifying high-risk repositories: Some companies simply want to target repositories that contain the most risk, enabling them to reduce risk by remediating vulnerabilities in their code and in their supply chain.
+* Increasing remediation rates: To prevent the accumulation of security debt, you will wish to drive developer adoption of findings and ensure these vulnerabilities are remediated in a timely manner.
 
 ## Lead your rollout with both your security and development groups
 
@@ -43,7 +43,10 @@ GHAS is a suite of tools that increases with value when configured, maintained,
 
 ### 2. GHAS will require adjustment out of the box
 
-After GHAS is set up on your repositories, you'll need to configure GHAS to meet your company’s needs.{% ifversion default-setup-ghas-enablement %} For example, while default setup for {% data variables.product.prodname_code_scanning %} automatically detects the languages to be scanned, you may need to customize other aspects of your {% data variables.product.prodname_code_scanning %} configuration. {% else %} {% data variables.product.prodname_code_scanning_caps %} in particular requires further customization, such as evaluating initial results and making adjustments for future scans. Many customers find that initial scans return limited or irrelevant results until {% data variables.product.prodname_code_scanning %} is adjusted based on the application's threat model.{% endif %}
+After GHAS is set up on your repositories, you'll need to configure GHAS to meet your company’s needs. For example:
+
+* Default setup for {% data variables.product.prodname_code_scanning %} automatically detects the languages to be scanned, but you may need to customize other aspects of your {% data variables.product.prodname_code_scanning %} configuration such as the application's threat model to fine tune the results.
+* {% data variables.product.prodname_secret_scanning_caps %} automatically detects the patterns used by many commonly used systems, but you may want to add custom patterns to detect tokens and other secrets used by internal tooling.
 
 ### 3. GHAS tools are most effective when used together and integrated into your application security program
 
@@ -59,5 +62,5 @@ If your company is interested in custom {% data variables.product.prodname_codeq
 
 When {% data variables.product.prodname_code_scanning %} is run from a pull request, the scan will include the full codebase and not just the changes made in the pull request. Scanning the entire codebase is an important step to ensure the change has been reviewed against all interactions in the codebase.
 
-> [!NOTE]
+> [!TIP]
 > For the next article in this series, see [AUTOTITLE](/code-security/adopting-github-advanced-security-at-scale/phase-2-preparing-to-enable-at-scale).