F5 Networks Configuring BIG-IP ASM: Application Security Manager

Course Outline

• Introducing the BIG-IP System


• Initially Setting Up the BIG-IP System


• Archiving the BIG-IP Configuration


• F5 Support Resources and Tools

• Identifying BIG-IP Traffic Processing Objects


• Understanding Network Packet Flow


• Understanding Profiles


• Overview of Local Traffic Policies and ASM

• Anatomy of a web application


• An Overview of Common Security Methods


• Examining HTTP and Web Application Components


• Examining HTTP Headers


• Examining HTTP Responses


• Examining HTML Components


• How ASM Parses File Types, URLs, and Parameters


• Using the Fiddler HTTP proxy tool

• OWASP Top 10 Vulnerabilities

• Comparing Positive and Negative Security


• Using the Deployment Wizard


• Deployment Wizard: Local Traffic Deployment


• Deployment Wizard: Workflow


• Reviewing Requests


• Security Checks offered by Rapid Deployment


• Configuring Data Guard

• Post-Configuration Traffic Processing


• Defining False Positives


• How Violations are Categorized


• Violation Ratings


• Enforcement Settings and Staging: Policy Control


• Defining Signature Staging


• Defining Enforcement Readiness Period


• Defining Learning


• Violations and Learning Suggestions


• Learning Mode: Automatic or Manual


• Defining Learn, Alarm and Block settings


• Interpreting Enforcement Readiness Summary


• Configuring the Blocking Response Page

• Defining Attack Signatures


• Creating User-Defined Attack Signatures


• Attack Signature Normalization


• Attack Signature Structure


• Defining Attack Signature Sets


• Defining Attack Signature Pools


• Updating Attack Signatures


• Understanding Attack Signatures and Staging

• Defining Security Policy Components


• Choosing an Explicit Entities Learning Scheme


• How to learn: Add All Entities


• Staging and Entities: The Entity Lifecycle


• How to Learn: Never (Wildcard Only)


• How to Learn: Selective


• Learning Differentiation: Real Threats vs. False positives

• ASM Cookies: What to Enforce


• Understanding Allowed and Enforced Cookies


• Configuring Security Processing on HTTP Headers

• Reporting Capabilities in ASM


• Viewing DoS Reports


• Generating an ASM Security Events Report


• Viewing Log files and Local Facilities


• Understanding Logging Profile

• Understanding User Roles and Partitions


• Comparing Policies


• Editing and Exporting Security Policies


• Examples of ASM Deployment Types


• Overview of ASM Synchronization


• Collecting Diagnostic Data with asmqkview

• Lab Project 1

• Defining Parameters


• Defining Static Parameters


• Understanding Dynamic Parameters and Extractions


• Defining Parameter Levels


• Understanding Attack Signatures and Parameters

• Application Template Overview

• Overview of Automatic Policy Building


• Choosing a Policy Type


• Defining Policy Building Process Rules


• Defining the Learning Score

• Integrating ASM with Vulnerability Scanners


• Importing Vulnerabilities


• Resolving Vulnerabilities


• Using the Generic XML Scanner Output

• Defining a Login URL


• Defining Session Awareness and User Tracking

• Defining Anomalies


• Mitigating Brute Force Attacks


• Defining Session-Based Brute Force Protection


• Defining Dynamic Brute Force Protection


• Defining the Prevention Policy


• Mitigating Web Scraping


• Defining Geolocation Enforcement


• Configuring IP Address Exceptions

• Defining Denial of Service Attacks


• Defining General Settings L7 DoS Profile


• Defining TPS-Based DoS Protection


• Defining Operation Mode


• Defining Mitigation Methods


• Defining Stress-Based Detection


• Defining Proactive Bot Defense


• Using Bot Signatures

• Defining Application Security iRule Events


• Using ASM iRule Event Modes


• iRule Syntax


• ASM iRule Commands

• Defining XML


• Defining Web Services


• Configuring an XML Profile


• Schema and WSDL Configuration


• XML Attack Signatures


• Using Web Services Security

• Defining Asynchronous JavaScript and XML


• Defining JavaScript Object Notation


• Configuring a JSON Profile

• Getting Started Series Web-Based Training


• F5 Instructor Led Training Curriculum


• F5 Professional Certification Program