F5 BIG-IP Advanced Web Application Firewall

• Describe the role of the BIG-IP system as a full proxy device in an application delivery network

• Provision F5 Advanced Web Application Firewall resources

• Define a web application firewall

• Describe how F5 Advanced Web Application Firewall protects a web application by securing file

• types, URLs, and parameters

• Deploy F5 Advanced Web Application Firewall using the Rapid Deployment template (and other

• templates) and define the security checks included in each

• Define learn, alarm, and block settings as they pertain to configuring F5 Advanced Web

• Application Firewall

• Define attack signatures and explain why attack signature staging is important

• Contrast positive and negative security policy implementation and explain benefits of each

• Configure security processing at the parameter level of a web application

• Use an application template to protect a commercial web application

• Deploy F5 Advanced Web Application Firewall using the Automatic Policy Builder

• Tune a policy manually or allow automatic policy building

• Integrate third party application vulnerability scanner output into a security policy

• Configure login enforcement and session tracking

• Configure protection against brute force, web scraping, and Layer 7 denial of service attacks

• Implement iRules using specific F5 Advanced Web Application Firewall events and commands

• Use Content Profiles to protect JSON and AJAX-based applications

• Implement Bot Signatures

• Implement Proactive Bot Defense

this course is intended for security and network administrators who will be responsible for theinstallation, deployment, tuning, and day-to-day maintenance of the F5 Advanced Web ApplicationFirewall.

 

• Introducing the BIG-IP System

• Initially Setting Up the BIG-IP System

• Archiving the BIG-IP System Configuration

• Leveraging F5 Support Resources and Tools

• Identifying BIG-IP Traffic Processing Objects

• Understanding Profiles

• Overview of Local Traffic Policies

• Visualizing the HTTP Request Flow

• Overview of Web Application Request Processing

• Web Application Firewall: Layer 7 Protection

• Layer 7 Security Checks

• Overview of Web Communication Elements

• Overview of the HTTP Request Structure

• Examining HTTP Responses

• How F5 Advanced WAF Parses File Types, URLs, and Parameters

• Using the Fiddler HTTP Proxy

• A Taxonomy of Attacks: The Threat Landscape

• Common Exploits Against Web Applications

• Defining Learning

• Comparing Positive and Negative Security Models

• The Deployment Workflow

• Assigning Policy to Virtual Server

• Deployment Workflow: Using Advanced Settings

• Configure Server Technologies

• Defining Attack Signatures

• Viewing Requests

• Security Checks Offered by Rapid Deployment

• Defining Attack Signatures

• Post-Deployment Traffic Processing

• How Violations are Categorized

• Violation Rating: A Threat Scale

• Defining Staging and Enforcement

• Defining Enforcement Mode

• Defining the Enforcement Readiness Period

• Reviewing the Definition of Learning

• Defining Learning Suggestions

• Choosing Automatic or Manual Learning

• Defining the Learn, Alarm and Block Settings

• Interpreting the Enforcement Readiness Summary

• Configuring the Blocking Response Page

• Defining Attack Signatures

• Attack Signature Basics

• Creating User-Defined Attack Signatures

• Defining Simple and Advanced Edit Modes

• Defining Attack Signature Sets

• Defining Attack Signature Pools

• Understanding Attack Signatures and Staging

• Updating Attack Signatures

• Defining Threat Campaigns

• Deploying Threat Campaigns

• Defining and Learning Security Policy Components

• Defining the Wildcard

• Defining the Entity Lifecycle

• Choosing the Learning Scheme

• How to Learn: Never (Wildcard Only)

• How to Learn: Always

• How to Learn: Selective

• Reviewing the Enforcement Readiness Period: Entities

• Viewing Learning Suggestions and Staging Status

• Defining the Learning Score

• Defining Trusted and Untrusted IP Addresses

• How to Learn: Compact

• The Purpose of F5 Advanced WAF Cookies

• Defining Allowed and Enforced Cookies

• Securing HTTP headers

• Viewing Application Security Summary Data

• Reporting: Build Your Own View

• Reporting: Chart based on filters

• Brute Force and Web Scraping Statistics

• Viewing Resource Reports

• PCI Compliance: PCI-DSS 3.0

• Analyzing Requests

• Local Logging Facilities and Destinations

• Viewing Logs in the Configuration Utility

• Defining the Logging Profile

• Configuring Response Logging

• Defining Parameter Types

• Defining Static Parameters

• Defining Dynamic Parameters

• Defining Parameter Levels

• Other Parameter Considerations

• Overview of Automatic Policy Building

• Defining Templates Which Automate Learning

• Defining Policy Loosening

• Defining Policy Tightening

• Defining Learning Speed: Traffic Sampling

• Defining Track Site Changes

• Integrating Scanner Output

• Importing Vulnerabilities

• Resolving Vulnerabilities

• Using the Generic XML Scanner XSD file

• Defining a Parent Policy

• Defining Inheritance

• Parent Policy Deployment Use Cases

• Defining Login Pages for Flow Control

• Configuring Automatic Detection of Login Pages

• Defining Brute Force Attacks

• Brute Force Protection Configuration

• Source-Based Brute Force Mitigations

• Defining Credential Stuffing

• Mitigating Credential Stuffing

• Defining Session Tracking

• Configuring Actions Upon Violation Detection

• Defining Denial of Service Attacks

• Defining the DoS Protection Profile

• Overview of TPS-based DoS Protection

• Creating a DoS Logging Profile

• Applying TPS Mitigations

• Defining Behavioral and Stress-Based Detection

• Classifying Clients with the Bot Defense Profile

• Defining Bot Signatures

• Defining F5 Fingerprinting

• Defining Bot Defense Profile Templates

• Defining Microservices protection

• Targeting Elements of Application Delivery

• Exploiting the Document Object Model

• Protecting Applications Using DataSafe

• The Order of Operations for URL Classification

• Final Lab Project (Option 1) – Production Scenario

• Final Lab Project (Option 2) – Managing Traffic with Layer 7 Local Traffic Policies