F5 BIG-IP Advanced Web Application Firewall

• Describe the role of the BIG-IP system as a full proxy device in an application delivery network
• Provision F5 Advanced Web Application Firewall resources
• Define a web application firewall
• Describe how F5 Advanced Web Application Firewall protects a web application by securing file
• types, URLs, and parameters
• Deploy F5 Advanced Web Application Firewall using the Rapid Deployment template (and other
• templates) and define the security checks included in each
• Define learn, alarm, and block settings as they pertain to configuring F5 Advanced Web
• Application Firewall
• Define attack signatures and explain why attack signature staging is important
• Contrast positive and negative security policy implementation and explain benefits of each
• Configure security processing at the parameter level of a web application
• Use an application template to protect a commercial web application
• Deploy F5 Advanced Web Application Firewall using the Automatic Policy Builder
• Tune a policy manually or allow automatic policy building
• Integrate third party application vulnerability scanner output into a security policy
• Configure login enforcement and session tracking
• Configure protection against brute force, web scraping, and Layer 7 denial of service attacks
• Implement iRules using specific F5 Advanced Web Application Firewall events and commands
• Use Content Profiles to protect JSON and AJAX-based applications
• Implement Bot Signatures
• Implement Proactive Bot Defense

this course is intended for security and network administrators who will be responsible for theinstallation, deployment, tuning, and day-to-day maintenance of the F5 Advanced Web ApplicationFirewall.

• Introducing the BIG-IP System
• Initially Setting Up the BIG-IP System
• Archiving the BIG-IP System Configuration
• Leveraging F5 Support Resources and Tools

• Identifying BIG-IP Traffic Processing Objects
• Understanding Profiles
• Overview of Local Traffic Policies
• Visualizing the HTTP Request Flow

• Overview of Web Application Request Processing
• Web Application Firewall: Layer 7 Protection
• Layer 7 Security Checks
• Overview of Web Communication Elements
• Overview of the HTTP Request Structure
• Examining HTTP Responses
• How F5 Advanced WAF Parses File Types, URLs, and Parameters
• Using the Fiddler HTTP Proxy

• A Taxonomy of Attacks: The Threat Landscape
• Common Exploits Against Web Applications

• Defining Learning
• Comparing Positive and Negative Security Models
• The Deployment Workflow
• Assigning Policy to Virtual Server
• Deployment Workflow: Using Advanced Settings
• Configure Server Technologies
• Defining Attack Signatures
• Viewing Requests
• Security Checks Offered by Rapid Deployment
• Defining Attack Signatures

• Post-Deployment Traffic Processing
• How Violations are Categorized
• Violation Rating: A Threat Scale
• Defining Staging and Enforcement
• Defining Enforcement Mode
• Defining the Enforcement Readiness Period
• Reviewing the Definition of Learning
• Defining Learning Suggestions
• Choosing Automatic or Manual Learning
• Defining the Learn, Alarm and Block Settings
• Interpreting the Enforcement Readiness Summary
• Configuring the Blocking Response Page

• Defining Attack Signatures
• Attack Signature Basics
• Creating User-Defined Attack Signatures
• Defining Simple and Advanced Edit Modes
• Defining Attack Signature Sets
• Defining Attack Signature Pools
• Understanding Attack Signatures and Staging
• Updating Attack Signatures
• Defining Threat Campaigns
• Deploying Threat Campaigns

• Defining and Learning Security Policy Components
• Defining the Wildcard
• Defining the Entity Lifecycle
• Choosing the Learning Scheme
• How to Learn: Never (Wildcard Only)
• How to Learn: Always
• How to Learn: Selective
• Reviewing the Enforcement Readiness Period: Entities
• Viewing Learning Suggestions and Staging Status
• Defining the Learning Score
• Defining Trusted and Untrusted IP Addresses
• How to Learn: Compact

• The Purpose of F5 Advanced WAF Cookies
• Defining Allowed and Enforced Cookies
• Securing HTTP headers

• Viewing Application Security Summary Data
• Reporting: Build Your Own View
• Reporting: Chart based on filters
• Brute Force and Web Scraping Statistics
• Viewing Resource Reports
• PCI Compliance: PCI-DSS 3.0
• Analyzing Requests
• Local Logging Facilities and Destinations
• Viewing Logs in the Configuration Utility
• Defining the Logging Profile
• Configuring Response Logging

• Defining Parameter Types
• Defining Static Parameters
• Defining Dynamic Parameters
• Defining Parameter Levels
• Other Parameter Considerations

• Overview of Automatic Policy Building
• Defining Templates Which Automate Learning
• Defining Policy Loosening
• Defining Policy Tightening
• Defining Learning Speed: Traffic Sampling
• Defining Track Site Changes

• Integrating Scanner Output
• Importing Vulnerabilities
• Resolving Vulnerabilities
• Using the Generic XML Scanner XSD file

• Defining a Parent Policy
• Defining Inheritance
• Parent Policy Deployment Use Cases

• Defining Login Pages for Flow Control
• Configuring Automatic Detection of Login Pages
• Defining Brute Force Attacks
• Brute Force Protection Configuration
• Source-Based Brute Force Mitigations
• Defining Credential Stuffing
• Mitigating Credential Stuffing

• Defining Session Tracking
• Configuring Actions Upon Violation Detection

• Defining Denial of Service Attacks
• Defining the DoS Protection Profile
• Overview of TPS-based DoS Protection
• Creating a DoS Logging Profile
• Applying TPS Mitigations
• Defining Behavioral and Stress-Based Detection

• Classifying Clients with the Bot Defense Profile
• Defining Bot Signatures
• Defining F5 Fingerprinting
• Defining Bot Defense Profile Templates
• Defining Microservices protection

• Targeting Elements of Application Delivery
• Exploiting the Document Object Model
• Protecting Applications Using DataSafe
• The Order of Operations for URL Classification

• Final Lab Project (Option 1) – Production Scenario
• Final Lab Project (Option 2) – Managing Traffic with Layer 7 Local Traffic Policies

*Course fee/pax. Minimum 4 registration is required to schedule the Class.