F5 BIG-IP Next and Distributed Cloud
f5bigipDistributed CloudAPI SecurityWAF
- >traffic-group-local-only: self IP.
- >traffic-group-1: floating IP.
Full proxy architecture
Expand
- >BigIP can modify various HTTP headers, data, etc.
- >The connection to BigIP can be secured with SSL and the connection to the server can be unencrypted.
- >To reduce load on servers, the connection to BigIP can be compressed and the connection to the server can be uncompressed.
- >Different HTTP versions compatible with the web servers can be used in BigIP.
BigIP architecture
Expand
BigIP components
Expand
Process:
Expand
User Configuration Set (UCS)
- >Compressed archive.
- >Can be encrypted.
- >Can include or exclude public keys.
- >Can be downloaded.
- >Backups are stored in
/var/local/ucs. - >Contains configuration files, licenses, user accounts and passwords, SSL certs and keys.
We can go to System > Support > QKView snapshot for support, and import the file into iHealth.
F5 Distributed Cloud
Expand
Multicloud: use multiple cloud providers as well as on-prem for sensitive stuff.
Expand
- >Collaborate across teams with a centralized SaaS console to simplify planning and streamline execution.
- >Automate network configs and security deployment to reduce effort, errors, and gaps in coverage.
- >Advanced security filters out bad traffic before it hits customer networks, and stays up to date.
- >Full-stack observability of network, security, and application performance, cloud-agnostic and exportable.
Expand
API security
- >Discover — continuous detection of new/unknown APIs, schema, characterization of data exposed, authentication status, and API vulnerabilities.
- >Monitor — continuous traffic inspection, analysis, and anomaly detection.
- >Secure — continuous enforcement of schemas, rate limiting, and blocking of undesirable and malicious traffic.
Customer Edge based solution → the customer has more granular control over their traffic, except metadata (name of WAF policies, name of WAF).
| Shadow API | Zombie API |
|---|---|
| A shadow API is an unmanaged API that is actively being used. | A zombie API is an API that has been deprecated or abandoned. Maybe used for test purposes. |
| Shadow APIs are not necessarily APIs that are used for malicious purposes. | Zombie APIs may already be identified and managed by an organization, but they are not actively being used. |
- >Automatically learns the app API surface.
- >Using AI/ML, models are built to baseline and track API behavior.
- >For each API leaf, a model is built for errors, latency, and request metrics.
- >Detect outliers and shadow APIs.
- >Export swagger to improve API definitions/update inventory.
- >Discovery and validation of APIs.
- >Discover and view authentication status, details, and risk scoring for all API endpoints.
- >Easily create protection rules (e.g. blocking, rate limiting, etc.).
- >Behavioral analysis of API endpoints.
- >Monitor and baseline API behavior continuously with a machine learning (ML) engine.
- >Easily identify anomalies (e.g., spikes in request rates, latency, response size, etc.).
- >Identify any PII in API communications.
Expand
WAF
- >False positive suppression engine.
- >Cloud scrubbing.
- >Gartner report.
Shadow or zombie?2 blanks
An unmanaged API that is actively being used is a API. An API that has been deprecated or abandoned is a API.
try it before revealing
Answer it in your head first, then reveal.