F5 BIG-IP Web Application Firewall
f5bigipWAFWeb SecurityOWASP
Positive security model
- >Positive: only allow positive (good) requests and block all others — e.g. allowed file types, allowed URL, allowed parameters, and allowed responses.
- >Negative: allow all traffic except known negative (bad) requests — e.g. attack signatures, malware hidden behind legitimate traffic, Data Guard.
Policy templates
- >Rapid
- >Minimal configuration
- >Relies on negative security
- >Learning mode — Manual
- >Enforcement mode — Transparent
- >Fundamental
Security policy
- >Transparent — do not block, let traffic pass and learn.
- >Blocking — blocks requests if the policy is attached.
Signature
- >Learn — appears in the traffic learning page.
- >Alarm — appears in the event log if the policy is in transparent. If the security policy is in blocking, the alarm will be generated even if the alarm flag is not ticked.
- >Block — block requests belonging to selected signature sets.
Signature sets
- >Staging — this signature set is learning and will not block anything.
- >Enforced — block traffic from this signature set.
WAF policy check1/3
Which security model allows only traffic you have explicitly defined?
Signature actions3 blanks
A signature can (traffic learning page), (event log), or requests in the selected set.
try it before revealing