Application security and web application firewall
Domain 3 tests whether you can design and operate an application security policy on BIG-IP Advanced WAF (ASM): enforcement modes, the learning workflow, entity types, signatures and the violations that drive blocking decisions.
Enforcement and learning
- A security policy runs in Transparent or Blocking enforcement mode. Transparent logs and learns but never blocks; Blocking enforces the violations configured to block.
- Each entity (URL, parameter, cookie, header, file type, method) has Learn, Alarm and Block flags. Learning suggestions appear while the policy is transparent or in staging; accepting a suggestion adds the entity to the allowed set.
- Policy staging runs a tightened policy in alarm-only mode before it becomes enforcing, which is how you validate false-positive risk.
Positive and negative security
- The positive model allows only explicitly permitted URLs, parameters and methods. It is strong against unknown attacks, but must be tuned from real traffic.
- The negative model relies on attack signatures and threat campaigns; signatures carry accuracy ratings and can themselves be staged.
- Violations include illegal URL, illegal method, parameter value or length, CSRF, brute force, session hijacking and data guard leakage. A single request can trigger several at once.
Worked example
A new POST /api/v2/orders endpoint returns an illegal URL violation while the policy is transparent. Reasoning: the URL entity is not yet in the allowed set, so the policy alarms and suggests adding /api/v2/orders with the POST method and a JSON profile. The suggestion is accepted, traffic is observed through staging, and only then is the policy moved to blocking. Moving to blocking first would have blocked legitimate orders.
Traps that cost marks
- Assuming staging already blocks traffic.
- Forgetting to attach the security policy to the virtual server.
- Expecting signatures to catch business-logic abuse such as price manipulation.
- Accepting every learning suggestion without checking the learning data for attack traffic.