F5-401 Security Expert cheat sheet

Positive security model: allow only explicitly permitted methods, paths, parameters, and lengths; negative model blocks known signatures. API discovery feeds the positive model.

API endpoint inventory should be derived from observed traffic plus declared specs (OpenAPI/Swagger), then compared; undocumented shadow endpoints are the primary API risk.

Layered defense order on BIG-IP: LTM virtual server → security policy (AWAF/API protection) → pool; the security policy attaches to the virtual server, so bypassing the VS bypasses protection.

REST vs GraphQL: REST protections center on per-endpoint schema and object-level authorization; GraphQL requires depth, complexity, and alias limits plus query allowlisting.

OWASP API Top 10 mapping: broken object level authorization (BOLA) and broken authentication dominate; enforce object ownership server-side, not via client-supplied IDs.

Rate and sequence rules: per-client request rate, concurrent connection caps, and request-order enforcement (e.g., login before checkout) belong in the policy, not only in the app.

Sensitive data exposure: response-side masking/redaction in the security policy protects PII in JSON/XML bodies; enforce schema validation to reject malformed or oversized payloads.

Parameter-level enforcement: define allowed value types, max lengths, and required/optional flags per parameter; unknown parameters are rejected under a strict positive policy.

WAF enforcement modes: transparent (log only), blocking, and staging/learning; violations have alarm and block flags that are set independently per violation type.

Attack signatures are grouped by accuracy: low, medium, high. Lowering to low accuracy increases false positives; signatures can be disabled per policy or per signature ID.

Learning suggestions must be reviewed before enforcement; accepting suggestions blindly widens the allowlist and erodes the positive model.

Bot defense layers: signature-based detection, behavioral/anomaly detection (request rate, mouse/keyboard telemetry via JavaScript), and client-side challenge (CAPTCHA/JS).

Device ID and browser fingerprinting let bot defense track clients across IP changes; mobile SDK integration is needed to attest native app traffic.

DDoS: volumetric (L3/L4) vs application-layer (L7). L7 mitigation uses request-rate thresholds, slowloris/partial-request detection, and behavioral analysis; L3/L4 uses SYN cookies and geo/IP reputation.

API security in the WAF: schema enforcement, sensitive-parameter detection, and per-endpoint rate limits; GraphQL and gRPC need protocol-aware parsing.

False-positive triage: reproduce the request, identify the triggering violation, then tune the specific parameter/URL or disable the signature rather than lowering global accuracy.

Zero trust principle: no implicit trust from network location; every request is authenticated and authorized per session using identity, device posture, and context.

Access policy evaluation order: identity provider authentication → MFA → device posture check → contextual conditions (geo, time, risk) → allow/deny/step-up.

Least privilege: per-application access policies, not per-network; a user allowed to app A is denied app B unless explicitly granted.

Device posture signals include OS patch level, disk encryption, EDR presence, and certificate presence; failing posture triggers remediation or denial.

ZTNA replaces flat VPN: the connector reaches apps outbound-only, so no inbound ports are exposed; apps are invisible to unauthenticated users.

Microsegmentation enforces east-west policy between workloads; identity-based rules replace IP-based trust inside the data center.

Continuous verification: session re-evaluation on risk change (new geo, token anomaly) rather than one-time login trust.

Logging for zero trust: every allow/deny decision must record identity, device, app, and policy reason for audit and tuning.

TLS 1.3 removes RSA key exchange and static DH; forward secrecy is mandatory via (EC)DHE, and the handshake is one round trip (1-RTT) or 0-RTT on resumption.

Certificate lifecycle: CSR → CA issuance → import to BIG-IP → attach to client SSL profile; track expiry and automate renewal to avoid outages.

SNI-based routing selects the client SSL profile by hostname; a default profile handles clients that send no SNI.

Cipher string order matters: the first shared cipher is chosen; prefer ECDHE with AEAD (AES-GCM, ChaCha20-Poly1305).

Post-quantum: NIST standardized ML-KEM (FIPS 203, from CRYSTALS-Kyber) and ML-DSA (FIPS 204, from Dilithium); hybrid key exchange combines X25519 with ML-KEM for transition safety.

Harvest-now-decrypt-later: long-lived secrets encrypted today can be broken by future quantum computers, so migrate key exchange before signature algorithms.

Certificate pinning and mTLS: client certificate verification enforces mutual auth; pinning must be planned for rotation or it causes hard failures.

OCSP stapling improves revocation checking latency; CRL fallback and must-staple settings affect client trust decisions.

AI Gateway sits between clients and LLM providers: it centralizes authentication, provider routing, token/rate quotas, logging, and cost control.

Guardrails inspect prompts (input) and completions (output) for PII, secrets, toxicity, prompt injection, and policy violations; blocking can occur on either direction.

Prompt injection is untrusted content steering the model; defenses include input filtering, instruction hierarchy, and output validation.

Data leakage control: redact or block sensitive data before it leaves to an external model provider; keep prompt/response logs governed by retention policy.

Workforce AI security governs shadow AI use: discover unsanctioned AI apps, apply acceptable-use policy, and route sanctioned traffic through the gateway.

Model access control: per-team API keys, token budgets, and allowed-model lists prevent cost abuse and data exfiltration via unapproved models.

RAG security: retrieved documents are untrusted input; enforce source allowlists and sanitize retrieved content before it enters the prompt.

Auditability: log who prompted which model with what data, and retain guardrail verdicts for incident review.

Config sync: a device group syncs configs; full sync pushes the config from the sync group owner to peers; verify sync status before and after changes.

Policy deployment: a WAF policy must be attached to the virtual server and the config deployed; a policy in staging does not block until enforcement is enabled.

Traffic flow troubleshooting: virtual server → security policy → pool → pool member; check each hop with logs, request logging, and packet capture.

Common WAF block causes: signature match, illegal method, length violation, parameter violation, or bot defense challenge; the violation name identifies the cause.

Logging destinations: local, remote syslog, or security analytics; ensure the logging profile is attached or events are lost.

High availability: an active/standby pair fails over on health check failure; security policies must be synced or the standby enforces stale rules.

Distributed Cloud Services: services are managed centrally; verify the site/app configuration and edge status before blaming the origin.

Change safety: test policy changes in transparent/staging mode, monitor, then enable blocking; keep a rollback config ready.