Scribd
Upload

F5 ASM Training Course Overview

248 views3 pages
The F5 ASM Training course provides participants with hands-on experience deploying, tuning, and operating the BIG-IP Application Security Manager to protect web applications from HTTP-based…

Uploaded by

vidit mehta
  • Introduction
  • Course Objectives
  • Course Topics

F5 ASM Training

The BIG-IP Application Security Manager course gives participants a functional


understanding of how to deploy, tune, and operate BIG-IP Application Security
Manager (ASM) to protect their web applications from HTTP-based attacks.

The course includes lecture, hands-on labs, and discussion about different ASM
components for detecting and mitigating threats from multiple attack vectors such
web scraping, Layer 7 Denial of Service, brute force, bots, code injection, and zero
day exploits.

Course Objectives

 Describe the role of the BIG-IP system as a full proxy device in an application
delivery network

 Provision the Application Security Manager

 Define a web application firewall

 Describe how ASM protects a web application by securing file types, URLs,
and parameters

 Deploy ASM using the Rapid Deployment template (and other templates) and
define the security checks included in each

 Define learn, alarm, and block settings as they pertain to configuring ASM

 Define attack signatures and explain why attack signature staging is important

 Contrast positive and negative security policy implementation and explain


benefits of each

 Configure security processing at the parameter level of a web application

 Use an application template to protect a commercial web application

 Deploy ASM using the Automatic Policy Builder

 Tune a policy manually or allow automatic policy building

 Integrate third party application vulnerability scanner output into a security


policy
 Configure login enforcement and session tracking

 Configure protection against brute force, web scraping, and Layer 7 denial of
service attacks

 Implement iRules using specific ASM events and commands

 Use Content Profiles to protect JSON and AJAX-based applications

 Implement Bot Signatures

 Implement Proactive Bot Defense

Course Topics

 Provisioning ASM

 Traffic processing with BIG-IP Local Traffic Manager (LTM)

 Web application concepts

 Web application vulnerabilities

 Security policy deployment

 Security policy tuning

 Attack signatures

 Positive security building

 Securing cookies and other headers

 Reporting and logging

 Policy Diff, merging, and exporting

 Advanced parameter handling

 Using application templates

 Using Automatic Policy Builder

 Integrating with web vulnerability scanners

 Login enforcement
 Brute force mitigation

 Session tracking

 Web scraping detection and mitigation

 Geolocation Enforcement and IP Address Exceptions

 Using Parent and Child policies

 Layer 7 DoS protection

 ASM and iRules

 Using Content Profiles for AJAX and JSON applications

F5 ASM Training The BIG-IP Application Security Manager course gives participants a funct
 Configure login enforcement and session tracking  Configure protection against brute force, web scraping, and Layer 7 deni
 Brute force mitigation  Session tracking  Web scraping detection and mitigation  Geolocation Enforcement and IP Address

You might also like