English | Size: 133.57 MB
Genre: eLearning
In this 4 day course, students are provided with a functional understanding of how to deploy, tune, and operate ASM to protect their web applications from HTTP-based attacks.
The course includes lecture, hands-on labs, and discussion about different ASM components for detecting and mitigating threats from multiple attack vectors such web scraping, Layer 7 Denial of Service, brute force, bots, code injection, and zero day exploits.
Course ObjectivesDescribe the role of the BIG-IP system as a full proxy device in an application delivery network
Provision the Application Security Manager
Define a web application firewall
Describe how ASM protects a web application by securing file types, URLs, and parameters
Deploy ASM using the Rapid Deployment template (and other templates) and define the security checks included in each
Define learn, alarm, and block settings as they pertain to configuring ASM
Define attack signatures and explain why attack signature staging is important
Contrast positive and negative security policy implementation and explain benefits of each
Configure security processing at the parameter level of a web application
Use an application template to protect a commercial web application
Deploy ASM using the Automatic Policy Builder
Tune a policy manually or allow automatic policy building
Integrate third party application vulnerability scanner output into a security policy
Configure login enforcement and session tracking
Configure protection against brute force, web scraping, and Layer 7 denial of service attacks
Implement iRules using specific ASM events and commands
Use Content Profiles to protect JSON and AJAX-based applications
Implement Bot Signatures
Implement Proactive Bot Defense
Provisioning ASM
Traffic processing with BIG-IP Local Traffic Manager (LTM)
Web application concepts
Web application vulnerabilities
Security policy deployment
Security policy tuning
Attack signatures
Positive security building
Securing cookies and other headers
Reporting and logging
Policy Diff, merging, and exporting
Advanced parameter handling
Using application templates
Using Automatic Policy Builder
Integrating with web vulnerability scanners
Login enforcement
Brute force mitigation
Session tracking
Web scraping detection and mitigation
Geolocation Enforcement and IP Address Exceptions
Using Parent and Child policies
Layer 7 DoS protection
ASM and iRules
Using Content Profiles for AJAX and JSON applications
Advanced Bot Detection and Defense
Proactive Bot Defense
Simple Edit Mode for Attack Signatures
The Configuring ASM v13.1 course presents much of the same content as v12.1, although all labs now reflect product changes in security policy deployment. The course progresses from securing web applications from common attacks to detecting and mitigating the latest bot attacks. Students can use a new Traffic Client to test automated attacks against an application.
If any links die or problem unrar, send request to
forms.gle/e557HbjJ5vatekDV9