1. What is F5 AWAF

Attack signatures: is a set of rules or patterns that identify potential known attacks on web applications. When traffic comes into the application, the system compares it against these signatures to detect malicious activities.

Geolocation enforcement (whitelist or blacklist): allows administrators to control access to web applications based on the geographic location (country) of the user.

IP intelligence (known malicious IP addresses): blocking client requests from IP addresses with known bad reputations. It utilizes a database maintained by Webroot’s IP Reputation service, which lists IP addresses identified for malicious activities such as attacks or exploits.

Cookie security: It prevents unauthorized changes to cookies. The most common example is to ensure that session cookies set by the web application are not modified on the client side.

Data Guard: Prevents leakage of confidential information from web applications. This involves scanning responses for sensitive information such as credit card numbers or social security numbers and either blocking or masking this information with asterisks (****). It can be configured to protect custom patterns using regular expressions to check specific file types or content types.

Login Enforcement: protect web applications from brute force attacks by monitoring and controlling access attempts. It tracks the number of failed login attempts and can block or challenge users based on predefined conditions. It also protect important pages to be accessed only by authenticated users.

File type protection: manage the types of files that can be uploaded to or from your web application.

URL protection: allows you to configure allowed or disallowed HTTP or HTTPS URLs in the security policy.

Parameter protection: In a web application, a parameter is a piece of data that can be passed between different parts of the application or between the client and server. Parameters are often used in the context of URLs, forms, or function calls within the application’s code. with this features it protects web application with enforcing checks on parameters against a set of rules for things like illegal parameter value length and illegal meta characters in values.

HTTP header and methods protection: ensuring that only legitimate and expected HTTP methods (like GET, POST, HEAD) and headers are used in requests.

Brute force protection: is designed to safeguard web applications from brute force attacks.The feature works by tracking the number of failed login attempts to configured login URLs. If the system detects a high rate of failed logins or a certain threshold is reached, it considers it an attack.

Cross-Site Request Forgery (CSRF) protection: These attacks exploit the trust a web application has in a user’s browser, tricking the browser into executing unwanted actions in a web application where the user is authenticated. The CSRF protection feature works by inserting custom JavaScript into response pages, which adds a unique token to each URI and form submission. This token must be present and valid for subsequent requests to be accepted by the server. If a request lacks the correct token, it’s considered a CSRF attack and is blocked, thereby preventing unauthorized commands from being executed.

XML and JSON protection: It ensures that the structure and content of XML and JSON requests comply with the expected format, preventing common attacks such as XML External Entity (XXE) and JSON threats. JSON Injection is a type of attack where malicious code is injected into JSON data. XML External Entity (XXE) occurs when an attacker exploits XML parser to include hostile external entities during the processing of XML documents.

User tracking: is monitoring and collecting data on user behavior and activities. This information is used to improve user experience.

Session tracking: It tracks user sessions using login pages, session IDs, or unique DeviceIDs for each client. This feature helps identify users or sessions that may be involved in an attack such as session hijacking.

Web scraping protection (extract data from websites): protect web applications from unauthorized data extraction methods using various methods such as bot detection, excessive session creation from a single IP address, or high data volume transfer.

DoS protection: is designed to protect web applications from denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks. It is based on monitoring transaction rates on the client side or latency on the server side, ensuring resource-intensive URLs are protected, using machine learning to learn application behavior, and continuously monitoring server health.

Positive/negative security model: negative secutity model allows all transactions except those identified as threats or attacks. It utilizes attack signatures to detect and prevent common vulnerabilities like web injections and cross-site scripting (XSS). Positive Security Model blocks all traffic by default, only allowing transactions that are known to be valid and safe. when used together, they can provide a robust defense for web applications against a wide range of security risks.

Audit logging and reporting: logs every significant event or change within the AWAF, which is essential for monitoring security events and can be critical for diagnosing problems.

Web App Vulnerability Scanner Integration: AWAF can integrate with various vulnerability assessment tools like HP WebInspect, IBM AppScan, and Qualys. It uses the results from these scanners to suggest updates to the security policy. In cases where Policy Builder decisions might conflict with scanner results, administrators have the flexibility to determine the final security policy settings.