Introduction F5 ASM Attack Signature Sets

--> Attack Signatures are the rules and patterns which identifies the attacks in a request to access the web application.

--> Attack Signatures are the basis for negative security model in ASM.

--> Whenever ASM receives any request for the web application, it checks for attack signatures enabled on the security policy.

--> If the request matches the attack signature then ASM triggers a violation based upon the mode request will be blocked ( Blocking Mode) or will not be blocked ( Transparent Mode).

--> Attack signatures works by buffering and holding different parts an HTTP request for inspection.

--> Attack Signatures in ASM of two types,

i) System Defined Attack Signatures: These are the signatures created by F5 and added to the attack signature pool.

ii) User Defined Attack Signatures: These are the signatures created by the Administrator and added to the attack signature pool.

--> Individual signatures cannot be applied to security policy. An Attack signature is set is assigned to security policy

--> An attack signature set is a group of individual attack signatures.

--> By default, Generic Attack Signature Set is applied to new security policy.

--> ASM Module comes with more than 2000 predefined attack signatures.

--> We can update these signatures using manual method or automatic method.

--> In Automatic Method, BIG IP system downloads the update file by using its own self IP address.

--> In Manual Method, BIG IP Admin needs to download the update file from downloads.f5.com

--> Updating Attack signatures provide updates to existing attack signature sets as well as adds new signature sets to the ASM.

--> Prior to version 13, attack signatures which are updated or new signatures placed into staging state.

--> From Version 13, we can select which attack signatures need to be placed in staging state.

--> In order to update attack signatures automatically, BIG IP ASM needs to have access to following Servers:

1) callhome.f5.com

2) activate.f5.com

--> If you want to know latest security announcements, attack signature updates by subscribing to F5 security Alerts mailing list ( https://interact.f5.com/F5-Preference-Center.html).

Ref: F5.com

Md.Kareemoddin

CCIE # 54759