10 Sub-Modules | 28 Lessons

• The effects of common attacks on web applications (how ASM affects clients and applications in transparent and blocking mode, and the OWASP Top Ten summarised properly)

• How specific policies mitigate specific attacks (reading an iRule or LTM policy that maps traffic to an ASM policy, and the trade-off between security, manageability, false positives and performance)

• Determining policy features and granularity from requirements (turning an application security requirement into technical tasks)

• Choosing the deployment method (web services, vulnerability scanner, templates, rapid deployment)

• The automatic policy builder lifecycle (the profiles it needs, and anomaly detection for DoS, brute force, web scraping and proactive bot defence)

• Reviewing and evaluating policy settings from what ASM has gathered (attack signatures, DataGuard, entities, initial policy building settings)

• Policy structure for policy elements (URLs, parameters, file types, headers, sessions and logins, content profiles, CSRF protection, anomaly detection, DataGuard, proactive bot defence)

• The deployment wizard (its options and their consequences, and selecting the right deployment model for the business requirement)

• Logging options (remote logger specifications: ports, log types, formats, address)

• The attack signature lifecycle (staging, enforcement readiness period, and choosing the right signatures or signature sets)

5 Sub-Modules | 15 Lessons

• The implications of a policy change on both the security and the functionality of the application

• Integrating third party vulnerability scan output with ASM (refining policy elements from the results, and managing policies with import, export, merge and revert)

• Evaluating whether the rules actually mitigate the violations they are supposed to

• Adjusting a policy from the available data (tuning for performance, including wildcards used deliberately rather than lazily)

• Policy management functions (policy status, the violation types that exist in ASM, merging and differentiating between policies)

4 Sub-Modules | 12 Lessons

• Interpreting log entries to refine the policy (examining traffic violations, determining whether attack traffic got through, removing false positives, and locating violations reported by users and developers)

• Identifying trends from an ASM report (each major violation category and how ASM detects the exploit, plus generating reports covering anomaly statistics, charts, requests and PCI compliance status)

• Choosing the appropriate mitigation for a given attack or vulnerability, and adapting the policy to it

• Deciding whether the mitigation worked (choosing a user-defined attack signature that responds to the specific traffic)

6 Sub-Modules | 18 Lessons

• Policy performance issues and their mitigation (performance graphs and statistics read alongside the configuration, and the effect of Guaranteed Logging)

• The impact of learning, alarm and blocking settings on enforcement (confirming the policy is actually inspecting and parsing the traffic)

• Examining policy objects to explain why traffic is or is not generating violations (Security Event Logs against the logging profile assigned to the virtual server)

• ASM performance metrics (the impact of ASM iRules, and of traffic spikes, with the mitigation options available)

• System performance issues correlated with policy changes (security policy history read against system performance graphs)

• ASM specific user roles and their permissions