This course is not currently offered by Global Knowledge. Information here is provided for reference only.

In this four-day course, you will learn ways to manage web-based and XML application attacks and how to use Application Security Manager to defend against these attacks.

Through lectures, labs, demonstrations, and discussions, you will cover installation, configuration, management, security policy building, traffic learning, and implementation of Application Security Manager in both stand-alone and modular configurations.

Note: You are required to bring your own laptop to class.

What You'll Learn

• HTTP and HTML Concepts
• Common HTTP Vulnerabilities
• HTTP Classes
• Security Policy Building
• Wildcard Entities
• Traffic Learning
• Parameter Configuration and Protection
• Security Policy Templates
• Web Services Protection
• Protocol Security Manager Configuration
• Logging Profiles
• Install and Understand Web Application Configuration
• Configure a Security Policy Based on Live Traffic
• Rapid Deployment Techniques
• Monitor and Administer Application Security Manager

Who Needs to Attend

Those who need to learn to use Application Security Manager to defend against attacks.

Prerequisites

Understanding of:

• Basic HTTP and HTML concepts
• Basic security concepts
• Common network terminology
• Web application terminology

Proficiency in:

• Basic PC operation and application skills, including operating a CD drive, keyboard, mouse, and Windows OS
• Basic web browser operation (Internet Explorer is used in class)

Follow-On Courses

There are no follow-ons for this course.

Course Outline

1. Installation and Initial Access

• BIG-IP
• Licensing and the Setup Utility
• Provisioning

2. Web Application Concepts

• Web Application Basic Overview
• Web Page Components
• HTTP Concepts
• HTTP Request Components
• HTTP Headers

3. Web Application Vulnerabilities

• Web Application Vulnerabilities Overview
• Risk Mitigation and ASM

4. ASM Application Configuration

• Configuration Components
• HTTP Class
• Virtual Servers
• SSL Termination/Initiation
• HTTP Request Flow

5. Security Policy Overview

• Security Policy Properties
• Policy Enforcer
• Security Policy Configuration
• Security Policy Components

6. Security Policy Building Tool

• Deployment Wizard
• Rapid Deployment Concepts

7. Application-Ready Security Policy

8. Reporting

9. Administering ASM

• User Management
• Human Readable Policy
• Synching Configurations
• ASM qkview
• Upgrading to v10

10. Configuration Lab Project 1

11. Traffic Learning

• Learning Concepts
• Violations

12. Parameters

• Parameter Types
• Parameter Levels

13. Security Policy Builder

14. Advanced Topics

• ASM iRules
• Flow Login Pages
• Anomaly Detections

15. XML and Web Services

• XML Concepts
• Web Services Protection

16. Protocol Security Manager

• Protocol Security Manager Overview
• FTP Protection
• SMTP Protection
• HTTP Protection
• Protocol Security Manager Statistics
• Configuring Protocol Security Manager

17. Configuration Lab Project 2

• Review Questions

Labs

Lab 1: Installation and Setup Labs

• Install and Setup Labs
• Licensing System Labs
• Setup Utility Labs
• Configuration Utility Lab
• Configuration Backup Lab

Lab 2: Fiddler Lab

Lab 3: HTTP Vulnerabilities Lab

Lab 4: ASM Applications Configuration Lab

Lab 5: Security Lab Policy

• Attack Signatures Lab

Lab 6: Rapid Deployment Lab

• Data Guard Lab
• Attack Signatures Lab

Lab 7: Application-Ready Security Policy Lab

Lab 8: Reporting Lab

• Remote System Log Server Lab

Lab 9: Partitions and User Roles Lab

Lab 10: Human Readable Policy Lab

Lab 11: Traffic Learning Lab

Lab 12: Parameters Lab

Lab 13: Security Policy Builder Lab

Lab 14: iRules Labs

• iRules #1
• iRules #2
• Flow Login Pages Lab
• Web Scraping Labs

Lab 15: XML and Web Services Lab

Lab 16: Protocol Security Manager FTP Lab