Forum Discussion
ErkkiS_295148
Cirrus
CirrusASM best practices and web application updates
Hello!
Could anyone kindly elaborate how the ASM detects web application changes when the application has been upgraded and has changed - does it detect new variables/parameters (that have been added to the web application) etc and allow them after detection or does it block them by default till the learning counter increases enough to make the parameter valid? We have a production system and users all over the world and the development team updates the apps quite frequently. Are there any best practices how the web application upgrades should be handled ASM-wise? Like for example putting the policy to transparent for a an hour or two till the new stuff has been learned by ASM so we won't get any legitimate users/data blocked?
Regards, Erkki
samstepCirrocumulus
Actually I believe the best practice is to never switch the policy to transparent mode in Production. The second you do that - you disable your protection and leave the application exposed to attacks.
What you do is let the policy learn all the application changes in TEST environment - test it with your QA team and verify the changes with application developers to make sure the policy does not block good traffic, then export the policy out of test environment's ASM and import it into the Production ASM.