Forum Discussion
zandar_304392
Nimbostratus
NimbostratusBest way to let developers adjust ASM policy
Hello Everyone,
Intro: Behind our F5's we have multiple web servers managed be different dev teams with different security levels and also working with different technologies.
I'd like to a...
You're describing the typical dilemma of risk management. Luckily (or sadly), you only have 2 choices here. The same as with any other security upgrades.
- Accept increased risk of service disruption but minimize risk of security breaches
- Accept increased risk of security breaches but minimize risk of service disruption
My preference is first. I always want to avoid using any learning or staging. But this also means a WAF 'babysitter' must personally attend every application upgrade intervention to make quick calls and policy adjustments accordingly. Legitimate traffic blockings will inevitably occur more often with this path of action. That's the tradeoff. On positive, policies will be exposed to 'unfinished' status for a much shorter period of time as the application upgrades take place.
Hannes_RappNimbostratus
NimbostratusYou're describing the typical dilemma of risk management. Luckily (or sadly), you only have 2 choices here. The same as with any other security upgrades.
- Accept increased risk of service disruption but minimize risk of security breaches
- Accept increased risk of security breaches but minimize risk of service disruption
My preference is first. I always want to avoid using any learning or staging. But this also means a WAF 'babysitter' must personally attend every application upgrade intervention to make quick calls and policy adjustments accordingly. Legitimate traffic blockings will inevitably occur more often with this path of action. That's the tradeoff. On positive, policies will be exposed to 'unfinished' status for a much shorter period of time as the application upgrades take place.
zandar_304392Hello Hannes Rapp,
thank you for your answer. We are currently using let say little bit automated option nr. 1. But as our web services are growing, I'm looking for maybe more optimal way to address this issues.
I'm completli aware of what are you writing here and thats why I believe I could develop some kind of "self provisioning" portal for developers to upgrade the security policy.
Y