Forum Discussion

DocteurBGP's avatar
DocteurBGP
Icon for Nimbostratus rankNimbostratus
Jun 06, 2023

Difference between Rest API security protection and API Security ASM template ?

Hi,

I have to protect some Rest API with ASM.

I saw that there are 2 different API protection features :

1) Create an ASM policy with the API security template where you just import the swagger file.

2) Use the guided configuration tool and create an API security protection. I can see that this also add some APM features to manage authentication

What is the difference between the 2 ?

I do not need to manage authentication at F5 level,  which one should I use ?

 

security
  • Daniel_Wolf's avatar
    Daniel_Wolf
    Icon for MVP rankMVP
    Jun 06, 2023

    Hi DocteurBGP,

    the APM Policy can

    1. import an Open API Spec file
    2. verify that the API call is made to an allowed API endpoint.
    3. verify that clients makes only unauthenticated API calls and verify JWT access tokens
    4. do Rate Limiting

    The AWAF Policy can

    1. import an Open API Spec file and validate that the API request conforms to the spec file
    2. protect against Web Application Threats

    To my surprise the AWAF Policy can import an Open API Spec file but does not build a list of allowed URLs (methods / endpoints) from it.

    KR
    Daniel

  • NUT2889's avatar
    NUT2889
    Icon for Cirrostratus rankCirrostratus
    Jun 13, 2023

    Hi DocteurBGP,

    Referring to your question. This is my opinion below:

    1) Swagger file import to F5 ASM / AWAF
    Generally the Swagger file will help to security team to reduce the time and false postivie to understand your API service has been protected by WAF/API security solution. I will call this is a "Positive Security Model".

    Reference from Introduction to Application Security Manager (f5.com)
    " Positive security features indicate which traffic has a known degree of trust, such as which file types, URLs, parameters, or IP address ranges can access the web server."

    Then the F5 ASM / AWAF will not touch any authentication method in your API services.

    2) API security protection
    Reference from Configure API security protection using the F5 BIG-IP Guided Configuration

    Seems to F5 APM will interact with session-based level of API since authentication until request/response the data.

    3) I do not need to manage authentication at F5 level,  which one should I use ?
    Normally base on the many criteria within your solution or organization. Below is based on my experience:

    The WAF operation team mostly not understand how your API service working, how your API authentication working.  I'm try to say you should move API authentication management to API gateway level. But our WAF will help them to secure the API services.

    Hope it helpfull.