For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Apr 28, 2014

Sort of a generic question, but I'll offer 3 recommendations:

 

  1. If your question is related to positive (default deny + learning) vs. negative (attack signatures) security models, then positive is the better choice.

     

  2. If you don't really understand the application and it's potential vulnerabilities, then start off with a rapid deployment and let it learn the application over a few weeks. And pay close attention to what learning mode reports. You may learn some really interesting things about the apps in the process.

     

  3. While ASM itself is relatively easy to configure, if you don't truly understand how the underlying applications work, and how they may be vulnerable, you may not get the best security policy that you could get otherwise. AppSec isn't rocket science, but it can get pretty close. So I would highly recommend taking a class or two on ASM, if for no other reason than to build a greater appreciation for the power it wields.