Security Parameters: Need to be apply to make secure solutions

Hi,

1. Which cookie does not contain the "secure" attribute? Your BIG-IP persistence cookie? If so you should enable it on the cookie persistence profile. If it is the application cookie you should rewrite that cookie (with an irule) to insert the "secure" attribute.
2. Is this for the webserver or for your BIG-IP persistence cookie? (if it is your BIG-IP persistence cookie, enable encryption on the cookie (I think you should alway's encrypt your BIG-IP persistence cookie))
3. Enable HTTP Strict transport security on your BIG-IP HTTP Profile (or is there another header your security team want's to insert?)
4. Did you enable the directory listing attack signatures in your ASM policy?

Cheers,

Kees