How to deploy a basic OWASP Top 10 for 2021 compliant declarative WAF policy for BIG-IP

This article follows up the excellent article written by Valentin_Tobi on the same subject based on OWASP Top 10 2017.  I will borrow heavily from the original and update this where changes have been made.

Due to length of this article, I will split this into parts to more easily digest.  Part 1 will cover what is OWASP Top 10 for 2021 and what are the key changes.  Part 2 will  cover the OWASP Compliance dashboard in BIG-IP and what code we will use to bring our device into compliance.

This article describes an example of a minimal declarative WAF policy that is OWASP Top 10 compliant. Note that there are policy elements that are customized for the application being protected, in this case a demo application named Arcadia Finance, so they will need to be adapted for each application.

The policy was configured following the pattern described in K45215395: Securing against the OWASP Top 10 for 2021 guide and its conformance with OWASP Top 10 is being verified by consulting the OWASP Compliance Dashboard bundled with F5's Advanced WAF.

OWASP Top 10 2021 introduction and key changes from 2017

As described in K45215395: Securing against the OWASP Top 10 for 2021, the current OWASP Top 10 for 2021 vulnerabilities are:

 

Broken access control (A1) moves up from the fifth position; 94% of applications were tested for some form of broken access control.

Cryptographic failures (A2) shifts up one position to #2, previously known as Sensitive data exposure.

Injection (A3) slides down to the third position. 94% of the applications were tested for some form of injection.

Insecure design (A4) is a new category for 2021. Insecure design is focused on the risks associated with flaws in design and architecture. To exploit insecure design, attackers can threat model workflows in the software to reveal a broad range of vulnerabilities and weaknesses.

Security misconfiguration (A5) moves up from #6 --The former category for XML External Entities (XXE) is now part of this category.

Vulnerable and outdated components (A6) Component-based vulnerabilities occur when a software component is unsupported, out of date, or vulnerable to a known exploit.

Identification and authentication failures (A7) was previously Broken Authentication. Identification and authentication failures can occur when functions related to a user's identity, authentication, or session management are not implemented correctly or not adequately protected by an application.

Software and data integrity failures (A8) is a new category for 2021. Software and data integrity failures relate to code and infrastructure that does not protect against integrity violations. Attackers can exploit these failures to introduce unauthorized access, malicious code, or complete system compromise.

Security logging and monitoring failures (A9) was previously Insufficient Logging & Monitoring. Insufficient logging, monitoring, or reporting makes your application susceptible to attacks that target any part of the application stack.

Server-side request forgery (SSRF) (A10) Server-side request forgery (SSRF) flaws occur when a web application fetches a remote resource without validating the user-supplied URL. To execute an SSRF attack, the attacker abuses the functionality on the server to read or update internal resources.

Most of these vulnerabilities can be mitigated with a properly configured WAF policy while, for the few of them that depend on security measures implemented in the application itself, there are recommended guidelines on application security which will prevent the exploitation of OWASP 10 vulnerabilities.

In the follow-on article, I will cover the declarative WAF policies and the effect they have on the BIG-IP Advanced WAF. Here