Difference between Rest API security protection and API Security ASM template ?

Hi DocteurBGP,

the APM Policy can

1. import an Open API Spec file
2. verify that the API call is made to an allowed API endpoint.
3. verify that clients makes only unauthenticated API calls and verify JWT access tokens
4. do Rate Limiting

The AWAF Policy can

1. import an Open API Spec file and validate that the API request conforms to the spec file
2. protect against Web Application Threats

To my surprise the AWAF Policy can import an Open API Spec file but does not build a list of allowed URLs (methods / endpoints) from it.

KR
Daniel

Hi DocteurBGP,

Referring to your question. This is my opinion below:

1) Swagger file import to F5 ASM / AWAF
Generally the Swagger file will help to security team to reduce the time and false postivie to understand your API service has been protected by WAF/API security solution. I will call this is a "Positive Security Model".

Reference from Introduction to Application Security Manager (f5.com)
" Positive security features indicate which traffic has a known degree of trust, such as which file types, URLs, parameters, or IP address ranges can access the web server."

Then the F5 ASM / AWAF will not touch any authentication method in your API services.

2) API security protection
Reference from Configure API security protection using the F5 BIG-IP Guided Configuration

Seems to F5 APM will interact with session-based level of API since authentication until request/response the data.

3) I do not need to manage authentication at F5 level,  which one should I use ?
Normally base on the many criteria within your solution or organization. Below is based on my experience:

The WAF operation team mostly not understand how your API service working, how your API authentication working.  I'm try to say you should move API authentication management to API gateway level. But our WAF will help them to secure the API services.

Hope it helpfull.