F5 Offers Advanced Web Security With BIG-IP v10.1

BIG-IP V10.1Advanced Web Security
November 2009

F5 Announcement Highlights
New release of BIG-IP delivers advanced Web security solutions to help customers efficiently address threats to Web applications

Web scraping attack protection
Better protection against automated scanners and bots
Simplified PCI compliance
Reporting with human readable policies to validate compliance with PCI DSS 1.2
Secure and Dynamic DNS
Meets DNSSEC 2009 government compliance
IP Geo-Location database
Integrated into F5’s TMOS architecture
Announcement date: Nov. 16, 2009

Airline Inventory Vulnerable to Web Scraping
Ryanair – Stolen data, litigation costs, decreasing revenue
Wins injunction against Vtours GmBH
Forbids screen-scraping as commercial use*
Ryanair sent cease and desist letters to 300 sites
easyJet warns Expedia: 'Hands off our flights‘

Protection from Web Scraping
Remote users
Dublin Datacenter
Frankfurt Datacenter
Legitimate users see inventory while scrapers are remediated
IT Staff
IT Staff
Automated scraper
Comprehensive reporting on scraping attacks
Web
Domino
Network
Detect requests and determine web site is being scraped
Web
Domino
Network
BIG-IP 8900
BIG-IP 6900
LTM/ASM
LTM/ASM
Solution
Protects valuable intellectual property
Prices are controlled and users see airline approved inventory
Integrated scrape reporting for PCI compliance
Avoid litigation drastically reducing legal costs

Attack Expert System

Improved PCI Compliance Reporting

DNS Infrastructure is VulnerableSpoofing and cache poisoning allow hijacking of domains
Example.com
www.example.com?
www.example.com?
GSLB
123.123.123.123
012.012.012.012
App Servers
LDNS
Cache poisoning
Problem
Need to secure DNS infrastructure

Cache poisoning and spoofing can hijack DNS records
Need a method for trusted responses
Need to meet US Government mandate for DNSSEC compliance

Hacker

Securing the DNS InfrastructureDynamic and secure DNS with Global Traffic Manager
Example.com
www.example.com?
www.example.com?
BIG-IP GTM
123.123.123.123
+ public key
123.123.123.123
+ public key
App Servers
LDNS
Client gets signed, trusted response
Solution
Secure and dynamic DNS

Ensure users get trusted DNS queries with signed responses
Reduce management costs – Simple to implement and maintain
Meet mandates with DNSSEC compliant solution

Hacker

F5 – A Better Solution For Web Security
BestWAF with protection from Web Scraping (ASM)
Best WAF to assist administrators in understanding security threats (ASM: Attack Expert)
Simplified PCI Reporting (ASM)
Only GSLB with DNSSEC (GTM)