Presque toutes les entreprises sont engagées dans un processus de transformation digitale. Cette transformation génère de nouveaux risques et les attaques ciblant les applications web sont actuellement la cause principale des violations de données. Si la plupart des WAF (pare-feu applicatif) permettent de faire face aux menaces les plus courantes et déjà identifiées, ils sont pourtant inadaptés pour contrer les attaques avancées qui ne cessent de se développer à un rythme effréné. Karim ZGUIOUI - Systems Engineer North Africa - F5

3. Stop web attacks
Fix vulnerabilities
Risk & compliance

4. 765Average # of
Apps in use per
enterprise
6 min
before it's scanned
If vulnerable, you
could be PWND in
<2 hours
1/3Mission critical

5. 2013 OWASP Top 10
1. Injection
2. Broken authentication and session
management
3. Cross-site scripting (XSS)
4. Insecure direct object references
5. Security misconfiguration
6. Sensitive data exposure
7. Missing function level access control
8. Cross-site request forgery (CSRF)
9. Using components with known
vulnerabilities
10. Unvalidated redirects and forwards
2017 OWASP Top 10
1. Injection
2. Broken authentication
3. Sensitive data exposure
4. XML external entities (XXE)
5. Broken access control
6. Security misconfiguration
7. Cross-site scripting (XSS)
8. Insecure deserialization
9. Using components with known
vulnerabilities
10. Insufficient logging
and monitoring
2013 OWASP Top 10
1. Injection
2. Broken authentication and session
management
3. Cross-site scripting (XSS)
4. Insecure direct object references
5. Security misconfiguration
6. Sensitive data exposure
7. Missing function level access control
8. Cross-site request forgery (CSRF)
9. Using components with known
vulnerabilities
10. Unvalidated redirects and forwards
2017 OWASP Top 10
1. Injection
2. Broken authentication
3. Sensitive data exposure
4. XML external entities (XXE)
5. Broken access control
6. Security misconfiguration
7. Cross-site scripting (XSS)
8. Insecure deserialization
9. Using components with known
vulnerabilities
10. Insufficient logging
and monitoring

6. App-layer DDoS has
increased by 43%
77% of web attacks start
from botnets
3 Billion Credentials were
reported stolen in 2016

7. Traditional WAF vendors have been slow to offer
protections against Non-OWASP Top 10 attacks
© 2017 F5 Networks 7
Traditional WAF:
SSL/TLS InspectionSSL/TLS Inspection
ScriptingScripting
OWASP Top 10OWASP Top 10
Advanced WAF:
SSL/TLS Inspection
Scripting
OWASP Top 10
Proactive Bots
Defense
Credential Protection
API Attacks
Protection
Threats Campaign
app

9. F5 Advanced WAF
Protect against bots, credential attacks, and app-layer DoS
Key Benefits:
• Protects Web and mobile apps from
exploits, bots, theft, app-layer DoS
• Prevent malware from stealing data
and credentials
• Prevent Brute Force attacks that
use stolen credentials
• Eliminate time-consuming manual
tuning for App-layer DoS protection
Defend against bots
• Proactive bot defense
• Anti-bot mobile SDK
• Client and server monitoring
Protect apps from DoS
• Auto-tuning
• Behavioral analytics
• Dynamic signatures
Prevent Account Takeover
• App-level encryption
• Mobile app tampering
• Brute Force protection
Mobile
Bot Mitigation
Credential Protection
App-Layer DoS
Hacker
Anti-bot
Mobile SDK
Bots
F5 Advanced WAF
Users
credentials

10. QUESTIONS?

11. THANK YOU!!!