Because XML is used as a data exchange mechanism, it is important to inspect, validate, and protect XML transactions. With XML security, you can protect the following applications:

• Web services that use HTTP as a transport layer for XML data
• Web services that use encryption and decryption in HTTP requests
• Web services that require verification and signing using digital signatures
• Web applications that use XML for client-server data communications, for example, Microsoft Outlook Web Access

You implement XML security by creating an XML profile for a security policy. The XML profile can protect XML applications in the following ways:

• Validates XML format
• Enforces compliance against XML schema files or WSDL documents
• Implements defense rules for XML documents
• Masks sensitive XML data
• Encrypts and decrypts parts of SOAP (Simple Object Access Protocol) web services
• Signs and verifies parts of SOAP messages using digital signatures

1. On the Main tab, click Security > Application Security > Security Policies. The Active Policies screen opens.
2. Click the Create button. The Deployment wizard opens to the Select Local Traffic Deployment Scenario screen.
3. For the Local Traffic Deployment Scenario setting, specify a virtual server to use for the security policy.
   • To secure an existing virtual server that has no security policy associated with it, select Existing Virtual Server and click Next.
   • To create a new virtual server and pool with basic configuration settings, select New Virtual Server and click Next.
   • To create an active but unused security policy, select Do not associate with Virtual Server and click Next. No traffic will go through this security policy until you associate it with a virtual server. The Policy Builder cannot begin automatically creating a policy until traffic is going to ASM through the virtual server.
   The virtual server represents the web application you want to protect. The Configure Local Traffic Settings screen opens if you are adding a virtual server. Otherwise, the Select Deployment Scenario screen opens.
4. If adding a virtual server, configure the new or existing virtual server, and click Next.
   • If creating a new virtual server, specify the protocol, name, virtual server destination address and port, and pool member IP address and port.
   • If using an existing virtual server, it must have an HTTP profile and cannot be associated with a local traffic policy.
   • If you selected Do not associate with Virtual Server, you will have to manually associate the security policy with a virtual server at a later time. On the policy properties screen, you need to specify a name for the security policy.
   The name of the virtual server becomes the name of the security policy. The Select Deployment Scenario screen opens.
5. For Deployment Scenario, click Create a policy for XML and web services manually and click Next. The Configure Security Policy Properties screen opens.
6. From the Application Language list, select the language encoding of the application, then click Next.
   Important: You cannot change this setting after you have created the security policy.
7. If the application is not case-sensitive, clear the Security Policy is case sensitive check box. Otherwise, leave it selected.
   Important: You cannot change this setting after you have created the security policy.
8. If you do not want the security policy to distinguish between HTTP and HTTPS URLs, clear the Differentiate between HTTP and HTTPS URLs check box. Otherwise, leave it selected.
9. Click Next. The Configure Attack Signatures screen opens.
10. To configure attack signatures, move the systems used by your web application from the Available Systems list into the Assigned Systems list. The system adds the attack signatures needed to protect the selected systems.
11. Retain the default value of Enabled for the Signature Staging setting. New and updated attack signatures remain in staging for seven days.
12. Click Next. The Security Policy Configuration Summary screen opens.
13. Review the settings for the security policy. When you are satisfied with the security policy configuration, click Finish. The system creates the security policy, and the Create New XML Profile screen opens and displays the message: The initial configuration of the web application is complete. You can now create a new XML profile.

1. If you are on the Create New XML Profile screen, skip to step 2. If not, at the top of the screen, click the Create new XML profile link. You can also navigate to Security > Application Security > Content Profiles > XML Profiles and click Create. The Create New XML Profile screen opens.
2. For Profile Name, type a unique name.
3. Select the Use XML Blocking Response Page check box to send an XML response page when the security policy blocks a request that contains XML content that does not comply with this XML profile.
4. To allow SOAP messages to have attachments, select the Allow Attachments in SOAP Messages check box.
5. In the Defense Configuration area, for Defense Level, select High (the default value), Medium, or Low to specify the level of protection you want the security policy to provide for XML applications and services. The system adjusts the defense configuration settings according to your choice. You can review the settings by selecting Advanced next to Defense Configuration.
6. Click Create. The Associate XML Profile screen opens.
7. For the Associate XML Profile setting, specify whether to associate the XML profile with a URL or a parameter:

   Option	Description
   URL	Validates XML data found in requests to this URL.
   Parameter	Validates XML data in a parameter. You also select the Parameter Level: Global specifies that this is a global parameter that has no association with URLs. URL specifies that this parameter is associated with a specific URL, a protocol (HTTP or HTTPS), and a target URL path.

8. Click Next. The New Allowed URL or Add Parameter screen opens, depending on which entity you choose to associate with the XML profile.
9. Create the URL or parameter to associate with the XML profile. Your steps depend on which option you selected.

   Option	Description
   URL	Type the explicit URL or wildcard URL that represents the web application, and click Next.
   Global Parameter	Type the name of the parameter, and click Create.
   URL Parameter	Type the explicit URL or wildcard URL that represents the web application, and click Next. Type the name of the parameter, and click Create.

   The system creates the URL or parameter and displays the list of entities.

1. If you are on the Create New XML Profile screen, skip to step 2. If not, at the top of the screen, click the Create new XML profile link. You can also navigate to Security > Application Security > Content Profiles > XML Profiles and click Create. The Create New XML Profile screen opens.
2. For Profile Name, type a unique name.
3. Select the Use XML Blocking Response Page check box to send an XML response page when the security policy blocks a request that contains XML content that does not comply with this XML profile.
4. In the Validation Configuration area, for the File option of the Configuration Files setting, navigate to the WSDL document.
5. Click Upload. The screen lists the uploaded file.
6. If the imported file references another URL (and the setting is available), for Import URL, type the URL.
7. To allow SOAP messages to have attachments, select the Allow Attachments in SOAP Messages check box.
8. In the Defense Configuration area, for Defense Level, select High (the default value), Medium, or Low to specify the level of protection you want the security policy to provide for XML applications and services. The system adjusts the defense configuration settings according to your choice. You can review the settings by selecting Advanced next to Defense Configuration.
9. Click Create. In most cases, the system automatically associates a URL or parameter with the application based on the WSDL file. If the XML Profiles screen is displayed, you are done creating the profile. Otherwise, the Associate XML Profile screen opens, and you can continue with the next step.
10. For the Associate XML Profile setting, specify whether to associate the XML profile with a URL or a parameter:

    Option	Description
    URL	Validates XML data found in requests to this URL.
    Parameter	Validates XML data in a parameter. You also select the Parameter Level: Global specifies that this is a global parameter that has no association with URLs. URL specifies that this parameter is associated with a specific URL, a protocol (HTTP or HTTPS), and a target URL path.

11. Click Next. The New Allowed URL or Add Parameter screen opens, depending on which entity you choose to associate with the XML profile.
12. Create the URL or parameter to associate with the XML profile. Your steps depend on which option you selected.

    Option	Description
    URL	Type the explicit URL or wildcard URL that represents the web application, and click Next.
    Global Parameter	Type the name of the parameter, and click Create.
    URL Parameter	Type the explicit URL or wildcard URL that represents the web application, and click Next. Type the name of the parameter, and click Create.

    The system creates the URL or parameter and displays the list of entities.

1. If you are on the Create New XML Profile screen, skip to step 2. If not, at the top of the screen, click the Create new XML profile link. You can also navigate to Security > Application Security > Content Profiles > XML Profiles and click Create. The Create New XML Profile screen opens.
2. For Profile Name, type a unique name.
3. Select the Use XML Blocking Response Page check box to send an XML response page when the security policy blocks a request that contains XML content that does not comply with this XML profile.
4. In the Validation Configuration area, for the Configuration Files setting File option, navigate to the XML schema file (.xsd), then click Upload.
5. If the imported file references another URL (and the setting is available), for Import URL, type the URL.
6. To allow SOAP messages to have attachments, select the Allow Attachments in SOAP Messages check box.
7. In the Defense Configuration area, for Defense Level, select High (the default value), Medium, or Low to specify the level of protection you want the security policy to provide for XML applications and services. The system adjusts the defense configuration settings according to your choice. You can review the settings by selecting Advanced next to Defense Configuration.
8. Click Create. The Associate XML Profile screen opens.
9. For the Associate XML Profile setting, specify whether to associate the XML profile with a URL or a parameter:

   Option	Description
   URL	Validates XML data found in requests to this URL.
   Parameter	Validates XML data in a parameter. You also select the Parameter Level: Global specifies that this is a global parameter that has no association with URLs. URL specifies that this parameter is associated with a specific URL, a protocol (HTTP or HTTPS), and a target URL path.

10. Click Next. The New Allowed URL or Add Parameter screen opens, depending on which entity you choose to associate with the XML profile.
11. Create the URL or parameter to associate with the XML profile. Your steps depend on which option you selected.

    Option	Description
    URL	Type the explicit URL or wildcard URL that represents the web application, and click Next.
    Global Parameter	Type the name of the parameter, and click Create.
    URL Parameter	Type the explicit URL or wildcard URL that represents the web application, and click Next. Type the name of the parameter, and click Create.

    The system creates the URL or parameter and displays the list of entities.

1. On the Main tab, click Security > Application Security > Security Policies. The Active Policies screen opens.
2. Click the name of the security policy you want to work on. The Policy Properties screen opens.
3. Review the messages in the identification and messages area to learn about the security policy status.

   Status Message	Description
   The initial configuration of the security policy is complete. Checking to see if ASM is detecting traffic.	The Application Security Manager is parsing and analyzing received requests. Allow the system several minutes to analyze requests.
   The ASM did not detect any traffic.	Verify the networking configuration (check the VLAN, self IP address, pool, and virtual server).
   ASM detected traffic successfully. Waiting for a minimum of 10000 requests and at least one hour from running the wizard for the name security policy. The ASM detected n requests during x hours and y minutes.	Application Security Manager detected traffic and will sample requests until it processes at least 10,000 requests, and at least one hour has passed since you started the Deployment wizard.
   Processing XML violations for at least one hour for the name security policy. The ASM found n new XML violations during xx minutes and yy seconds.	After successfully detecting traffic and sampling requests, the Application Security Manager processes XML violations. Based on what it finds in the traffic sample and the violations, Application Security Manager automatically adjusts security policy settings to match the traffic and eliminate false positives. The system samples requests for at least one hour.
   The system did not detect any new XML violations over the last hour for the name security policy. You can now go to the Traffic Learning page to fine-tune the security policy.	For at least an hour, none of the traffic going to or from the application has caused XML violations. When you see this message, you can fine-tune the security policy.
   Timed out while waiting for sufficient number of requests for the security policy. Checking XML violations status.	The system processed insufficient traffic to finish building the security policy. Check to be sure that traffic can access the web application.

1. In the identification and messages area of the screen, click the Traffic Learning link.
   Tip: If you do not see the link, click Security > Application Security > Policy Building > Manual Traffic Learning.
   The Traffic Learning screen opens, and lists violations that the system has found based on real traffic.
2. In the Traffic Learning area, click each violation hyperlink, then review and handle learning suggestions:

   Option	Description
   Accept	Select a learning suggestion, click Accept, and then click Apply Policy. The system updates the security policy to allow the file type, URL, parameter, or other element.
   Clear	Select a learning suggestion, and click Clear. The system removes the learning suggestion and continues to generate suggestions for that violation.
   Cancel	Click Cancel to return to the Manual Traffic Learning screen.

   By default, a security policy is put into a staging-tightening period for seven days. During this time, you can examine learning suggestions and adjust the security policy without blocking traffic.
3. On the Manual Traffic Learning screen, review the violations and consider whether you want to permit any of them (for example, if a violation is causing false positives). Select any violations you do not want the system to trigger, and click Disable Violation. A popup screen opens, and you can verify that you want to disable the violations or cancel the action.
4. To put the security policy changes into effect immediately, click Apply Policy.

1. On the Main tab, click Security > Application Security > Blocking. The Settings screen opens.
2. In the Current edited policy list near the top of the screen, verify that the edited security policy is the one you want to work on.
3. For the Enforcement Mode setting, select Blocking.
4. For each violation, review the settings so you understand how the security policy handles requests that cause the violation, and adjust if necessary.

   Option	Description
   Learn	If selected, the system generates learning suggestions for requests that trigger the violation.
   Alarm	If selected, the system records requests that trigger the violation in the Charts screen, the system log (/var/log/asm), and possibly in local or remote logs (depending on the settings of the logging profile).
   Block	If selected (and the enforcement mode is set to Blocking), the system blocks requests that trigger the violation.

   Tip: Click the information icon preceding a violation for a description of it.
5. Click Save to save your settings.
6. On the Main tab, click Security > Application Security > Security Policies. The Active Policies screen opens.
7. Click the name of the security policy you want to work on. The Properties screen opens.
8. To change the number of days the security policy remains in staging, change the value in the Enforcement Readiness Period field. The security policy does not block traffic during the Enforcement Readiness Period even if violations occur.
9. If you want to block traffic that causes violations, you need to enforce violations. One way to do this is:
   1. Set the Enforcement Readiness Period to 0.
   2. Click Save.
   3. On the Main tab, click Security > Application Security > Policy Building > Enforcement Readiness.
   4. Click Enforce Ready.
10. To put the security policy changes into effect immediately, click Apply Policy.
11. For a quick summary of system activity, look at the Overview screen (Security > Overview > Application). The Summary screen displays statistical information about Application Security traffic.

How you proceed with configuring XML security depends on the type of application you want to protect. If the application consists simply of XML content, creating the security policy is straightforward. If your application is a SOAP web service, you have additional options for setting up the security policy.

Securing XML applications