An Attack signature set is a group of attack signatures. Rather than applying
individual attack signatures to a security policy, you can apply one or more attack signature
sets. The Application Security Manager™ ships with several system-supplied
signature sets.
Each security policy has its own attack signature set assignments. By default, a generic
signature set is assigned to new security policies. You can assign additional signature sets
to the security policy. Sets are named logically so you can tell which ones to choose.
Additionally, you can combine custom attack signatures with system-supplied signatures or
system-supplied sets to create custom signature sets.
An ideal security policy includes only the attack signature sets needed to defend the
application. If too many are included, you waste resources on keeping up with signatures that
you do not need. On the other hand, if you do not include enough, you might let an attack
compromise your application without knowing it. If you are in doubt about a certain signature
set, it is a good idea to include it in the policy rather than to omit it.
In BIG-IQ® Web Application Security, you can obtain system-supplied or
custom attack signature sets through the device discovery process. You can assign these sets
to security policies. Then, you can deploy those policies to BIG-IP®
devices.
Creating custom attack signature sets
You can use the BIG-IQ
® Web Application Security Signature
Policy Editor to create custom attack signature sets. Like system-supplied signature
sets,
custom signature sets contain signatures from the signature pool.
Once you create a custom signature set, you can apply it to the security policy to
protect web applications against known attacks.
You can assign system-supplied or
custom signature sets to new or existing application security policies.
You can create attack signature sets:
- By using a filter.
- By manually selecting the signatures to include.
Currently, BIG-IQ Web Application Security supports creating filter-based
signature sets only. Filter-based signature sets are based solely on criteria you
define in the signatures filter presented in the screen.
-
Log in with Administrator, Security Manager, or Web App Security Manager
credentials.
-
Navigate to the Policy Editor screen: click .
-
Click Signature Sets.
The default, system-supplied signature sets are displayed on the
Signature Sets screen, along with any user-defined sets. By default, the system
lists signature sets in alphabetical order by name.
-
Click Add and use the Signature Sets - New Item screen
to supply the required information.
-
On the Properties tab, specify the basics for this new signature set:
-
Type a unique name for the signature set.
-
From the Type list, select Filter
Based to create an attack signature set by using a
filter only. (Currently, this is the only available option.)
You can create or edit a signature set by configuring a filter to
select from the signature pool signatures that meet specific criteria.
Using a filter enables you to focus on the criteria that define the
signatures you are interested in. Another when you update the signatures
database, the system also updates any signature sets affected by the
update.
-
For Default Blocking Actions, select the
blocking actions you want the system to enforce for the set when you
associate it with a new security policy.
The Learn, Alarm, and
Block actions take effect only when you
assign this set to a new security policy. If this set is already
assigned to an existing security policy, these settings have no effect.
-
If you want the system to automatically include this set in any
newly-created security policies, enable the Assign to Policy
by Default setting.
-
Click the Signatures Filter tab, and select the filter options to narrow the
scope of the signatures to include in the new signature set:
-
Select a Signature Type to include the type of
signatures the system displays.
-
All traffic is the default.
-
Request only. Signatures that are
configured to inspect the client request.
-
Response only. Signatures that are
configured to inspect the server response.
-
From the Attack Type list, specify the threat
classifications for which to include signatures in the set.
- Select All for signatures with all Attack
Type values, which is the default.
- Select an attack type for signatures configured to protect
against that specific attack type.
-
Use the Move button to transfer selected Systems
to the Enabled list.
-
From the Accuracy list, select the accuracy
association.
-
All specifies signatures that match all
accuracy levels, which is the default.
-
Equals specifies signatures whose
accuracy levels exactly match the accuracy level you set.
-
Greater Than/Equal To specifies
signatures whose accuracy levels are more precise than, or the
same as, the accuracy level you set.
-
Less Than/Equal To specifies signatures
whose accuracy levels are less precise than, or the same as, the
accuracy level you set.
-
From the resulting list, select the accuracy level.
-
Low indicates a high likelihood of false
positives.
-
Medium indicates some likelihood of false
positives.
-
High indicates a low likelihood of false
positives.
-
From the Risk list, select the risk
association.
-
All specifies signatures that protect
against attacks of all risk levels, which is the default.
-
Equals specifies signatures whose risk
levels exactly match the risk level you set.
-
Greater Than/Equal To specifies
signatures whose risk levels are higher than, or the same as,
the risk level you set.
-
Less Than/Equal To specifies signatures
whose risk levels are lower than, or the same as, the risk level
you set.
-
From the resulting list, select the risk level; the level of potential
damage for attacks protected by the signatures in the set.
-
Low indicates the attack may assist the
user in gathering knowledge to perpetrate further attacks, but
does not cause direct damage or reveal highly sensitive
data.
-
Medium indicates the attack may reveal
sensitive data, or cause moderate damage.
-
High indicates the attack may cause a
full system compromise, denial of service, and the like.
-
For User-defined, specify whether to include
signatures based on who created them: the user
(Yes), the system
(No), or both (All).
-
For Update Date, specify whether to include all
signatures in the set based on the date the signature was changed
(All), only signatures added before the date
the signature was changed (Before), or only
signatures added after the signature was changed
(After).
If specifying Before or
After, use the calendar icon to specify a
date.
-
Click the Signatures tab.
Because filter-based signature sets are currently the only option, the
Signatures tab displays the signatures included in the signature set, based on
the filter settings you configure.
-
In the Included Policies tab, view the policies (if any) that enforce this
signature set.
Each security policy enforces one or more signature sets. The decision about
which signature sets to include occurs when creating a security policy. You can
assign additional signature sets to the security policy.
-
When you are finished, click Save to save the new custom
attack signature set.
Clicking Save and Close prompts the system to return to
the Signature Sets screen and display the new set.
Sets are listed in alphabetical order; custom sets appear in blue.
The new signature set is added to the list of signature sets that are available on
the system, and is available to be applied when creating new security policies. If, in
the future, you no longer need a custom signature set, you can delete it. Note that when
you delete a custom signature set, you are deleting the set; you are not deleting the
signatures that made up the set.
Editing custom attack signature sets
You can use the BIG-IQ® Web Application Security Signature
Policy Editor to edit custom attack signature sets. Once you edit a custom signature
set, you can apply it to the security policy to protect your web applications in ways
that are unique to your needs.
-
Log in with Administrator, Security Manager, or Web App Security Manager
credentials.
-
Navigate to the Policy Editor screen: click .
-
On the left, click Signature Sets.
The system displays the default, system-supplied signature sets, along
with any user-defined sets. By default, the system lists signature sets in
alphabetical order by name.
-
Click the name of the signature set that you want to change and use the
Signature Sets screen to modify the settings.
-
On the Properties tab, revise the settings for this custom attack signature
set, as needed:
-
Note that Name and
Category are not editable fields, and that
the only option in the Type list is
Filter Based.
-
For Default Blocking Actions, select or modify
the blocking actions you want the system to enforce for the set when you
associate it with a new security policy.
The blocking actions take effect only when you assign this set to a
new security policy. If this set is already assigned to an existing
security policy, these settings have no effect.
-
For Assign to Policy by Default, if you want the
system to automatically include this set in any newly-created security
policies, select Yes from the list.
-
Click the Signatures Filter tab, and select the filter options to narrow the
scope of the signatures to include in the new signature set.
-
Select a Signature Type to include the type of
signatures the system displays.
-
All traffic is the default.
-
Requests only. Include signatures that
are configured to inspect the client request.
-
Responses only. Include signatures that
are configured to inspect the server response.
-
From the Attack Type list, specify the threat
classifications for which to include signatures in the set.
- Select All for signatures with all Attack
Type values, which is the default.
- Select an attack type for signatures configured to protect
against that specific attack type.
-
Select the Systems that you want protected from
the Available list, and use the Move button to
transfer them to the Enabled list. You can also
double-click to move a system from one list to the other.
-
From the Accuracy list, select the accuracy
association.
-
All specifies signatures that match all
accuracy levels, which is the default.
-
Equals specifies signatures whose
accuracy levels exactly match the accuracy level you set.
-
Greater Than/Equal To specifies
signatures whose accuracy levels are more precise than, or the
same as, the accuracy level you set.
-
Less Than/Equal To specifies signatures
whose accuracy levels are less precise than, or the same as, the
accuracy level you set.
-
From the resulting list, select the accuracy level.
-
Low indicates a high likelihood of false
positives.
-
Medium indicates some likelihood of false
positives.
-
High indicates a low likelihood of false
positives.
-
From theRisk list, select the risk
association.
-
All specifies signatures that protect
against attacks of all risk levels, which is the default.
-
Equals specifies signatures whose risk
levels exactly match the risk level you set.
-
Greater Than/Equal To specifies
signatures whose risk levels are higher than, or the same as,
the risk level you set.
-
Less Than/Equal To specifies signatures
whose risk levels are lower than, or the same as, the risk level
you set.
-
From the resulting list, select the risk level; the level of potential
damage for attacks protected by the signatures in the set.
-
Low indicates the attack may assist the
user in gathering knowledge to perpetrate further attacks, but
does not cause direct damage or reveal highly sensitive
data.
-
Medium indicates the attack may reveal
sensitive data, or cause moderate damage.
-
High indicates the attack may cause a
full system compromise, denial of service, and the like.
-
For User-defined, specify whether to include
signatures based on who created them: the user
(Yes), the system
(No), or both (All).
-
For Update Date, specify whether to include all
signatures in the set based on the date the signature was changed
(All), only signatures added before the date
the signature was changed (Before), or only
signatures added after the signature was changed
(After).
If specifying Before or
After, use the calendar icon to specify a
date.
-
Click the Signatures tab.
Because filter-based signature sets are currently the only option, the
Signatures tab displays the signatures included in the signature set, based on
the filter settings you configured.
-
Click the Included Policies tab, and view the policies (if any) that enforce
this signature set.
Each security policy enforces one or more signature sets. The decision about
which signature sets to include occurs when creating a security policy. You can
assign additional signature sets to the security policy.
-
When you are finished, click Save to save the new custom
attack signature set.
Clicking Save and Close prompts the system to return to
the Signature Sets screen and display the new set.
The system lists sets in alphabetical order.
The edited signature set is available for application when creating new security
policies. If, in the future, you no longer need a custom signature set, you can delete
it. Note that when you delete a custom signature set, you are deleting the set; you are
not deleting the signatures that made up the set.