Training and CyberInsights Today

F5 ASM

17 lessons · Beginner to advanced

Policies, staging, learning, signatures, tuning, API security, logs and recovery.

F5 ASM training →

FortiWeb

17 lessons · Beginner to advanced

Server policies, profiles, ML, signatures, APIs, troubleshooting and HA.

FortiWeb training →

How to use the WAF training hub

CyberInsights Today

Daily cybersecurity analysis and practical bulletins

Understand recent vulnerabilities, threats, their impact and mitigation. When there is no worthwhile new issue, learn a security concept or defensive practice through clear explanations, illustrations and evidence.

Read CyberInsights Today →

FortiWeb Lesson 14: Login Security, CSRF, Bot Mitigation and DoS

FORTIWEB CLASSROOM • LESSON 14

Level: Advanced · Study and lab: 90 minutes
Instructor: Harpreet Singh Virdi, CISSP, CCSP

FortiWeb course guide · FortiWeb training block

Different abuse patterns need different controls

A well-formed request can still contribute to abuse. Repeated login guesses, unwanted automation, forged browser actions, and resource exhaustion are separate problems. Start by defining the threat and the legitimate clients before choosing a response.

Login and session context

Document how the application reports successful and unsuccessful authentication. Some applications return the same status code for both. Tracking can help correlate activity, but an IP address or client-supplied field is not automatically a reliable user identity.

CSRF concerns unwanted authenticated browser actions. Coordinate the application's token, cookie, and origin defenses with supported FortiWeb CSRF protection. Browser-oriented features may depend on page processing or cookies and must be tested with cross-domain flows, mobile clients, and APIs.

Bot mitigation

Automation is not inherently malicious. Search indexing, health checks, and approved integrations have business value. Classify client populations and inspect the relevant bot policy. A browser challenge can disrupt an API client that cannot execute JavaScript.

Use narrowly justified exception policies and verify their semantics. A bot exception that skips checks is a security change, not merely a cosmetic classification.

Availability and DoS

Request volume is only one signal. A small number of expensive searches may stress the backend more than many cached images. Observe response time, failures, endpoint cost, and origin health. Avoid universal thresholds copied from another application.

Guided bounded lab

  1. Inventory a browser, approved API client, monitor, and controlled automation client.
  2. Record a low-volume baseline and the application's expected login outcomes.
  3. Configure only the supported observation protections being evaluated.
  4. Use synthetic accounts and a small agreed set of failed logins; avoid accidental lockout.
  5. Compare browser and API behavior when testing supported challenges.
  6. Generate only bounded traffic within your lab capacity ceiling. Do not flood the environment.
  7. Correlate detections with latency, origin health, and client behavior.
  8. If testing mitigation, verify recovery and the continued operation of approved clients.

Expected result: you can explain each detection and its scope. A small lab may not activate adaptive protections; state that limitation rather than treating no alert as proof of a defect.

Knowledge check

Why is blocking a shared source address risky?

Instructor answer

Several users may share an address through NAT or a proxy. A source-based response can affect innocent users. Validate trusted client-IP handling and the selected tracking scope.

Official reading

Independent training, not affiliated with Fortinet. Examples use an authorized isolated lab with synthetic data. The lab steps and expected outcomes have not been executed on a FortiWeb appliance for this publication. Firmware, platform, operating mode, licensing, and subscriptions affect behavior; follow the documentation for your exact build. References use 8.0.x examples and do not constitute an upgrade recommendation.

← Previous FortiWeb lesson · FortiWeb course guide · Next FortiWeb lesson →

Comments

Post a Comment

Popular posts from this blog

PHP2Shell Explained: Impact, Patches and Mitigation for CVE-2026-109618 and CVE-2026-109619

By Harpreet Singh Virdi, CISSP, CCSP · Cybersecurity Updates Published and evidence checked: November 3, 2026. If you run PHP, start with an inventory and a patch decision today. If a security appliance uses PHP internally, check its vendor advisory too. Updating your website code alone does not update the runtime inside a firewall. PHP2Shell is the name used for CVE-2026-109618 and CVE-2026-109619. They can allow remote code execution without authentication. PHP released security updates on October 21. The PHP team identifies web-serving installations as at risk and highlights Apache mod_php as the highest-risk configuration. PHP security announcements .
Read more

Start Here: F5 ASM Classroom — From Beginner to Advanced

WELCOME TO YOUR ONLINE CLASSROOM Learn F5 ASM, one clear lesson at a time. A practical English-language course for beginners, progressing to advanced policy operations. Instructor: Harpreet Singh Virdi, CISSP, CCSP Start here — you do not need prior ASM experience If the words “security policy,” “staging,” and “learning suggestion” feel unfamiliar, you are in the right place. We will explain them carefully, follow a web request through BIG-IP, and build a policy around a fictional online bookshop. F5 ASM means BIG-IP Application Security Manager. It inspects application traffic against configured security checks. The course explains how to use those checks, investigate their results, and protect legitimate user journeys. Advanced WAF terminology also appears; feature availability depends on your release and license. How to take this course Read the lessons in numerical order. Each is a separate blog post. Learn the terms, then work through the example before changing settings. Use an ...
Read more

Lesson 01: What Is F5 ASM? Your First Web Application Firewall Class

F5 ASM CLASSROOM • LESSON 01 Level: Beginner  |  Suggested study and lab time: 30 minutes Instructor: Harpreet Singh Virdi, CISSP, CCSP Start Here / Course Guide · All lessons Welcome to class Imagine running an online bookshop. Your website must accept searches, logins, and orders from people you have never met. The same public entrance also receives malformed requests and attempts to exploit software weaknesses. How do you distinguish a normal search from a suspicious request? A web application firewall (WAF) examines web traffic using rules about the application and patterns associated with attacks. F5 BIG-IP Application Security Manager, usually called ASM , is a WAF capability on the BIG-IP platform. Our task is to understand the traffic, define appropriate checks, investigate the results, and enforce protection without unnecessarily disrupting legitimate users. What you will learn Explain the purpose of a WAF in your own words. Identify where ASM fits in a web reque...
Read more