When you configure TLS cipher suites, you have a lot to choose from.  But, what should you look for when choosing these cipher suites?  And, what should you stay away from... Read more

When a web client (Internet browser) connects to a secure website, the data is encrypted. But, how does all that happen? And, what type of encryption is used? Read more

The F5 SSL Orchestrator (SSLO) provides a powerful solution to the problem of TLS encryption visibility. Most of the traffic on the Internet today is encrypted, so organizations have to figure out how to reliably inspect that encrypted traffic... Read more

Internet traffic today is encrypted at a rate of almost 90%. While encryption is a great benefit to securing web traffic, it also presents a problem for inspecting that traffic... Read more

In the world of secure websites, it's critical to maintain proper ownership of the certificate that helps protect your site. As it turns out, one person can legitimately hold a valid certificate for a website that someone else owns... Read more

Many critical emergency services manage fleets with vulnerable cellular IoT devices. “Vulnerable” doesn’t mean a vulnerability within the hardware or software. It can also mean being susceptible to remote attacks because of weak access control... Read more

The Diffie-Hellman key exchange is used extensively in Internet communications today.  With the approval of the new TLS 1.3 protocol and the need for Perfect Forward Secrecy... Read more

F5 DataSafe protects data and credentials entered into sensitive fields in your web application by encrypting data at the application layer on the client side... Read more

The newest version of the TLS protocol was recently approved by the Internet Engineering Task Force -- TLS 1.3. There are several key changes in this protocol... Read more

The F5 Advanced Web Application Firewall (WAF) provides a powerful set of security features that will keep your Web Applications safe from attack... Read more

The OWASP Top 10 is a list of the most common security risks on the Internet today.  The #10 risk in the latest edition is "Insufficient Logging and Monitoring".  Logging and monitoring are sometimes viewed as not the most interesting topics, but... Read more

The OWASP Top 10 is a list of the most common security risks on the Internet today.  The #9 risk is "Using Components With Known Vulnerabilities".  It may seem obvious that you wouldn't want to use components that have known vulnerabilities... Read more

The OWASP Top 10 is a list of the most common security risks on the Internet today.  Insecure Deserialization comes in at the #8 spot in the latest edition... Read more

The OWASP Top 10 is a list of the most common security risks on the Internet today.  Cross Site Scripting (XSS) comes in at the #7 spot in the latest edition of the OWASP Top 10... Read more

The OWASP Top 10 is a list of the most common security risks on the Internet today.  Security Misconfiguration comes in at the #6 spot in the latest edition of the OWASP Top 10... Read more

The OWASP Top 10 is a list of the most common security risks on the Internet today. Broken Access Control comes in at the #5 spot in the latest edition of the OWASP Top 10. John discusses this security risk... Read more

The OWASP Top 10 is a list of the most common security risks on the Internet today.  XML External Entities comes in at the #4 spot in the latest edition of the OWASP Top 10... Read more

The OWASP Top 10 is a list of the most common security risks on the Internet today.  Sensitive Data Exposure comes in at the #3 spot in the latest edition of the OWASP Top 10. Read more

The OWASP Top 10 is a list of the most common security risks on the Internet today.  Broken Authentication comes in at the #2 spot in the latest edition of the OWASP Top 10. Read more

The OWASP Top 10 is a list of the most common security risks on the Internet today.  For the past several years, "Injection Attack" has been the #1 security risk on the Top 10 list. Read more

Now that the majority of web traffic is encrypted with Forward Secret ciphers, how do you monitor your incoming web traffic for threats? Join guest host David Holmes again this week for another Lightboard Lesson on the ultimate SSL visibility... Read more

Join DevCentral guest host David Holmes as he details the ultimate passive inspection architecture in this latest episode of Lightboard Lessons! Read more

In this Lightboard Lesson, I describe how F5 Silverline Cloud-based Platform can help mitigate DDoS and other application attacks both on-prem and in the cloud with the Hybrid Signaling iApp. Learn how both on-premises and the cloud can work... Read more

In this episode of Lightboard Lessons, Jason updates an earlier Whiteboard Wednesday with a slight change in flow introduced in TMOS version 12.1. Some of the features in this flow are only applicable if you have hardware or if you have security... Read more

Server Name Indication (SNI) is an extension to the TLS protocol that allows the client to include the requested hostname in the first message of the SSL handshake (Client Hello). Prior to the introduction of SNI, the client could not easily establish secure connections to multiple servers hosted on a single IP address. Read more