Security Parameters: Need to be apply to make secure solutions

Hi,

 

1. Which cookie does not contain the "secure" attribute? Your BIG-IP persistence cookie? If so you should enable it on the cookie persistence profile. If it is the application cookie you should rewrite that cookie (with an irule) to insert the "secure" attribute.
2. Is this for the webserver or for your BIG-IP persistence cookie? (if it is your BIG-IP persistence cookie, enable encryption on the cookie (I think you should alway's encrypt your BIG-IP persistence cookie))
3. Enable HTTP Strict transport security on your BIG-IP HTTP Profile (or is there another header your security team want's to insert?)
4. Did you enable the directory listing attack signatures in your ASM policy?

Cheers,

 

Kees

 

Hi,

 

Cookie encryption is disabled in the screenshot......

 

Is it the application cookie that shows the session ID? If so, you have to encrypt it by enabling cookie encryption in the HTTP profile.

 

Look at the bottom section of your HTTP profile. There you can find HTTP STS (Strict transport security)

 

When you go to Security > Application Security > Attack Signatures. Go to advanced filtering and type directory in the string search field and click go.

 

At the bottom of the page you will find the assigned attack signatures for directory listing mitigation.

 

Cheers,

 

Kees