Forum Discussion

John_Meggers's avatar
John_Meggers
Icon for Nimbostratus rankNimbostratus
Oct 03, 2012

ASM Best Practice for Major Web Site Updates

We are planning an ASM deployment, and we expect one of the web servers will have periodic significant upgrades. We are trying to determine what our approach will be when that happens. We're assuming in the mean time the policies will be converted into enforcement mode with signature staging enabled. I've been searching but haven't found a clear recommendation on this.

 

Should we re-enable Policy Builder prior to the update so that it starts learning any new file types, URLs, etc. that the policy hadn't seen before, and then disable PB once there's been enough traffic to validate those new elements? I don't really think we want to move the policy back to Transparent Mode because then we won't be blocking anything.

 

Thanks for any assistance.

 

 

APM
app sec
security

2 Replies

Sort By
  • mister_paul_717's avatar
    mister_paul_717
    Icon for Nimbostratus rankNimbostratus
    Oct 03, 2012
    I recommend having ASM in your test environment. Perform the upgrade in the test environment and test heavily. In that environment, you probably won't have malicious traffic (unless you throw a tool or a pen tester at it), but if you fully exercise the functionality, especially the new functionality, you should be able to determine what needs to change.

     

     

    Paul
  • john_m_34866's avatar
    john_m_34866
    Icon for Nimbostratus rankNimbostratus
    Oct 30, 2012
    How do you migrate wherever you have learned in the test into production environment ? Do you merge the the two policies in production, if so what are the risks?

     

     

    Thanks.