The lab summarizes how F5 Distributed Cloud can discover, inventory, and secure critical APIs, helping you defend your known endpoints and bring the rogue Shadow APIs into the light. The connected world runs on APIs. Your banking app uses them, your ride share app uses them, even that weather app you check before walking out the door, it gets that data from an API. We interact with them multiple times throughout our daily life, to do everything from the most essential to the most mundane. They are simply everywhere and more and more are being published every day. As you would expect, this proliferation of APIs has marked them as a prime target for malicious actors. In the last couple years there have been quite a few well publicized attacks. From social media to fitness firms, no industry seems to be safe. With recent reports indicating that API vulnerabilities are costing businesses billions of dollars annually, it's no wonder they are at the top of mind of many cyber security professionals.

Several of the fundamental principles of F5 Distributed Cloud (XC) are highlighted in this lab environment. You will be simulating a customer during the lab who needs to verify the safety of an application. The objective is to verify the applications safety of on-premises or application on cloud before and after enabling F5 Distributed Cloud Console WAAP Capabilities by sending attacks to the application.

The purpose of this lab is to demo how NGINX Controller API Management Module and NGINX App Protect can secure the OAuth Authorization Code flow, which is core to Open Banking specifications. The NGINX App Protect will be deployed as an Ingress Controller for Kubernetes and will provide both negative and positive security by ingesting the OpenAPI declaration file. The NGINX API Gateway will be controlled by NGINX Controller, will publish the application API based on the same OpenAPI declaration file, will provide JWT authentication and authorization and enforce rate limiting. The deployment and configuration of these elements will be performed automatically through a CI/CD pipeline. ELK dashboards will be used for visualization purposes and, lastly, a DAST tool will also be run as part of the CI/CD pipeline. BIG-IP APM is deployed as both Authorization Server with OpenID Connect support and as OAuth Client, in separate instances.

Systems are at higher risk without a concerted, repeatable application security configuration process. In this lab, you will learn how to build a declarative AWAF policy and achieve OWASP Top Ten (2021) compliance with the BIG-IP OWASP Compliance Dashboard. A complete CI/CD pipeline is used to deploy our AWAF policy to the BIG-IP system using Application Services 3 Extension (AS3) and Ansible.