LinkT&B Editorial Team
After deploying a WAF or DDoS protection, you still need to check that legitimate users can submit forms and log in. Measuring attack reduction separately from the business impact of false positives helps you decide which settings to improve.
In this article
- Business operations to protect and results to check
- Protecting information and the work done through a website
- What F5 XC WAAP does
- Checking which websites and APIs are protected
- Where to look when a form will not submit
- Who responds after an alert arrives?
- How to assess the results
- Reducing maintenance work and costs
- Discuss website security and ongoing operations
When a website goes down, customers cannot buy products or submit applications. Sometimes a company only notices a problem when inquiries stop arriving. Website security helps prevent data breaches, but it also supports the everyday work that depends on the site.
LinkT&B manages websites for client companies and works on the deployment and operation of F5 Distributed Cloud Web App & API Protection, referred to here as F5 XC WAAP. Before deployment, we consider what work the site supports, the impact of an outage, and who will handle day-to-day operations.
Business operations to protect and results to check
| Area | What to check | Evidence to use |
|---|---|---|
| Inquiries | Legitimate users can submit the form | Compare blocking logs with actual user actions |
| Member services | Users can log in | Distinguish authentication failures from WAF blocks |
| Ongoing operation | Incident alerts reach the responsible person | Verify detection, notification and recovery separately |
Protecting information and the work done through a website
Business websites hold personal information submitted through inquiries, account credentials, and order or reservation records. Preventing theft and unauthorized changes is essential in any industry. Altered website content can also mislead visitors or direct them to malicious sites.
Availability matters just as much. An online store loses sales opportunities while customers cannot complete purchases. Even a site used mainly to publish information can generate extra phone calls and work for staff if important notices become inaccessible. A prolonged outage can also damage users’ trust.
That does not mean every site needs the same budget or recovery time. An overnight outage has different consequences for an ordering system and a company information page. The information handled, hours of use and alternative contact channels help determine the monitoring and emergency response needed.
What F5 XC WAAP does
A web application firewall, or WAF, inspects website traffic to detect and block malicious input and other suspicious requests. Web App & API Protection, or WAAP, extends protection to APIs used to exchange data between systems, alongside the WAF.
F5 XC WAAP combines WAF, API security, bot protection and DDoS protection. Their roles are outlined below. Available features depend on the subscription and configuration. [1]
| Feature | Role | Business relevance |
|---|---|---|
| WAF | Detects and blocks malicious requests to web applications | Helps counter attacks that exploit contact forms, search pages and similar functions |
| API security | Identifies APIs and detects and controls misuse | Protects data exchanged with mobile apps and external systems |
| Bot protection | Identifies and controls automated access | Restricts abusive automation while allowing automated access needed for business |
| DDoS protection | Reduces the impact of attacks that disrupt services through traffic floods and other methods | Helps keep the website available to users during an attack |
In a distributed denial-of-service (DDoS) attack, traffic from many devices can make a website slow or unreachable. Mitigation blocks or limits traffic identified as part of the attack while allowing legitimate users through. Blocking all traffic simply because volumes are high would also turn away customers waiting for a sale or the opening of reservations.
Some automated access is necessary, such as a business partner’s system retrieving stock information. Detection results alone cannot determine which traffic should be allowed. Security staff need to work with people who understand the site’s purpose and the systems connected to it.
Checking which websites and APIs are protected
A company’s main website, reservation system and member pages may run on separate domains. Protecting one does not automatically protect the others. Start by listing publicly accessible sites and APIs, then decide which traffic should pass through F5 XC WAAP.
The F5 WAF is applied to the HTTP/HTTPS load balancer that receives traffic for the site. “Monitoring,” which records detections, also behaves differently from “Blocking,” which blocks requests. A WAF configuration visible in the console will not provide the expected blocking if it is not applied to the target site or is only recording detections. [2]
Begin the changeover with a site or function where the impact can be contained. Test ordinary actions such as browsing, logging in and submitting forms, and prepare a way to restore the previous configuration if something goes wrong. Including protection checks in the release process for new sites and APIs also helps prevent omissions.
Where to look when a form will not submit
Suppose users report that a contact form stopped working just after an update. Did the WAF mistake their input for an attack? Is there a bug in the form, or is the destination server not responding? These can look like the same submission error to a user, but each requires a different fix.
Useful clues include the time of the failure, the page used, what was entered or submitted, and recent changes. Comparing these with traffic logs narrows the investigation. The F5 XC console provides traffic and response information alongside attack detections and blocking logs. Checking application logs as well makes it easier for the teams involved to share a clear picture. [3]
If the cause is a WAF false positive, identify the form, input field and detection rule before adjusting the configuration. Disabling the WAF for the whole site in a hurry would let other attacks through as well. Change only what is necessary, then verify that the form works and check the effect on other functions.
Record why the adjustment was made. A note explaining which input on which form needed to be allowed helps the next person remove an exception when that form is retired. Handing over configuration values without their rationale forces someone else to investigate the reason for the change again.
Who responds after an alert arrives?
An alert from a monitoring service does not lead to action unless someone is assigned to receive it and arrange an investigation. Security staff may also be unable to decide on their own whether particular traffic is needed for business. Site administrators, developers and the people who change security settings need a way to work together.
When outsourcing maintenance, examine exactly which work is included. A product help desk, a service that makes requested configuration changes, and a security operations center (SOC) that continuously analyzes logs offer different levels of support. Whether investigation and recovery are included determines how much work remains with your own team.
The same applies at night and on holidays. A product running around the clock does not mean that people are contracted to investigate and restore service at all hours. Agree on emergency contacts and response hours, and assign routine tasks such as certificate renewal and destination changes to named staff.
How to assess the results
The number of attacks blocked this month is one operational indicator, but it is not enough to judge effectiveness. Repeated attacks increase the count. If the total includes legitimate requests blocked by mistake, some of that activity may actually be causing problems for users.
The following records help connect security measures to business outcomes.
| Desired outcome | Records to compare |
|---|---|
| Reliable access to the site | Downtime, response times, and success rates for key actions such as login, purchase and form submission |
| Fewer legitimate actions blocked by mistake | Inquiries caused by false positives, adjustments made, and any recurrence |
| Prevention of unauthorized access and tampering | Detection and blocking logs, application audit records, and detection results from tests |
| Faster response to problems | Time from an incident to detection, the start of investigation, and recovery |
| Less operational work | Time spent on investigation and reporting, outsourcing fees, and charges for additional work |
Before-and-after comparisons need to account for traffic volumes and website changes. On a day with no alerts, check whether monitoring data was actually collected. Treating a gap in the records as “no incidents” undermines the assessment.
WAAP addresses some attacks carried through traffic to websites and APIs. Application fixes, account management and backups still need to continue. A high blocking count does not establish that no data breach or tampering occurred.
Reducing maintenance work and costs
Collecting logs from several screens, grouping similar alerts, finding earlier responses and writing monthly reports all take time. Together, these tasks can create a substantial amount of preparation before an investigation even begins.
LinkT&B proposes using AI and automated processing for this work to reduce maintenance effort and costs. Presenting the underlying records in a form staff can review quickly gives them more time to assess the impact on users and decide what to do. Alongside the detection capabilities of F5 products, this work focuses on reducing the tasks performed by maintenance teams. Our article on AI-assisted security maintenance explains the approach in more detail.
Discuss website security and ongoing operations
We support website security, monitoring and maintenance. Tell us about your current setup and the daily tasks that are taking too much time.