WIXLIB

OverviewBusiness DriversCapabilities &Use CasesQualifying &DiscoveryCompetitionPricing andPackagingSales ResourcesF5 Advanced WAFPlaybook 2018April 2018

OverviewCapabilities &Use CasesBusiness DriversWhat is Advanced WAFQualifying &DiscoveryMarket OpportunityCompetitionPricing andPackagingWhy Sell Advanced WAFProtect against bots, credential attacks, and app-layer DoSAnti-botMobile SDKF5 Advanced WAFUserscredentialsMobileHackerBotsBot MitigationCredential ProtectionApp-Layer DoSSales ResourcesWhy Customers Buy

OverviewBusiness DriversCapabilities &Use CasesWhat is Advanced WAFQualifying &DiscoveryMarket OpportunityCompetitionPricing andPackagingWhy Sell Advanced WAFSales ResourcesWhy Customers BuyTotal Market 1,200 1,100 1,025 1,000 941 840High growth marketfueled by proliferation ofapps, APIs, and businessdigital transformation 800 600 400 200 02018201920202021

OverviewCapabilities &Use CasesBusiness DriversWhat is Advanced WAFMarket OpportunityCompetitionCyber-Espionage15%Privilege Misuse14%Miscellaneous Errors11%Point of Sale11%Everything Else2017 Verizon DataBreachInvestigations Report”Web Application Attacksremains the mostprevalent”9%Payment Card Skimmers5%Physical Theft and Loss4%Crimeware“Use of stolen credentialsagainst web applicationswas the dominant hackingtactic“2%1%0%10%20%30%40%Pricing andPackagingWhy Sell Advanced WAF29%Web App AttacksDenial of ServiceQualifying &DiscoverySales ResourcesWhy Customers Buy Protecting apps is a hardproblem to cost-efficiently solve Apps continue to be the #1source of data breaches WAF deployment is leadingpractice – your customer isgoing to buy one Addresses a C-Level riskmanagement concern

OverviewBusiness DriversCapabilities &Use CasesWhat is Advanced WAFQualifying &DiscoveryMarket OpportunityCompetitionPricing andPackagingWhy Sell Advanced WAFSales ResourcesWhy Customers BuyWeb Application Firewalls are the fastest and most cost-effective way toaddress application vulnerabilities in productionSENSITIVE DATACLOUDAPIsAPPSHalf of applicationsremain vulnerableTransformation createsoperational challengesAPIs are being exploitedand abused

OverviewBusiness DriversAddresses Top ThreatCapabilities &Use CasesQualifying &DiscoveryApp ProtectionsWeb app attacksare the #1 singlepoint of entry insuccessful databreaches Pricing andPackagingCompetitionSales ResourcesAdvanced Protections53%Web App Attacks33%User / Identity11%PhysicalOther (VPN, PoS, infra.)3%

OverviewBusiness DriversCapabilities &Use CasesAddresses Top ThreatQualifying &DiscoveryApp ProtectionsCompetitionPricing andPackagingAdvanced ProtectionsWAFs don’t requireaccess to source codeor developersFix vulnerabilitiesStop web attacksRisk & complianceSales ResourcesWAFs provide coveragefor OWASP Top 10WAFTechnologyWAFs fix vulnerabilitiespromptly withoutmaintenance windowsWAFs can be analternative to code review

OverviewBusiness DriversCapabilities &Use CasesAddresses Top ThreatTraditional WAF:Qualifying &DiscoveryApp ProtectionsCompetitionPricing andPackagingSales ResourcesAdvanced ProtectionsAdvanced WAF:OWASP Top 10OWASP Top 10Malicious BotsSSL/TLS InspectionSSL/TLS InspectionCredential AttacksScriptingScriptingAPI Attacks

OverviewDifferentiationBusiness DriversCapabilities &Use CasesBot MitigationQualifying &DiscoveryCredential ProtectionCompetitionApplication DoSPricing andPackagingAPI SecuritySales ResourcesOWASP Top 10F5 is uniquely positionedApplication Protection Advanced WAF Mitigate bots for web and mobile apps Prevent credential theft and abuse Defend against application DoSThis graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available upon request from F5 Networks. Gartner does not endorse any vendor,product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's researchorganization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

OverviewDifferentiationBusiness DriversCapabilities &Use CasesBot MitigationQualifying &DiscoveryApplication DoSCredential ProtectionMalicious BotsCompetitionAnti-BotMobile SDKPricing andPackagingAPI SecuritySales ResourcesOWASP Top 10F5 Advanced WAFWebProactive Bot DefenseMobileAutomated attacks are increasing infrequency and sophisticationHackerBots77% of web attacks are from botsMobile apps are a growing targetAdvanced WAF mitigate bots for web and mobile apps Proactive Bot Defense blocks web bots automatically F5 Anti-Bot Mobile SDK only allows trusted mobile users

OverviewDifferentiationBusiness DriversCapabilities &Use CasesBot MitigationQualifying &DiscoveryCredential ProtectionCompetitionApplication DoSPricing andPackagingAPI SecuritySales ResourcesOWASP Top 10Credential AttacksHackers target credentials andsensitive data3 billion credentials reportedstolen in 2016The victim is infectedwith malwareAdvanced WAF prevent credential theft and abuse DataSafe encrypts and obfuscates sensitive data Brute Force Mitigation prevents credential stuffing

OverviewDifferentiationBusiness DriversCapabilities &Use CasesBot MitigationQualifying &DiscoveryCredential ProtectionCompetitionApplication DoSPricing andPackagingAPI SecuritySales ResourcesOWASP Top 10Application Denialof Service (DoS)Application layer DoS evadesstatic security solutionsApplication layer DoS hasincreased by 43%Advanced WAF defend against application DoS Automated baseline and stress monitoring Behavioral analytics and machine learning

OverviewDifferentiationBusiness DriversCapabilities &Use CasesBot MitigationQualifying &DiscoveryCredential ProtectionCompetitionApplication DoSPricing andPackagingAPI SecuritySales ResourcesOWASP Top 10API SecurityModern applicationarchitectures leverageApplication ProgrammingInterfaces (APIs)Advanced WAF protects APIs:Unprotected APIs are beingexploited Rest API, JSON, SOAP, AJAX, XML, WSDL parsing Brute Force mitigation, attack signatures, L7 DoS

OverviewDifferentiationBusiness DriversCapabilities &Use CasesBot MitigationQualifying &DiscoveryCredential ProtectionCompetitionApplication DoSPricing andPackagingAPI SecuritySales ResourcesOWASP Top 10OWASP Top 10A broad consensus on themost critical web applicationsecurity flawsAdvanced WAF protects from the OWASP Top 10: Mitigations for all well known persistent attacks Beyond OWASP: bots, credential theft, application DoS

OverviewBusiness DriversCapabilities &Use CasesQualifiersQualifying &DiscoveryKey StakeholdersQualifiers New application initiatives-Net new application deployments with budgetMoving existing apps to cloud environmentsBusiness digital transformation projectsBuilding new application APIs Compelling events- Data breach- Out of compliance / fines- Failed audit Has competitive product- Using Imperva, Barracuda, or other basicWAFCompetitionPricing andPackagingDiscussion QuestionsSales ResourcesObjection HandlingDisqualifiers Few or limited applications- No apps or apps are not a part of the businessmodel- Low risk exposure for applications- No application APIs No compelling event or initiative- No pain- No budget AND no painCheck back in 3-6 months, things may have changed

OverviewBusiness DriversCapabilities &Use CasesQualifiersStakeholderCIO/CISO (or representative)Focus on business capacity and asset controlLOB/App OwnerFocus on speed to market/implementationQualifying &DiscoveryKey Stakeholders YesCompetitionPricing andPackagingDiscussion QuestionsSales ResourcesObjection HandlingTop ConcernsKeeping pace with business - Become an enabler of business and not an the bottle neckReducing business risk – Identification and implementation of risk mitigating controlsYesBusiness success - Leverage IT tools for business objectives, not deeply concerned with details ofdeployment, just want to get it done. Don’t want to know the sausage ingredients, just want the finishedproductNoHappy users / Operational success - Application availability, business as usualIT Ops/Director (Ops)Focus on availability, uptime, and resourceallocationCompliance OfficerFocus on privacy and regulatory complianceNoDirector Risk ManagementFocus on implementation & awareness of riskmanagementNoDeveloping process - Implement technology and practices compliant with best practicesConsulting lines of business – provide education and training for risk management policyIdentify Risk Gaps – in business process and projects, escalate and work to resolutionImproving decision making - Technology strategy for enterprise operations.Enterprise / Security ArchitectFocus on infrastructure, costs, and bestpracticesKeeping up to date – Regulatory & compliance laws: PCI-DSS, data protection.NoLeading adoption - The identification, analysis, evaluation, and life-cycle management securitytechnologies

OverviewBusiness DriversQualifiersCapabilities &Use CasesQualifying &DiscoveryKey StakeholdersQuestions to AskCompetitionPricing andPackagingDiscussion QuestionsSales ResourcesObjection HandlingFollow-up QuestionsHow many web/mobile business apps do youhost?Do you have the SecOps capacity to manage all ofyour application security policies?What are you doing to protect apps fromattacks?What is the business impact of a an app outage orbreach? What about an app data breach?How do you create and manage app securitypolicies?Are they efficient? How do you know?How do you safeguard sensitive user data inuse by your applications?What is the business impact of an app data breach?If you could encrypt this data without impact to theapp or client, would you do it?What percentage of your app traffic is frombots? Do you have a solution in place to blockmalicious bot traffic?Would blocking bot traffic make your apps moreefficient? Reduce costs? How do you stop botbased fraud?

OverviewBusiness DriversCapabilities &Use CasesQualifiersQualifying &DiscoveryKey StakeholdersCompetitionPricing andPackagingDiscussion QuestionsSales ResourcesObjection HandlingI already have a WAF, why should I care about F5 Advanced WAF?Our customer have found that the Advanced WAF helps optimize efficiency and operationalcosts by using behavioral analytics to automatically generate and deploy optimal securitypolicies. The added advanced features – for bot mitigation, credential protection, and dataencryption have also been compelling drivers for our customers.I’ll just use the AWS WAFI understand, basic WAFs are easy to use. However these only provide simple protections. WithAWS you pay per rule and request. If you want to keep it simple, consider F5 managed rules forAWS WAF our managed service, Silverline. These provide simplicity and offer advancedprotections created by F5 pros.

OverviewBusiness DriversCapabilities &Use CasesMarket AdvantagesKey F5 AdvantagesQualifying &DiscoveryCompetitionPricing andPackagingSales ResourcesImpervaBot Protection beyond signatures and reputation Web and mobile application protection Client fingerprinting Server performance monitoringAccount Takeover that stops credential theft and abuse Bot Protection Account Takeover Application DoS Application Layer Encryption Obfuscation and evasion detection Comprehensive Brute Force mitigation including credential stuffingApplication DoS that adapts to changing apps Real-time application baselines Behavioral Denial of Service with machine learning Dynamic signatures with low false positives