F5 API Security - Local Edition

Key Concepts

• F5 API Security Local Edition: A self-hosted API security solution designed for environments where cloud-based security is restricted.
• BIG-IP: F5’s application delivery controller used as the primary discovery and enforcement point.
• Shadow APIs: Undocumented or unauthorized APIs that exist within a network without oversight.
• Zombie APIs: Deprecated or forgotten APIs that remain active and pose a security risk.
• OAS (OpenAPI Specification): Standardized documentation files used to define API structures and populate inventory.
• Data Sovereignty: Legal requirements (e.g., GDPR) mandating that data remains within specific geographic or network boundaries.
• Air-gapped Networks: Secure networks physically isolated from the public internet.

---

1. Overview and Use Cases

F5 API Security Local Edition is designed for organizations that cannot utilize F5 Distributed Cloud due to specific operational or regulatory constraints. It is specifically engineered for:

• Regulated Industries: Environments subject to HIPAA, PCI, or FedRAMP compliance.
• Data Sovereignty: Compliance with regulations like GDPR where data must remain local.
• Restricted Environments: Air-gapped networks or hybrid/multi-cloud architectures requiring security to reside locally with the workload.

2. Deployment and Configuration Methodology

The platform operates as a closed-loop system where the control loop resides entirely within the user's network, eliminating external dependencies.

• Connecting BIG-IP: The BIG-IP acts as the traffic sensor. Configuration is performed via GUI, TMSH (TMOS Shell), or iControl APIs.
• Onboarding: Users provide the management IP, organization details, and user credentials. Once onboarded, the system reads traffic for discovery and pushes security policies back to the BIG-IP for enforcement.
• Domain Organization: Traffic is organized into "domains," which can be managed (enabled/disabled/deleted) individually.

3. API Discovery and Inventory Management

The platform populates its inventory through a combination of documentation ingestion and real-time traffic analysis.

• Documentation Ingestion: Users upload OAS files to the API endpoint dashboard. The system processes these to create an initial inventory, including risk scores, authentication status, and sensitive data flagging.
• Base Dashboard: Provides an aggregated view of the entire API surface, including metrics on shadow/zombie APIs, sensitive data exposure, and overall risk scores.
• Analysis Process: The "Analyze" function triggers a deep scan of traffic telemetry to update the inventory and risk scores based on real-world usage.

4. Security Enforcement and Incident Response

The platform allows for immediate remediation of discovered threats, such as shadow APIs.

• Detection: Using tools like Burp Suite, the video demonstrates how the platform identifies unauthorized traffic (shadow APIs) that deviates from the known inventory.
• Blocking Mechanism: Upon identifying a threat, the user can select "Block" from the action menu.
• Policy Push: The platform communicates directly with the BIG-IP to update the security policy. The user can review the specific virtual server and policy changes before final approval.
• Verification: Changes are reflected in the BIG-IP configuration (e.g., the "Blocked URLs" list), allowing for manual review or unblocking if the endpoint is deemed legitimate.

5. Monitoring and Reporting

The platform provides granular visibility into API health and risk:

• Request Timeline: Visualizes traffic volume over time.
• Most Active APIs: Identifies high-traffic endpoints.
• Top Sensitive Data: Tracks the flow of credentials and PII (Personally Identifiable Information).
• Response Code Distribution: Offers a quick health check of the API environment.
• Risk Breakdown: Clicking on a risk score reveals the specific factors contributing to that score, allowing for targeted remediation.
• Exporting: Inventory data can be exported in various formats, including Swagger files, for external auditing or documentation.

Synthesis

F5 API Security Local Edition provides a robust, localized framework for organizations to discover, monitor, and secure their API landscape without relying on external cloud services. By leveraging existing BIG-IP infrastructure, it enables seamless integration into highly regulated or air-gapped environments. The platform’s ability to automatically detect shadow APIs and push enforcement policies directly to the edge makes it a critical tool for reducing the attack surface in complex, hybrid, or multi-cloud architectures.