What is Runtime Application Self-Protection (RASP) Security in AppSec?

What is Runtime Application Self-Protection (RASP) Application Security? – Overview

Building security into applications, as they execute, is what makes Runtime Application Self-Protection RASP security approach is a welcome choice beyond perimeter-based technology defense.

RASP-protected application’s “self-protection” tool is the only appsec technology which doesn’t disturb an application design but guards an application living ‘inside’ the application.

With the popularity of dynamic and agile languages like Python, node.JS and Java, application developers have been mastering the principles of DevOps of collaboration and software development lifecycle (SDLC). With rapid and shorten development cycles, we need to secure production at runtime.

Tagged as the new way forward, Runtime Application Self-Protection RASP software tools works to defend and protect mobile and web applications themselves from attacks. RASP application security monitors running applications and detects real-time application attacks.

The new way forward, RASP security is an abbreviated form of Runtime Application Self-Protection – a security category – introduced by Gartner in 2012, which could control an application execution being “built or linked into an application or application runtime environment”.

Instrumentation of RASP technology has been working to protect web applications by controlling its execution, vulnerabilities finding, and safeguarding it from attacks by detecting and stop attacks in real-time.

In other words, RASP security decisions are made inside an application to focus on any malicious behavior, indicative of an attack context, when the application is running.

instrumented into an application or its runtime environment to protect the application itself.

What is RASP Security?

Runtime Application Self Protection – Making Applications become self-defending

Gartner RASP Magic Quadrant

But protection of web applications and APIs has been the moot questions for years and dealing with lots of challenges.

With the rapid evolution of threat landscape, dependency on blocking threats based on ‘blacklisting’ known attacks will not solve the issue. For applications security, it is very important to understand the context of incoming traffic so that you have idea of ‘inside’ story of an application information. This is what ‘runtime instrumentation does.

As more than 70% of attacks take place on application layer, dependency on security perimeter needs an overhaul. Security of application is also evident as attackers are always in the know of finding targeting vulnerabilities to compromise sensitive, confidential data. To safeguard information assets, identifying and blocking attacks in real time,  

Runtime Application Self-Protection (RASP) security is an application security technology which protects applications, from attacks and vulnerabilities in real time, during an application’s runtime environment.

RASP Application Security Testing

This concept of protecting production applications from the inside stems from Gartner’s 2018 Magic Quadrant for Application Security Testing.  Inclusion of Interactive application security testing, or IAST paved way to utilize the combined version of SAST and DAST via a runtime agent.

The common denominator between an IAST and RASP is their residence on the application server as they run on web server. Difference lies in their working style. On the one hand, we have Interactive application security testing (IAST) which reports detected vulnerabilities by launching tests and Runtime Application Self-Protection (RASP) solutions on the other which does not ‘scan’ an application but monitors the application, by integrating itself (and living inside an application) , for attack at runtime by analyzing traffic and end user behavior.

How RASP Security Solutions Tools Work?

RASP solutions enable self-protection against common attacks and vulnerabilities in real time.

RASP security tools, working as an agent by sitting inside the application, give security insights. Because RASP software do not bank on signatures, heuristics, fuzzy logic, machine learning or AI,

Source

Adding an integrated layer of threat defense and vulnerability mitigation, RASP application security software works as an agent, living in the runtime environment, monitoring application input behavior with context.

RASP application security works in 2 operational modes   

Diagnostic mode:

In this monitoring/diagnostic mode, RASP software detects risky application behaviours, API calls and threats – getting contextual information from software. RASP software, in diagnostic mode, will raise alerts when attacks are detected (does not block an attack, in this mode) and send information about vulnerabilities to a dashboard.  

Self-protection mode:

In this pre-programmed application self-protection mode, In the process of detection of security issues, RASP solutions stop the execution of requests at run-time which could trigger application vulnerabilities in the code. Some of the actions during self-protection mode could be:

RASP Security Software – Beyond Perimeter-based protections