Runtime application self-protection

Runtime application self-protection (RASP) is a security technology that uses runtime instrumentation to detect and block computer attacks by taking advantage of information from inside the running software.[1][2] The technology differs from perimeter-based protections such as firewalls, that can only detect and block attacks by using network information without contextual awareness.[3][4] RASP technology is said to improve the security of software by monitoring its inputs, and blocking those that could allow attacks, while protecting the runtime environment from unwanted changes and tampering.[5] RASP-protected applications rely less on external devices like firewalls to provide runtime security protection. When a threat is detected RASP can prevent exploitation and possibly take other actions, including terminating a user's session, shutting the application down, alerting security personnel and sending a warning to the user.[6][7] RASP aims to close the gap left by application security testing and network perimeter controls, neither of which have enough insight into real-time data and event flows to either prevent vulnerabilities slipping through the review process or block new threats that were unforeseen during development.[8]

Implementation

RASP can be integrated as a framework or module that runs in conjunction with a program's codes, libraries and system calls.[5] The technology can also be implemented as a virtualization.[4] In some application security solutions, RASP technology is used in conjunction with Dynamic Application Security Testing (DAST) technology to create an Interactive Application Security Testing security product.[9]

Deployment options

RASP solutions can be deployed in two different ways: monitor or protection mode. In monitor mode, the RASP solution reports on web application attacks but does not block any attack. In protection mode, the RASP solution reports and blocks web application attacks.

Commercial vendors

Many commercial RASP vendors have similar features, but major differences often refer to the programming languages and databases supported, user interfaces, deployment options, or requirements within specific environments.

References

  1. ↑ "Gartner IT Glossary: Runtime Application Self-Protection(RASP)". Gartner.
  2. ↑ Messmer, Ellen (June 23, 2014). "Will Perimeter Firewalls Give Way to 'RASP'". NetworkWorld.
  3. ↑ Laskowski, Nicole (February 25, 2015). "RASP Helps Apps Protect Themselves, But is it Ready for the Enterpreise?". Computer Weekly.
  4. 1 2 Badakhchani, Hussein (October 20, 2016). "RASP Rings in a New Java Application Security Paradigm". JavaWorld.
  5. 1 2 Tittel, Ed (October 2016). "Runtime Application Self-Protection Basics, Pros and Cons". TechTarget.
  6. ↑ "Runtime Application Self-Protection". Veracode.
  7. ↑ Rouse, Margaret. "Runtime Application Self-Protection". TechTarget.
  8. ↑ "How does RASP application security testing work?". www.bitpipe.com. Retrieved 2018-06-30.
  9. ↑ "What is IAST? Interactive Application Security Testing". Veracode.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.