Cybersecurity
RASP
RASP (Runtime Application Self-Protection) is a security technology embedded in an application that monitors and protects it from within during runtime. RASP detects and blocks attacks in real-time, using application context for precise detection.
What is RASP?
RASP Definition
RASP (Runtime Application Self-Protection) is an application security technology that is embedded or integrated with an application and protects it from within during runtime. RASP has full application execution context, enabling precise attack detection and blocking.
How Does RASP Work?
RASP operates inside the application process:
- Instrumentation: RASP integrates with application runtime (JVM, .NET CLR, Node.js)
- Monitoring: Observes function calls, DB queries, file access
- Context analysis: Understands code intent and data flow
- Detection: Identifies anomalies and attacks
- Blocking: Stops attack or logs event
What Does RASP Protect?
- SQL Injection: Detects query manipulation
- XSS: Identifies script injection attempts
- Path Traversal: Blocks unauthorized file access
- Command Injection: Detects command injection
- XXE: Protects against XML attacks
- SSRF: Blocks unauthorized server requests
RASP vs WAF
| Aspect | RASP | WAF |
|---|---|---|
| Location | Inside application | In front of application |
| Context | Full application context | Request/response only |
| False positives | Lower | Higher |
| Performance | Application impact | Latency impact |
| Deploy | Per application | Centralized |
RASP Operating Modes
Monitoring (Log only):
- Detects and logs attacks
- Doesn’t block
- Deployment phase
Blocking:
- Detects and blocks attacks
- May return error or terminate session
- Production mode
RASP Benefits
- Precision: Context minimizes false positives
- Zero-day protection: Behavioral detection
- Visibility: Insight into application behavior
- Self-protection: Application protects itself
- Defense in depth: Additional protection layer
RASP Challenges
- Performance: Application overhead
- Compatibility: Not all frameworks supported
- Complexity: Requires application integration
- Scalability: Deploy per instance
- Language support: Limited to supported languages
RASP in DevSecOps
RASP complements other tools:
- SAST: Detects vulnerabilities in code
- DAST: Tests running application
- SCA: Analyzes dependencies
- RASP: Protects in production
RASP is the last line of application defense, operating when other mechanisms fail.