Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

01:15 PM
Mark Carrizosa
Mark Carrizosa
Connect Directly
E-Mail vvv

RASP: A False Sense of Security For Apps & Data

Betting on a single runtime tool like RASP is not the solution for eliminating application security risk.

Reports about data breaches have become so common that we no longer react with shock or outrage, we merely treat them as business as usual. Whether it be a hack at the Office of Personnel Management, UCLA, the Army National Guard or countless smaller breaches, we have become indifferent and desensitized to these violations - unless it impacts us personally.

Web-based applications have been, and will continue to be, a primary target for attackers seeking a means to penetrate organizations’ networks. What’s worse, hackers are finding easier openings when security takes a back seat to achieving faster development and deployment cycles. A number of technologies have been introduced to help secure apps, while fostering faster development. But are they really all they’re cracked up to be?

Let’s consider one technology that’s getting a lot of buzz these days: runtime application self-protection (RASP). The idea behind using RASP for security, according to Joseph Feiman, a research vice president and fellow at Gartner, is that applications can be better protected when self-protection capabilities are built into their runtime environments. This provides security and development teams with full insight into application logic, configuration, and data and event flows. And, because RASP operates in the runtime environment, it is able to control application execution, and detect/prevent attacks in real-time, as opposed to a more reactive model that is more focused on minimizing impact. 

RASP clearly offers a number of benefits, such as a granular approach to combatting attack vectors and better scalability minus the additional hardware costs. Because RASP has that direct connection to the self-protected app, it has a clear sense of what that app needs to remain secure. When the application is executed, RASP enables it to monitor itself, detect malicious or errant behaviors, and alert IT to problems.

RASP is growing in popularity because it eliminates a lot of the time and effort that organizations would typically take to build security checks into their processes. But in many ways, I see such handy shortcuts could foreshadow serious problems with the quality of the underlying code.

This is not speculation; there is a reason why SQLi/XSS are consistently on the Open Web Application Security Project (OWASP) Top 10. The concern is that the reliance on this solution can mask a developer’s tendency to let software security best practices take a back seat to new capabilities, particularly with increasingly aggressive go-to-market timelines and continuous delivery models.

Unintended Consequences

Though RASP’s goals are noble, it could also have unintended consequences rendering it unusable. Introducing a re-write of software execution at the last minute could be very risky from a support/incident response perspective, particularly as applications are modularized and supported by numerous teams. Expect there to be a fair amount of contention and finger pointing should there be any type of operational issue (regardless of relevance).

More often than not, checks could be paused, alarms silenced, and anything causing these issues could take a back seat to revenue generation as a company essentially accepts a high level of risk out of sheer annoyance (similarly to WAF implementations). Certainly this is not the most effective way of responding to security issues.

RASP also could have a negative impact on service level agreements (SLAs). Allowing RASP to stop code running in production in the midst of an attack certainly paves the way for a pretty effective self-imposed Denial of Service (DoS) engine. In today’s high-performing environments, where availability is expected at four or five 9s, downtime could have a serious impact to SLA’s and subsequently result in lost revenue and impact the company brand.

Having been on the frontlines of building security into solutions and development code for high-profile retailers, including Walmart and PetSmart, I believe there are a number of red flags surrounding RASP that must be considered. It is still a nascent technology, as less than 1 percent of all web and cloud applications are leveraging RASP for self-protection today. If companies experience security breaches as a result of their reliance on RASP, they’re not likely to fess up to it publicly. Hence, we don’t know, and won’t know, how effective it is.

Without a doubt, RASP can be a valuable addition in development, QA and testing environments, where it can serve as another element of due diligence and allow you to go back and fix security bugs before they are introduced to a production build. But to truly mitigate these attack vectors, we need to look to properly secure what is at the core of the businesses, the application code itself. Betting on a single runtime tool - like RASP - to magically eliminate risk is not the answer.

Mark Carrizosa is the vice president of Security at Soha Systems, a cloud-based application security provider for enterprises and SaaS providers. Carrizosa joined Soha Systems in 2015 from Walmart where, as principal security architect, he developed and implemented the ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
8/24/2015 | 8:38:19 AM
In my opinion...
In my opinion, this article was written by a person who's "Cloud Application Security" business would be greatly impacted, in an  adverse way, if companies were to adopt the use of RASP, so take it for what it's worth.
User Rank: Author
8/19/2015 | 1:02:59 PM
Re: Testing
Clearly, the title posed a question intended to shed light on a hot topic to provoke a discussion from all angles...mission accomplished I suppose.

As for your second point, you are correct in that reliance on any single technology (security or otherwise) carries some level of risk and are considered as such by any security professional, hence the term "Defense In Depth"; though when considering the difference between detective and preventative security measures I'd say it's only half true.

What is unique about this particular topic is that there is conflicting information with regards to how compliance efforts are approached. We've all seen shops utilize compliance as a checkbox, as opposed to part of a robust security program. I've had (as recently as 2 weeks ago) conversations with teams who are looking to use WAF to eliminate the need of source code review for PCI. While not entirely accurate, PCI DSS 3.1 Section 6.6 may help in perpetuating some of the confusion by allowing organizations to rely on a preventative control vs actual testing.

Considering the increasing risk to any application exposed to the Internet these days, it is worth bringing this point of view to light to hopefully drive security organizations to think about all angles as they implement more effective programs and reduce the amount of overall breaches.
User Rank: Author
8/19/2015 | 12:20:21 PM
Re: Testing
If that's what you really think, then what's with a title like "RASP: A False Sense of Security For Apps & Data?  Clickbait?  Why wouldn't any single security technology give the same false sense of security?
User Rank: Author
8/19/2015 | 12:15:41 PM
Re: Testing
There is no doubt that RASP has the potential to be used as part of a multi-pronged approach to securing applications. However, as with any new technology, careful consideration must be given to the manner in which it is implemented and how it will affect the overall effort. As the "latest and greatest" innovations break into the industry, the marketing machine has a way of promoting something that has potential to add great value to a more loftier "magic bullet" status. With all the hype, deserving or otherwise, organizations are feeeling pressure to plug the leaks quickly to focus on features & function and may do so at the risk of skirting solid appsec fundamentals.

This is not to say developers do not care about security, I would argue that they have more insight to how to protect an application than a potion of security professionals. The issue at hand is that they receive requirements from multiple sources and must prioritize (sometimes according to who screams the loudest). Over the last 10+ years i've seen, more often than I would care to admit, security requirements are given priority when there is some external driving force (i.e. audits, breaches, etc.) as opposed to becoming ingrained as part of the development culture.

Tools like IAST, DAST, and even RASP are just that, tools. They can be extremely effective to help mitigate risk throughout the SDLC, but they must be used effectively and efficiently and in combination with training and awareness programs to ensure the quality code is released consistently. My point being, that reliance on a single tool is a bit short-sided and can have some pretty serious repercussions if other critical practices are de-prioritized.

As I mentioned, as of a recent study less than 1% reported using RASP within their production environments. With such little adoption (not unexpected at this stage of the game), it is impossible to predict just how effective or dispruptive the technology will be. What is clear so far is that caution and due dilligence should be priorities as organizations look to explore methods which operate within a run-time environment, particularly those that have the potential to affect functionality if not configured optimally and managed throughout the change cycle.
User Rank: Author
8/18/2015 | 10:16:28 AM
Re: Testing
This is a big advantage of RASP. You can have it in place during development and security testing, to be sure that everything works. I think of RASP as just part of the application that provides attack detection and prevention.  It deploys along with the application into production fully tested.
User Rank: Author
8/18/2015 | 10:13:12 AM
Are there any real criticisms here?
I think it's important to recognize that there are many critical use cases that RASP performs far better than any alternative. Every organization needs to have the ability to respond quickly to security events without a full development cycle.

* measure attacks traffic for threat intelligence
* block attacks against custom code and libraries
* issue virtual patches

So RASP isn't a "handy shortcut." It's part of a well-balanced application security strategy. When integrated with IAST, you get unified application security command and control throughout the entire SLC.  You claim RASP...

* "can mask a developer's...security best practices"
* "could have unintended consequences"
* "could be paused"
* "could have a negative impact on SLAs"

These are strawmen with no evidence or substantiation. That's the essence of the fear, uncertainty, and doubt that plagues our industry. If you think there is a chance that RASP could cause a DoS, then spell out the scenario. But remember that RASP is different than a WAF, it operates within the context of the running application, and can be extremely surgical in how it responds to attacks.

It's not my experience that developers just throw in the towel and not try to develop secure code anymore when new technologies are added. Actually, RASP will provide the data to help prioritize fixes on the vulnerabilities that are actually being attacked.

User Rank: Ninja
8/17/2015 | 2:44:10 PM
This is why the testing phase is imperative. Even in the context of RASP. I would imagine like any of technology there are ways to set exclusions for genuine traffic. During the testing phase you need to discern what regular traffic looks like and remove it from the prevent phase. As "regular" is subject to change RASP would need to be updateable. This is all in an effort to not prevent genuine traffic. Like anything else, if you skip through this phase you are going to run into problems.
When It Comes To Security Tools, More Isn't More
Lamont Orange, Chief Information Security Officer at Netskope,  1/11/2021
US Capitol Attack a Wake-up Call for the Integration of Physical & IT Security
Seth Rosenblatt, Contributing Writer,  1/11/2021
IoT Vendor Ubiquiti Suffers Data Breach
Dark Reading Staff 1/11/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-01-18
An issue was discovered on ASUS DSL-N14U-B1 devices. An attacker can upload arbitrary file content as a firmware update when the filename Settings_DSL-N14U-B1.trx is used. Once this file is loaded, shutdown measures on a wide range of services are triggered as if it were a real update, r...
PUBLISHED: 2021-01-18
Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory. The affected versions are before version 4.8.5.
PUBLISHED: 2021-01-17
An issue was discovered in Quali CloudShell 9.3. An XSS vulnerability in the login page allows an attacker to craft a URL, with a constructor.constructor substring in the username field, that executes a payload when the user visits the /Account/Login page.
PUBLISHED: 2021-01-17
Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies via a direct /session/list/allActiveSession request. For example, the attacker can discover the admin's cookie if the admin account happens to be logged in when the allActiveSession request occurs, and ...
PUBLISHED: 2021-01-15
An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch daemon. The privileged service improperly validated XPC connections by relying on the PID instead of the audit token. An attacker can construct ...