Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
RASP: A False Sense of Security For Apps & Data
Newest First  |  Oldest First  |  Threaded View
Darkman9812
50%
50%
Darkman9812,
User Rank: Apprentice
8/24/2015 | 8:38:19 AM
In my opinion...
In my opinion, this article was written by a person who's "Cloud Application Security" business would be greatly impacted, in an  adverse way, if companies were to adopt the use of RASP, so take it for what it's worth.
mcarrizosa
50%
50%
mcarrizosa,
User Rank: Author
8/19/2015 | 1:02:59 PM
Re: Testing
Clearly, the title posed a question intended to shed light on a hot topic to provoke a discussion from all angles...mission accomplished I suppose.

As for your second point, you are correct in that reliance on any single technology (security or otherwise) carries some level of risk and are considered as such by any security professional, hence the term "Defense In Depth"; though when considering the difference between detective and preventative security measures I'd say it's only half true.

What is unique about this particular topic is that there is conflicting information with regards to how compliance efforts are approached. We've all seen shops utilize compliance as a checkbox, as opposed to part of a robust security program. I've had (as recently as 2 weeks ago) conversations with teams who are looking to use WAF to eliminate the need of source code review for PCI. While not entirely accurate, PCI DSS 3.1 Section 6.6 may help in perpetuating some of the confusion by allowing organizations to rely on a preventative control vs actual testing.

Considering the increasing risk to any application exposed to the Internet these days, it is worth bringing this point of view to light to hopefully drive security organizations to think about all angles as they implement more effective programs and reduce the amount of overall breaches.
planetlevel
50%
50%
planetlevel,
User Rank: Author
8/19/2015 | 12:20:21 PM
Re: Testing
If that's what you really think, then what's with a title like "RASP: A False Sense of Security For Apps & Data?  Clickbait?  Why wouldn't any single security technology give the same false sense of security?
mcarrizosa
50%
50%
mcarrizosa,
User Rank: Author
8/19/2015 | 12:15:41 PM
Re: Testing
There is no doubt that RASP has the potential to be used as part of a multi-pronged approach to securing applications. However, as with any new technology, careful consideration must be given to the manner in which it is implemented and how it will affect the overall effort. As the "latest and greatest" innovations break into the industry, the marketing machine has a way of promoting something that has potential to add great value to a more loftier "magic bullet" status. With all the hype, deserving or otherwise, organizations are feeeling pressure to plug the leaks quickly to focus on features & function and may do so at the risk of skirting solid appsec fundamentals.

This is not to say developers do not care about security, I would argue that they have more insight to how to protect an application than a potion of security professionals. The issue at hand is that they receive requirements from multiple sources and must prioritize (sometimes according to who screams the loudest). Over the last 10+ years i've seen, more often than I would care to admit, security requirements are given priority when there is some external driving force (i.e. audits, breaches, etc.) as opposed to becoming ingrained as part of the development culture.

Tools like IAST, DAST, and even RASP are just that, tools. They can be extremely effective to help mitigate risk throughout the SDLC, but they must be used effectively and efficiently and in combination with training and awareness programs to ensure the quality code is released consistently. My point being, that reliance on a single tool is a bit short-sided and can have some pretty serious repercussions if other critical practices are de-prioritized.

As I mentioned, as of a recent study less than 1% reported using RASP within their production environments. With such little adoption (not unexpected at this stage of the game), it is impossible to predict just how effective or dispruptive the technology will be. What is clear so far is that caution and due dilligence should be priorities as organizations look to explore methods which operate within a run-time environment, particularly those that have the potential to affect functionality if not configured optimally and managed throughout the change cycle.
planetlevel
50%
50%
planetlevel,
User Rank: Author
8/18/2015 | 10:16:28 AM
Re: Testing
This is a big advantage of RASP. You can have it in place during development and security testing, to be sure that everything works. I think of RASP as just part of the application that provides attack detection and prevention.  It deploys along with the application into production fully tested.
planetlevel
50%
50%
planetlevel,
User Rank: Author
8/18/2015 | 10:13:12 AM
Are there any real criticisms here?
I think it's important to recognize that there are many critical use cases that RASP performs far better than any alternative. Every organization needs to have the ability to respond quickly to security events without a full development cycle.

* measure attacks traffic for threat intelligence
* block attacks against custom code and libraries
* issue virtual patches

So RASP isn't a "handy shortcut." It's part of a well-balanced application security strategy. When integrated with IAST, you get unified application security command and control throughout the entire SLC.  You claim RASP...

* "can mask a developer's...security best practices"
* "could have unintended consequences"
* "could be paused"
* "could have a negative impact on SLAs"

These are strawmen with no evidence or substantiation. That's the essence of the fear, uncertainty, and doubt that plagues our industry. If you think there is a chance that RASP could cause a DoS, then spell out the scenario. But remember that RASP is different than a WAF, it operates within the context of the running application, and can be extremely surgical in how it responds to attacks.

It's not my experience that developers just throw in the towel and not try to develop secure code anymore when new technologies are added. Actually, RASP will provide the data to help prioritize fixes on the vulnerabilities that are actually being attacked.

 
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
8/17/2015 | 2:44:10 PM
Testing
This is why the testing phase is imperative. Even in the context of RASP. I would imagine like any of technology there are ways to set exclusions for genuine traffic. During the testing phase you need to discern what regular traffic looks like and remove it from the prevent phase. As "regular" is subject to change RASP would need to be updateable. This is all in an effort to not prevent genuine traffic. Like anything else, if you skip through this phase you are going to run into problems.


Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11619
PUBLISHED: 2020-04-07
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).
CVE-2020-11620
PUBLISHED: 2020-04-07
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).
CVE-2020-11509
PUBLISHED: 2020-04-07
An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows remote attackers to upload page templates containing arbitrary JavaScript via the c37_wpl_import_template admin-post action (which will execute in an administrator's browser if the template is used to create a page).
CVE-2020-6647
PUBLISHED: 2020-04-07
An improper neutralization of input vulnerability in the dashboard of FortiADC may allow an authenticated attacker to perform a cross site scripting attack (XSS) via the name parameter.
CVE-2020-9286
PUBLISHED: 2020-04-07
An improper authorization vulnerability in FortiADC may allow a remote authenticated user with low privileges to perform certain actions such as rebooting the system.