Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
RASP: A False Sense of Security For Apps & Data
Newest First  |  Oldest First  |  Threaded View
Darkman9812
50%
50%
Darkman9812,
User Rank: Apprentice
8/24/2015 | 8:38:19 AM
In my opinion...
In my opinion, this article was written by a person who's "Cloud Application Security" business would be greatly impacted, in an  adverse way, if companies were to adopt the use of RASP, so take it for what it's worth.
mcarrizosa
50%
50%
mcarrizosa,
User Rank: Author
8/19/2015 | 1:02:59 PM
Re: Testing
Clearly, the title posed a question intended to shed light on a hot topic to provoke a discussion from all angles...mission accomplished I suppose.

As for your second point, you are correct in that reliance on any single technology (security or otherwise) carries some level of risk and are considered as such by any security professional, hence the term "Defense In Depth"; though when considering the difference between detective and preventative security measures I'd say it's only half true.

What is unique about this particular topic is that there is conflicting information with regards to how compliance efforts are approached. We've all seen shops utilize compliance as a checkbox, as opposed to part of a robust security program. I've had (as recently as 2 weeks ago) conversations with teams who are looking to use WAF to eliminate the need of source code review for PCI. While not entirely accurate, PCI DSS 3.1 Section 6.6 may help in perpetuating some of the confusion by allowing organizations to rely on a preventative control vs actual testing.

Considering the increasing risk to any application exposed to the Internet these days, it is worth bringing this point of view to light to hopefully drive security organizations to think about all angles as they implement more effective programs and reduce the amount of overall breaches.
planetlevel
50%
50%
planetlevel,
User Rank: Author
8/19/2015 | 12:20:21 PM
Re: Testing
If that's what you really think, then what's with a title like "RASP: A False Sense of Security For Apps & Data?  Clickbait?  Why wouldn't any single security technology give the same false sense of security?
mcarrizosa
50%
50%
mcarrizosa,
User Rank: Author
8/19/2015 | 12:15:41 PM
Re: Testing
There is no doubt that RASP has the potential to be used as part of a multi-pronged approach to securing applications. However, as with any new technology, careful consideration must be given to the manner in which it is implemented and how it will affect the overall effort. As the "latest and greatest" innovations break into the industry, the marketing machine has a way of promoting something that has potential to add great value to a more loftier "magic bullet" status. With all the hype, deserving or otherwise, organizations are feeeling pressure to plug the leaks quickly to focus on features & function and may do so at the risk of skirting solid appsec fundamentals.

This is not to say developers do not care about security, I would argue that they have more insight to how to protect an application than a potion of security professionals. The issue at hand is that they receive requirements from multiple sources and must prioritize (sometimes according to who screams the loudest). Over the last 10+ years i've seen, more often than I would care to admit, security requirements are given priority when there is some external driving force (i.e. audits, breaches, etc.) as opposed to becoming ingrained as part of the development culture.

Tools like IAST, DAST, and even RASP are just that, tools. They can be extremely effective to help mitigate risk throughout the SDLC, but they must be used effectively and efficiently and in combination with training and awareness programs to ensure the quality code is released consistently. My point being, that reliance on a single tool is a bit short-sided and can have some pretty serious repercussions if other critical practices are de-prioritized.

As I mentioned, as of a recent study less than 1% reported using RASP within their production environments. With such little adoption (not unexpected at this stage of the game), it is impossible to predict just how effective or dispruptive the technology will be. What is clear so far is that caution and due dilligence should be priorities as organizations look to explore methods which operate within a run-time environment, particularly those that have the potential to affect functionality if not configured optimally and managed throughout the change cycle.
planetlevel
50%
50%
planetlevel,
User Rank: Author
8/18/2015 | 10:16:28 AM
Re: Testing
This is a big advantage of RASP. You can have it in place during development and security testing, to be sure that everything works. I think of RASP as just part of the application that provides attack detection and prevention.  It deploys along with the application into production fully tested.
planetlevel
50%
50%
planetlevel,
User Rank: Author
8/18/2015 | 10:13:12 AM
Are there any real criticisms here?
I think it's important to recognize that there are many critical use cases that RASP performs far better than any alternative. Every organization needs to have the ability to respond quickly to security events without a full development cycle.

* measure attacks traffic for threat intelligence
* block attacks against custom code and libraries
* issue virtual patches

So RASP isn't a "handy shortcut." It's part of a well-balanced application security strategy. When integrated with IAST, you get unified application security command and control throughout the entire SLC.  You claim RASP...

* "can mask a developer's...security best practices"
* "could have unintended consequences"
* "could be paused"
* "could have a negative impact on SLAs"

These are strawmen with no evidence or substantiation. That's the essence of the fear, uncertainty, and doubt that plagues our industry. If you think there is a chance that RASP could cause a DoS, then spell out the scenario. But remember that RASP is different than a WAF, it operates within the context of the running application, and can be extremely surgical in how it responds to attacks.

It's not my experience that developers just throw in the towel and not try to develop secure code anymore when new technologies are added. Actually, RASP will provide the data to help prioritize fixes on the vulnerabilities that are actually being attacked.

 
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
8/17/2015 | 2:44:10 PM
Testing
This is why the testing phase is imperative. Even in the context of RASP. I would imagine like any of technology there are ways to set exclusions for genuine traffic. During the testing phase you need to discern what regular traffic looks like and remove it from the prevent phase. As "regular" is subject to change RASP would need to be updateable. This is all in an effort to not prevent genuine traffic. Like anything else, if you skip through this phase you are going to run into problems.


COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15208
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a `DCHECK` which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can ...
CVE-2020-15209
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a `nullptr` buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one....
CVE-2020-15210
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption. We have patched the issue in d58c96946b and ...
CVE-2020-15211
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, saved models in the flatbuffer format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators and each operator has a set of input/output tensors. The flatbuffer format uses indices f...
CVE-2020-15212
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger writes outside of bounds of heap allocated buffers by inserting negative elements in the segment ids tensor. Users having access to `segment_ids_data` can alter `output_index` and then write to outside of `outpu...