Applications have become an excellent target for hackers to penetrate the enterprise . Because they know that if they can find and exploit vulnerabilities in the application , They have more than a third chance of successfully invading . what's more , The possibility of discovering application vulnerabilities is also high . Contrast Security The survey shows that , 90% The application has not been tested for vulnerabilities during the development and quality assurance phases , Even quite a few applications are not protected during production .

Because there are many vulnerable applications running in the enterprise , The challenge for the security team is how to protect these applications from attack . One way is for applications to protect themselves by identifying and preventing attacks in real time , This is called runtime application self-protection （Runtime Application Self-Protection） Technology .

  What is? RASP？

Apply self-protection at runtime （RASP） This concept is developed by Gartner On 2012 in , This is a new security technology , So that enterprises can prevent hackers from invading enterprise applications and data . RASP Technology is usually built into an application or application runtime environment , Be able to control the execution of the application , And detect vulnerabilities to prevent real-time attacks .

When the application starts running ,RASP By analyzing the behavior of the application and the context of that behavior , Protect them from malicious input or behavior . RASP By enabling the application to continuously detect its own behavior , Can immediately identify and mitigate attacks , And there's no need for human intervention .

No matter what RASP Resident in server Where is it , It integrates security into running applications . It intercepts all calls from the application to the system , Make sure they are safe , And validate data requests directly within the application . Web He Fei Web Applications can be RASP The protection of the . This technology does not affect the design of the application , because RASP The detection and protection functions of the can be applied in the server Up operation .

  Why? RASP So important ？

Intrusion prevention system （IPS） And network application firewall （WAF） Technologies such as are commonly used for application protection at run time , But they work online while checking network traffic and content . When they analyze traffic to and from applications and user sessions , They cannot see how traffic and data are handled within the application . Because their protection measures often lack the accuracy required for session termination , Therefore, it will consume a lot of security team bandwidth , Usually only used for alarm and log collection . What is needed now is a new application protection technology ——RASP, It can reside in the runtime environment of the application to be protected .

  Security challenges facing applications

Protecting Web The application and API when , You will usually face the following 4 Common security challenges ：

1、 Real attacks are hard to identify . Each application has its own unique vulnerability , And can only be used by special attacks . Completely harmless for an application HTTP request , It could be devastating for another application . meanwhile ,“ On-line （on the wire）” The data may be different from what it shows in the application （ go by the name of “ Impedance mismatch ” problem ）.

2、 present Generation applications （ especially API） Use complex formats , Such as JSON、XML、 Serialize objects and custom binary formats . These requests use the exception of HTTP Various agreements other than , Include WebSocket, It is created by the JavaScript、 Rich client 、 Mobile applications and many other sources .

3、 Traditional technical defense has no effect . WAF By means of HTTP Analyze the traffic before it reaches the application server , Completely independent of the application . Although most large organizations have WAF, However, many of the these enterprises do not have a professional team to make necessary adjustments and maintenance , Make it only in “ Logging mode ”.

4、 Software is developing rapidly , Containers 、IaaS、PaaS、 Both virtual machines and elastic environments are experiencing explosive growth . These technologies make applications and API Can be deployed quickly , But it will also expose the code to new vulnerabilities . DevOps It has also speeded up integration 、 Speed of deployment and delivery , Therefore, the process of ensuring software security in the rapid development stage becomes more complex .

Fortunately, , Apply self-protection at runtime （RASP） It can solve many of these problems .

 RASP How it works

When APP When a security event occurs in ,RASP Will control the application and solve the problem . In diagnostic mode ,RASP Just issue a problem alarm . In protected mode , It will try to block the problem instruction . for example , It can prevent execution on the database when it looks like SQL Instructions to inject attacks .

RASP Other actions that can be taken include terminating the user's session 、 Stop application execution , Or send an alarm to the user or security personnel .

Developers can do this in several ways RASP. They can access the technology through function calls contained in the application source code , Or they can put a complete application in one wrapper in , This allows the application to be protected with the press of a button . The first method is more accurate , Because developers can decide that they want to protect APP Which part of , For example, log in 、 Database query and management functions .

Either way , The end result will be Web The application firewall is bound to the runtime environment of the application . This closeness to the application means RASP Can be more finely tuned to meet the security needs of the application .

RASP Major advantages

RASP It is unique because it works inside the software , Instead of running as a network device . This makes RASP You can take advantage of all running applications and API Context information obtained in , Including the code itself 、 Frame configuration 、 Applications server To configure 、 Code base and framework 、 Runtime data flow 、 Runtime control flow 、 Back end connection, etc . More context information means wider protection scope and better accuracy .

RASP A lower cost

  • RASP The solution can quickly and efficiently prevent attacks until the underlying vulnerabilities are resolved

  • And WAF comparison , Their deployment costs and operation and maintenance are lower

  • They are deployed on existing server On , Avoid extra expenses

  • RASP Technology looks at what the application actually does , Therefore, the same type of adjustment is not required 、 model building 、 Validation or human resources

RASP Accuracy means that applications are better protected

Protecting applications from attacks often means trying to block them at the network level . But when it comes to understanding application behavior , Traditional methods are inherently inaccurate , Because they are outside the application . meanwhile , Network based application security products will generate many false positives and need to be constantly adjusted . In the past 25 In the year , Network protection is getting closer to application —— From firewalls to intrusion prevention systems , Until then WAF. With RASP, Security can go directly into the application .

  • RASP Pile insertion provides a level of accuracy that traditional methods cannot achieve

  • It enables application security to be truly in application

  • Higher accuracy enables enterprises to confidently protect more data and applications with fewer resources

RASP Can be in the cloud and DevOps Use in

  • RASP Be able to develop in agile 、 Cloud Applications and web Good operation in service

  • And those that need constant adjustment WAF The solution is different , It accelerates agile development by providing protection without rework

  • RASP Faster and more accurate application

  • Whether in the cloud or locally ,RASP Can move seamlessly as applications grow or shrink

  • Support RASP The application does not know that the attack is through API Or the user interface

RASP Provide unprecedented monitoring

  • RASP Simplify application security monitoring by plugging the entire application

  • When relevant parts of the application are accessed or other conditions are met （ Such as login 、 transaction 、 Permission change 、 Data manipulation, etc ）, You can create RASP Policy to generate log events

  • Policies can also be added and deleted as needed

  • With RASP, All these application records can be implemented without modifying the application source code or redeploying .

RASP Good at providing visibility of application layer attacks

  • RASP Keep providing information about who attacked you and the technology they used , And tell you which applications or data assets are targeted .

  • Except for the complete HTTP Request details ,RASP Application details are also provided , Including the specific location of the code line related to the vulnerability 、 Exact back-end connection details （ Such as SQL Inquire about ）、 Transaction information and currently logged in user .

  • Use RASP Provides instant visibility to software development teams , Help prioritize your work , And take action on security defense .

because RASP Not a hardware box , It can be easily deployed in all environments , And quickly stop hacker attacks , Finally, the application can defend against attacks in real time .

Self protecting applications will become a reality

When the attacker breaks through the perimeter defense ,RASP The system can still be protected . It provides insight into applied logic 、 Configuration and data event flow , It means RASP Can thwart attacks with high accuracy . It can distinguish between actual attacks and legitimate requests for information , This reduces false positives , So that network defenders can spend more time solving real problems , Instead of drilling into a dead end .

Besides , Its ability to self protect application data means Data is protected from the moment of its birth to its destruction . This is especially useful for businesses that need to meet compliance requirements , Because the self-protection data is unsolvable to network hackers . Even in some cases , If stolen data makes it unreadable when stolen , Regulators do not require companies to report this data breach .

And WAF equally ,RASP Nor will it fix the application's source code , But it does integrate with the application's underlying code base , And protect vulnerable areas of the application at the source code level .

because RASP Still in its infancy , Its shortcomings will be gradually overcome in the future development , And hopefully it will become the future of application security . just as Veracode Chief Innovation Officer Joseph Feiman In the position of Gartner As the vice president of research pointed out ： “ Modern security cannot test and protect all applications . therefore , The application must be able to protect itself —— Self test 、 Self diagnosis and self-protection . This should be CISO Top priority ”.

Reference link ：

Maverick Research: Stop Protecting Your Apps; It's Time for Apps to Protect Themselves:

https://www.gartner.com/en/documents/2856020

Apply self-protection at runtime （RASP）： More related articles on applying safe self-cultivation

  1. RASP Runtime Application Self-protection Apply self-protection at runtime Introduction and advantages and disadvantages

    RASP Introduce Runtime Application Self-protection Apply self-protection at runtime [ Picture source : Green unita ] Concept Gartner ( Famous information technology research and analysis manufacturers ) stay 2014 It was proposed that ...

  2. Learn about the self-protection of running software (RASP)

    Take a look at this article : http://www.jianshu.com/u/c89141b2d51e Corresponding demo demonstration : https://github.com/xbeark/javaopenrasp

  3. Android Data storage Android 6.0 Thinking about file storage under runtime permission

    Preface : Before we do App File storage is basically used in the development process , So file storage is quite familiar to us , But since Android 6.0 After the release , Access to external devices based on runtime permission mechanism sdcard You need to apply for permission dynamically , So ...

  4. Android Authority management Android 6.0 Runtime permissions and solutions

    Preface : Today is still a hot topic around the recent interview Android 6.0 Authority adaptation to summarize learning , Actually Android 6.0 It's this year that our company adapts its rights 5 It's only in June that we start to do , It's relatively late , But now, Android 6.0 With ...

  5. Android in Activity Detailed explanation of screen direction and display mode during operation

    Now our mobile phones generally have a built-in direction sensor , The mobile phone screen will automatically switch between horizontal and vertical screens according to the location ( If the screen orientation is not locked ). But sometimes our application can only run in horizontal or vertical screen , At this point, we need to lock the program Activity shipment ...

  6. ASP.NET 5 Run time upgrade to Beta5

    stay Visual Studio 2015 RTM and Windows 10 Before official release , Microsoft open source .NET Upgrade to beta5, Has brought some enhancements and changes . and Visual Studio 2015 RC Installed together AS ...

  7. java Get generic types at run time

    introduction as everyone knows ,java The most important feature of generics is generic erasure , All generics are converted to at compile time Object So in java The generic type cannot be obtained by the runtime in . But in fact, the above rules are for the internal variables of the method , If it is a generic type in other forms, it is actually ...

  8. from objC What comes to mind at runtime ...

    objC Languages are not just object-oriented ( encapsulation , Inheritance and polymorphism ), It also has the flexibility of a scripting language ( Runtime ), This makes objC It has a lot of strange functions - You can add methods to a class or object at run time , You can even add class methods , You can even create classes dynamically . ...

  9. Android Studio Use the source code everywhere red warning , The runtime is right

    Reprinted address :http://www.07net01.com/program/2016/04/1452749.html [ Abstract : is AS When I was on the road , When it comes to that problem , Open all of them Java Source file , Red on the right , Did you find it ...

  10. 1.2 - C# Language habits - Use runtime constants readonly Instead of compile time constants const

    C# There are two types of constants in : Compile time constants and runtime constants . The two have very different behaviors , Improper use will lead to performance or correctness problems . It's best not to have either of these problems happen , But if it is difficult to avoid at the same time , So a slightly slower but guaranteed program ...

Random recommendation

  1. CCF Best catering (BFS)

    Problem description Dongdong recently opened a restaurant chain , Take out service . With more and more chain stores , How to reasonably deliver meals to customers has become an urgent problem to be solved . The area where the chain stores are located can be regarded as a n×n The grid of ( As shown in the figure below ), On the lattice point of a square ...

  2. python Introductory exercises 2

    1, Make a form The loop prompts the user to enter : user name , password , mailbox ( The length of the user input is required to exceed 20 Characters , If it exceeds, then only the front 20 Characters are valid ) If user input q or Q Just quit the program , Display the user's input in the form of a table user_inpu ...

  3. iOS Open source project tutorial collection

    UI piece 1.MMDrawerController http://www.cnblogs.com/shangdahao/p/3142204.html 2.SVPullToRefresh http://w ...

  4. Apache .htaccess Rewrite How to solve the problem of question mark matching

    Such as news.asp?id=123 It needs to be directed to news/123.html  This one uses RewriteRule How to write it? ? RewriteRule ^news\.asp\?id=(\d+)$ news/ ...

  5. CELL_PHOTO_IDENTIFIER

    # define CELL_PHOTO_IDENTIFIER @"photoLibraryCell" # define CLOSE_PHOTO_IMAGE @"close ...

  6. uva10934 Dropping water balloons

    // It's been a long time I've been out of shape Then I brush a water topic to play // Winter training and school competition have achieved similar topics But it wasn't ( In fact, not now The question : Yes k Two balloons and one n A tall building , The balloon has hardness , It happened to break in some place , Ask at least how many experiments ...

  7. JSP File conversion to JAVA The structure after the file

    public final class zzz_jsp extends HttpJspBase implements JspSourceDependent{ public void _jspInit() ...

  8. utilize qq Set personalized domain name mailbox

    First, there are domain names . Register first , There are many domain name trading platforms in China . I am a domain name registered on the Internet of China ,Lios.top, Because the value of this domain name is very low . It's only a year 10 element , The price is very affordable . The next step is to qq Mailbox settings , Find account , however ...

  9. SSH build spring, Using dependency injection

    The configuration file <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.o ...

  10. We can talk fedora Installation of music and video player under

    rpm The package is equivalent to windows Under the exe, It is already the compiled binary code , have access to rpm Order or dnf install ???.rpm To install lnux Install the software windows Different , The latter should look everywhere , Want to do ...