Runtime Application Security
Runtime application security places detection and protection inside a running application or its language runtime. It uses execution context to recognize harmful operations and can report or block them before they complete.
itOffensive security and application security | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Intro
Runtime Application Security
Runtime application security observes and controls software while it executes. Its best-known form is runtime application self-protection, or RASP. A RASP control runs inside the application process or language runtime. That position lets it examine an operation with application context before the operation reaches a sensitive sink such as a database, file system, network client, template engine, or command interpreter.
NIST describes RASP as runtime instrumentation that detects and blocks exploitation by using information from executing software. This location distinguishes it from a web application firewall, or WAF. A WAF inspects network requests at a boundary. RASP can see what the application does with a request after parsing, routing, decoding, and business logic have changed it. The controls complement each other because each has a different view.
The protection path
A typical server-side request follows this path:
request → framework → application logic → sensitive operation → response
↘ runtime sensor → policy decision → event or block
An agent, library, or runtime hook instruments selected functions. It associates untrusted input with the request and watches that data move toward sensitive operations. At a sink, the sensor combines the operation, arguments, data origin, call path, user, route, and configured policy. The policy then permits the operation, records it, or interrupts it.
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
Supports
- SI-7(17) definition of runtime application self-protection
- Runtime instrumentation and use of executing-software context
- Detection, blocking, monitor and protection modes, and response choices
- Difference between runtime and perimeter protection
- https://owasp.org/www-project-appsensor/
Supports
- Application-layer attack detection and automated response
- Application-specific detection points and response categories
- Self-defending applications as a complement to external controls
- https://mas.owasp.org/MASTG/tools/android/MASTG-TOOL-0147/
Supports
- Mobile RASP checks for hostile device and execution conditions
- Client-side runtime checks can be bypassed and need layered validation
- https://arxiv.org/abs/2312.17726
Supports
- RASP as runtime exploitation prevention rather than vulnerability discovery
- Runtime agents as an instrumentation mechanism
- Evaluated RASP coverage was effective for injection but did not replace broader testing
- https://docs.contrastsecurity.com/en/python.html
Supports
- Language agent deployment for IAST and RASP
- Inspection of request input, database queries, file writes, and output
- https://docs.contrastsecurity.com/en/protect.html
Supports
- In-process data-flow and execution context
- Protect rules, virtual patches, and runtime customization
- https://docs.contrastsecurity.com/en/set-protect-rules.html
Supports
- Off, monitor, and block modes per environment
- Monitoring reports attacks while blocking interrupts them
- https://docs.contrastsecurity.com/en/instrument-applications-for-protect.html
Supports
- Agent installation by application language
- Production identification, monitoring, and blocking through Protect
- https://docs.datadoghq.com/security/application_security/
Supports
- Runtime threat detection and in-app protection
- Difference between in-app WAF and sink-aware exploit prevention
- SQL, file, command, and outbound-request exploit paths
- https://docs.datadoghq.com/security/application_security/waf-integration/
Supports
- Layered use of perimeter and in-app controls
- Distributed trace context for runtime investigation
- https://docs.dynatrace.com/docs/secure/application-security/application-protection
Supports
- Runtime instrumentation, attack analysis, and optional blocking
- Deep monitoring prerequisites and supported technology boundaries
- Off, monitor, and block configuration by technology and process group
- https://docs.waratek.com/
Supports
- Java agent interception of sensitive runtime calls
- Resolved arguments, call stacks, input tracking, policy, blocking, and event logging
- https://www.alibabacloud.com/help/en/arms/application-security/product-overview/what-is-application-security
Supports
- Java agent deployment and key-function hooks
- Runtime and WAF controls as complementary layers
- Documented Java-only scope and covered attack classes
- https://github.com/sindresorhus/awesome
Supports
- Discovery of the curated Awesome AppSec list
- https://github.com/paragonie/awesome-appsec
Supports
- Discovery of Juice Shop, WebGoat, and NodeGoat as application security learning projects
- https://owasp.org/www-project-juice-shop/
Supports
- Deliberately insecure Node.js application for training and security-tool evaluation
- https://owasp.org/www-project-webgoat/
Supports
- Deliberately insecure Java application for authorized learning and tool testing
- https://owasp.org/www-project-node.js-goat/
Supports
- Node.js environment for learning, fixing, and testing OWASP risks
- https://www.talsec.app/
Supports
- Mobile runtime self-protection offerings and supported mobile frameworks
- https://www.guardsquare.com/dexguard
Supports
- Android code hardening, runtime self-protection checks, and malware defenses