Runtime Application Security
Runtime application security places detection and protection inside a running application or its language runtime. It uses execution context to recognize harmful operations and can report or block them before they complete.
itOffensive security and application security | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Don't Panic
Don't Panic - Runtime Application Security
Runtime application security observes and controls software while it executes. Its best-known form is runtime application self-protection, or RASP. A RASP control runs inside the application process or language runtime. That position lets it examine an operation with application context before the operation reaches a sensitive sink such as a database, file system, network client, template engine, or command interpreter.
NIST describes RASP as runtime instrumentation that detects and blocks exploitation by using information from executing software. That location distinguishes it from a web application firewall. A WAF inspects network requests at a boundary. RASP can see what the application does with a request after parsing, routing, decoding, and business logic have changed it. The controls complement each other because each has a different view.
A typical path instruments selected functions, associates untrusted input with the request, and watches that data move toward sinks. At a sink, the sensor combines the operation, arguments, data origin, call path, user, route, and policy. Policy may permit, record, or interrupt. Common modes are off, monitor, and block. Virtual patches are narrowly scoped runtime rules that reduce exploitability while code is fixed.
Coverage is limited by supported languages, frameworks, versions, and process architectures. Unsupported workers and native extensions create gaps that a green agent status will not reveal. Start in monitor mode long enough to tune false positives, then block high-confidence classes. Keep virtual patches owned and time-bounded so they do not become permanent policy debt.
Read the Intro for the protection path and WAF contrast. Use the Cheatsheet when you need the component and mode map. Landscape places RASP beside related application security tools; Updates tracks NIST SP 800-53 and OWASP AppSensor pages this course uses for the vendor-neutral framing.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
Supports
- SI-7(17) definition of runtime application self-protection
- Runtime instrumentation and use of executing-software context
- Detection, blocking, monitor and protection modes, and response choices
- Difference between runtime and perimeter protection
- https://owasp.org/www-project-appsensor/
Supports
- Application-layer attack detection and automated response
- Application-specific detection points and response categories
- Self-defending applications as a complement to external controls
- https://mas.owasp.org/MASTG/tools/android/MASTG-TOOL-0147/
Supports
- Mobile RASP checks for hostile device and execution conditions
- Client-side runtime checks can be bypassed and need layered validation
- https://arxiv.org/abs/2312.17726
Supports
- RASP as runtime exploitation prevention rather than vulnerability discovery
- Runtime agents as an instrumentation mechanism
- Evaluated RASP coverage was effective for injection but did not replace broader testing
- https://docs.contrastsecurity.com/en/python.html
Supports
- Language agent deployment for IAST and RASP
- Inspection of request input, database queries, file writes, and output
- https://docs.contrastsecurity.com/en/protect.html
Supports
- In-process data-flow and execution context
- Protect rules, virtual patches, and runtime customization
- https://docs.contrastsecurity.com/en/set-protect-rules.html
Supports
- Off, monitor, and block modes per environment
- Monitoring reports attacks while blocking interrupts them
- https://docs.contrastsecurity.com/en/instrument-applications-for-protect.html
Supports
- Agent installation by application language
- Production identification, monitoring, and blocking through Protect
- https://docs.datadoghq.com/security/application_security/
Supports
- Runtime threat detection and in-app protection
- Difference between in-app WAF and sink-aware exploit prevention
- SQL, file, command, and outbound-request exploit paths
- https://docs.datadoghq.com/security/application_security/waf-integration/
Supports
- Layered use of perimeter and in-app controls
- Distributed trace context for runtime investigation
- https://docs.dynatrace.com/docs/secure/application-security/application-protection
Supports
- Runtime instrumentation, attack analysis, and optional blocking
- Deep monitoring prerequisites and supported technology boundaries
- Off, monitor, and block configuration by technology and process group
- https://docs.waratek.com/
Supports
- Java agent interception of sensitive runtime calls
- Resolved arguments, call stacks, input tracking, policy, blocking, and event logging
- https://www.alibabacloud.com/help/en/arms/application-security/product-overview/what-is-application-security
Supports
- Java agent deployment and key-function hooks
- Runtime and WAF controls as complementary layers
- Documented Java-only scope and covered attack classes
- https://github.com/sindresorhus/awesome
Supports
- Discovery of the curated Awesome AppSec list
- https://github.com/paragonie/awesome-appsec
Supports
- Discovery of Juice Shop, WebGoat, and NodeGoat as application security learning projects
- https://owasp.org/www-project-juice-shop/
Supports
- Deliberately insecure Node.js application for training and security-tool evaluation
- https://owasp.org/www-project-webgoat/
Supports
- Deliberately insecure Java application for authorized learning and tool testing
- https://owasp.org/www-project-node.js-goat/
Supports
- Node.js environment for learning, fixing, and testing OWASP risks
- https://www.talsec.app/
Supports
- Mobile runtime self-protection offerings and supported mobile frameworks
- https://www.guardsquare.com/dexguard
Supports
- Android code hardening, runtime self-protection checks, and malware defenses