1

What is the difference between:

  1. Runtime Application Self Protection (RASP)
  2. Web Application Firewalls (WAF)
  3. Intrusion Detection and Prevention Systems (IDPS)

Especially the difference between IDPS and RASP is kind of vague to me. For example, I'm currently working on OWASP AppSensor and they describe themselves as: "intrusion detection and automated response".

I would assume then that AppSensor is a IDPS. But when I go and read what RASP means I'm more inclined to believe that AppSensor is a RASP.

Can anyone explain the difference to me (and perhaps many others), preferably in plain English.

bobylito
  • 3,172
  • 22
  • 27
Damien Brils
  • 75
  • 1
  • 10

1 Answers1

3

IDS / IPS

IDPS means that you want to detect intrusions and protect from intrusions. Most of the time a distinction is made between IDS (intrusion detection system, which is passive) and IPS (intrusion prevention system, which is active).

WAF (Web application firewall)

WAF (https://en.wikipedia.org/wiki/Web_application_firewall) is a technology originated in the 1990s.

What is it? A HTTP reverse proxy that will analyse the HTTP payload going through it.

Examples: ModSecurity, a popular Apache or Nginx module, CloudFlare, Fortinet...

How does it work? A WAF will detect and/or block attacks based on patterns, statistical analysis, and algorithms such as libinjection. WAF can implement useful protections against Denial of Service attacks since they are located on the network - in front of the application.

Inconvenient: due to the few information they use to take action, WAF typically suffer from false positives (they block legitimate attack, or alert you about legitimate attacks).

RASP (Runtime Application Security Protection)

RASP (no Wikipedia page yet) is a much more recent protection method.

What is it? A library or SDK that is embedded inside your application code.

Examples: Sqreen, Prevoty, Checkmarx, Contrast Security, ...

How does it work? RASP modify application runtime behavior (e.g. it will only check for Cross Site Scripting when a page is rendered, not on any incoming HTTP request). It can do everything a WAF can do (since it has as well access to the incoming HTTP request) but it can also use more elaborated algorithms (https://blog.sqreen.io/block-sql-injections-not-customers/) since it has access to the context of any library used by the application. This makes zero false positives.

Inconvenient: RASP cannot protect web applications against Denial of Service attacks.

Jb Aviat
  • 31
  • 1