WAF vs. RASP Security Tools

WAF vs. RASP security tools: a defense in depth approach to application security

In today's threat landscape, web applications are constantly under attack. To defend against these attacks, organizations often rely on Web Application Firewalls (WAFs). However, weekly statistics from Contrast Security highlight the limitations of WAFs and the crucial role of Runtime Application Self Protection (RASP) as a complementary security measure.

What is web application firewall (WAF) technology? 

A web application firewall (WAF) is a network-level security tool designed to filter, monitor, and block HTTP traffic to and from a web application. A WAF differs from a regular firewall, which typically is designed to serve as a safety gate between servers. A web application firewall is able to watch application-level traffic and make decisions to allow or disallow that traffic based on the data that is visible over the network. WAF security typically performs SSL termination to watch decrypted traffic for pattern-matching or volumetric attacks. 

What is runtime application self protection (RASP) technology? 

Runtime Application Self Protection is an application-level security tool that operates from within the application’s runtime environment. It’s designed to monitor and analyze both application behavior and context every time the application is used. By doing so, RASP defense tools control the application execution, detect vulnerabilities, and prevent real-time attacks that exploit vulnerabilities inside that application – without human intervention.

WAFs: the first line of defense

Web Application Firewalls (WAFs) act as a security shield at the perimeter, inspecting incoming traffic for malicious payloads associated with known attack patterns. They offer several advantages:

• Ease of Deployment: WAFs are often deployed at the network level, requiring minimal configuration for existing applications.
• Perimeter Defense: WAFs positioned at the network or cloud perimeter are uniquely positioned to defend against Distributed Denial of Service (DDOS) attacks and known bad actors.
• Centralized Management: Security teams can manage WAF rules from a central location, simplifying security policy enforcement.
• Protection from Common Attacks: WAFs effectively block common attacks like SQL injection and Cross-Site Scripting (XSS) by identifying known attack signatures.

• Limited Context: WAFs rely solely on the content of the request (payload) for analysis, making them vulnerable to attacks that exploit application logic flaws.
• False Positives: Due to their reliance on generic signatures, WAFs can generate false positives, blocking legitimate traffic and disrupting application functionality.
• Vulnerability to Zero-Day Attacks: WAFs are ineffective against new and unknown vulnerabilities (zero-day attacks) until their signatures are added to the WAF rule set.

RASP: deeper protection with runtime analysis

Runtime Application Self Protection (RASP) complements WAFs by providing deeper application security from within. Think of RASP as a zero-friction agent for production applications. It automatically hardens the runtime, the libraries, the open source software, and the app server, mitigating top vulnerability classes and stopping zero-day exploits. 

Here's how RASP technology offers distinct advantages:

• Behavior-Based Detection: RASP monitors application runtime behavior, allowing it to detect and block attacks that manipulate application logic or access unauthorized data, even if the payloads appear benign.
• Zero-Day Protection: RASP's ability to analyze application behavior makes it effective against zero-day attacks, offering protection even before vulnerabilities are publicly known.
• Reduced False Positives: By understanding the application's logic, RASP can differentiate between malicious and legitimate behavior, minimizing false positives compared to WAFs.

However, RASP technology also presents some challenges:

• Deployment Complexity: Integrating RASP with existing applications can be more complex than deploying a WAF.

Potential Performance Impact: RASP's runtime monitoring can introduce some overhead, requiring careful optimization to avoid impacting application performance. However, Contrast Security’s statistics have shown that more than 80% of all requests going through Contrast Protect (Contrast’s RASP) are treated in less than 0.5 milliseconds. At least 96% are treated within less than a single-digit milliseconds delay, making RASP just as fast, if not faster, than equivalent WAF treatment times.

The power of combining WAF and RASP for application security

The Contrast Security statistics highlight a critical point: over 180,000 attacks bypass WAFs every week but are successfully blocked by the Contrast Protect RASP*. This demonstrates the limitations of relying solely on WAFs.

By combining WAFs with RASP, organizations can achieve a layered defense:

• WAFs act as the first line of defense, blocking very obvious and common attacks and preventing malicious traffic from reaching the application.
• RASP provides deeper inspection as it can see how input values are being transformed by the application, where these values are being used, and whether they hit a vulnerable part of an application, thus providing protection from logic flaws, zero-day attacks, and data breaches that might bypass a WAF.

This layered approach offers several benefits:

• Comprehensive Security: Addresses a wider range of threats, including both known and unknown vulnerabilities.
• Reduced Risk: Minimizes the attack surface and potential damage from breaches.
• Improved Efficiency: WAFs can be configured to handle only common attacks and to let other traffic flow through without spending time on analysis. This frees up time for RASP to focus on more complex threats, as RASP usually takes less time for analyzing such attacks as it sees what happens and does not have to rely on probability analysis or guesswork like a WAF would.

Example: understanding deserialization attacks, WAF limitations, and how Contrast Security’s RASP does it better

Deserialization attacks exploit a fundamental process within many applications. Applications often serialize data – converting objects into a format suitable for storage or transmission. Later, this data is deserialized back into objects for use by the application. Attackers can craft malicious payloads that, when deserialized, trigger unexpected or harmful actions within the application.

• The Challenge for WAFs: WAFs primarily analyze the content of incoming requests. They might spot an unusually structured data payload but often lack the context to understand how an application will process that data during deserialization. This means attacks that exploit application logic flaws in the deserialization process can slip through a WAF's defenses.
• Real-World Example: An attacker might craft a payload that, when deserialized, executes arbitrary code on the server (remote code execution). A WAF, analyzing the payload itself, might see nothing inherently malicious. It wouldn't understand that the deserialization process would lead to the dangerous execution of attacker-supplied code.

Understanding the nature of a serialized object is only possible within the application. Only there the content is revealed and can be analyzed based on its true nature and its usage by the application. The instrumentation-based approach provides key benefits:

• Runtime Insight: RASP like Contrast Protect operates within the application, monitoring its behavior at runtime. During deserialization, it observes how the data is processed – where it flows within the application and what actions it influences.
• Behavioral Anomaly Detection: If the deserialized data triggers suspicious or unexpected actions, Contrast Protect recognizes these as potential attacks, blocking the request from causing further harm, and alerting security teams.
• Clean Exception Handling: Contrast Protect can neatly integrate with the application's error handling. If an attack is detected, it generates an exception, just like the application would for invalid input. This smoothly halts the abnormal usage, allowing the application to respond gracefully.

The Log4Shell example

The widespread Log4Shell vulnerability (2021) was a prime example. Attackers exploited a weakness in the popular logging library to inject malicious payloads that could take control of systems.

Until specific signatures were released, WAFs had little chance of stopping Log4Shell attacks. In comparison, Contrast Protect had defenses in place since 2018. Its data flow analysis capabilities allowed it to identify the abnormal Log4Shell payload behavior during execution, preventing exploitation even before the vulnerability became public knowledge.

Conclusion

While WAFs remain a valuable security tool, RASP offers a complementary and increasingly necessary layer of protection by analyzing application behavior at runtime. By combining WAF and RASP, organizations can achieve a more comprehensive and future-proof application security posture, significantly reducing the risk of successful cyberattacks.

* the source of the data are Contrast Security’s SaaS environments, additional blocked attacks are reported to on-premise-based, customer-hosted servers which are excluded from these statistics