Building a WRAP | an Interdependent Runtime Protection(or runtime application self-protection / RASP) | Web Application Firewall(WAF) Solution

Today while I was sitting in the waiting room at a local Urgent Care office trying to figure out the root cause of the sudden onset of hyper-salivation…my attention deficit disorder kicks in before I realized I didn’t take my ADD meds yet, and I start to seriously return my thoughts to building a runtime application self-protection (RASP), system for the most popular runtimes/web apps that works interdependently with a WAF to provide protection, control risks, prevent zero days, and highly valuable threat intelligence…thinking it could be abbreviated to WRAP (Web & Runtime Application Protection) and here’s the plan so far:

Building a web and runtime application self-protection (RASP) product that supports multiple programming languages (Java, .NET, Python, Node.js, Golang, Rust, Ruby, PHP, C, C++) and can work interdependently with a web application firewall (WAF) to protect against OWASP Top 10 risks is an exceptionally complex and ambitious undertaking. Such a project requires extensive expertise in various programming languages, runtime environments, security principles, and integration technologies. Here are the high-level steps involved in building such a comprehensive RASP/WAF/WRAP (Web & Runtime Application Protection) solution:

**Note:** This is a highly specialized project that requires a team of experienced security experts and software developers with expertise in multiple programming languages.

### Steps to Build a Multi-Language RASP/WAF/WRAP (Web & Runtime Application Protection) Integrated Solution:

1. **Define Objectives and Requirements:**

   - Determine the specific OWASP Top 10 risks you want to mitigate with your multi-language RASP/WAF/WRAP (Web & Runtime Application Protection) solution.

   - Define the high-level requirements for your solution, including supported programming languages, integration methods, and threat intelligence gathering mechanisms.

2. **Market Research and Competitive Analysis:**

   - Research existing RASP and WAF solutions to understand their capabilities and limitations.

   - Identify opportunities for innovation and differentiation in the market with a WRAP (Web & Runtime Application Protection) solution.

3. **Build a Multidisciplinary Team:**

   - Assemble a team of skilled software developers, security experts, and experts in each of the supported programming languages.

4. **Understand Web Application Security:**

   - Gain a deep understanding of web application security principles, including OWASP Top 10 vulnerabilities.

   - Study the OWASP Top 10 and understand how each risk can be mitigated at runtime for each supported language.

5. **Design RASP Features:**

   - Develop a detailed design for the RASP features that will protect applications from OWASP Top 10 risks in each supported language. Consider techniques such as input validation, output encoding, authentication and authorization controls, and security logging.

   - Plan how the RASP module will integrate with applications in each language and the data it will gather for threat intelligence.

6. **Design WAF Features:**

   - Develop a design for the WAF features that will protect applications at the network level.

   - Define how the WAF will interact with the RASP modules for each supported language to share threat intelligence.

7. **Implement RASP Features for Each Language:**

   - Start implementing the RASP features for each supported language based on your respective designs. This may involve writing custom code, creating agents, or modifying the runtime environments to inject security controls.

   - Integrate security checks, monitoring mechanisms, and anomaly detection for each language to identify and respond to security threats.

8. **Implement WAF Features:**

   - Implement the WAF features according to your design. These features should include request filtering, rate limiting, and intrusion detection.

   - Enable the WAF to communicate with the RASP modules for each language to share threat intelligence and alerts.

9. **Testing and Quality Assurance:**

   - Use state of the art DevSecOps architecture and processes to Rigorously test your multi-language WRAP (Web & Runtime Application Protection)/RASP/WAF solution to ensure it effectively mitigates OWASP Top 10 risks for each supported language without introducing new vulnerabilities.

   - Perform security testing, including Static Application Security(SAST), Dynamic Application Security Testing(DAST), Open Source Software(OSS)/Software Composition Analysis(SCA), Interactive Application Security Testing (IAST) & Infrustructure as code(IAC)/Infrustructure Security Testing combined with automated and manual penetration testing to ensure full coverage of available data path and route coverage integrity and security, comprehensive solution architecture and implementation integrity testing and for each language module in the WRAP (Web & Runtime Application Protection) solution, and WRAP the WRAP in production.

10. **Documentation and User Guides:**

    - Create comprehensive documentation and user guides for your multi-language RASP/WAF/WRAP (Web & Runtime Application Protection) solution. Provide language-specific instructions for integration and configuration.

11. **Licensing and Distribution:**

    - Implement a licensing system to control access to your RASP/WAF/WRAP (Web & Runtime Application Protection) product.

    - Decide on a multi-distribution model, including a downloadable on premise supported software packaged solution, a cloud-based SaaS service with agents, and an integrated solution with popular web servers and application platforms.

12. **Support and Maintenance:**

    - Establish a support and maintenance plan to address customer inquiries, bug fixes, and updates as new security threats emerge for each supported language.

13. **Marketing and Sales:**

    - Develop a marketing strategy to promote your multi-language RASP/WAF/WRAP (Web & Runtime Application Protection) solution.

    - Create a sales plan and identify potential customers, partners, and integrators.

14. **Compliance and Certifications:**

    - Depending on your target market, consider obtaining relevant certifications or compliance certifications for the WRAP (Web & Runtime Application Protection) solution and for each supported language runtime component to enhance the product's credibility.

15. **Feedback and Iteration:**

    - Continuously gather feedback from users and security experts to improve your multi-language RASP/WAF/WRAP (Web & Runtime Application Protection) solution for each supported language.

    - Stay updated on new security threats and adapt the WRAP (Web & Runtime Application Protection)solution accordingly.

Building an integrated RASP/WAF or WRAP (Web & Runtime Application Protection) solution that supports multiple programming languages and provides comprehensive protection against OWASP Top 10 risks is an ambitious and challenging endeavor. It requires a deep understanding of web application security, various programming languages, runtime environments, and security integration across multiple technology stacks. Collaboration with experts in the field and a commitment to ongoing improvement are essential for success in this space.

At this time the medical professionals say I don’t have Covid-19, no strep throat, and the root cause of hyper-salivation is undetermined yet. They did suggest I eat some crackers and I might have a cold. Well that’s a WRAP for this post today:)

Thanks for reading and please contact us if you have any feedback|feedforward or if you are interested in helping build a WRAP (Web & Runtime Application Protection) solution with us