A web application firewall (WAF) is a hardware appliance, virtual appliance or cloud-based service that resides in front or before the web-facing applications to detect and protect against a variety of malicious attacks. A WAF is focused on web application traffic (HTTP/S) and protects applications in internet-facing zones of the network.
A WAF can use many techniques to understand whether traffic should be allowed to pass through to an application or should be blocked, including behavioral algorithms (machine learning and a positive security model) or a negative security model.
Lastly, WAFs are transitioning from standalone tools into fully-integrated Web Application and API Protection (WAAP) offerings that include a suite of capabilities, including protecting APIs, bot management and mitigation capabilities, application Layer 7 DDoS protection, web application security, and more.
Runtime application self-protection (RASP) is an agent or linked library that secures an individual application in real time. RASP tools and libraries become part of the application and must be run as part of the application runtime, thus affecting application initialization overhead and application performance.
Transitioning from a traditional WAF to WAAP and augmenting your application security posture with RASP is the recommended best practice for most organizations. This protects individual applications from certain threats using RASP while protecting all web-facing applications using a WAF or WAAP.
Typically a WAF/WAAP is the primary defense before a cyberthreat can reach an application. A RASP and application coding will protect an application if a cyberthreat reaches the application.
Depending on how a WAF or WAAP is developed and its capabilities, WAF and WAAP may also include many of the RASP functionalities or use RASP libraries themselves.
Comparison Table: WAF vs RASP
| |
WAF |
RASP |
| Focus |
Web applications |
Individual application |
| How it works |
Inline or out-of-path traffic scan of traffic to APIs and applications |
Realtime traffic from within an application |
| Protection |
Both behavioral and static across many web applications |
Heuristic and static checks for input data |
| Deployment |
Standalone in a hybrid topology |
Co-located or as a linked library with the protected application |
| Visibility and logs |
Across applications |
For a specific application |
Additional Resources