Comparing WAF and RASP, Why?

The talk opens with how much of a modern application is custom code versus third-party components, and why application security struggles to keep pace with the volume of software being written. It then covers web application firewalls, a layer seven control that inspects traffic and blocks suspicious patterns without knowing the application's context. The speaker explains how regex-driven rules produce false positives, need constant tuning, and can be bypassed through encoding and SQL comment tricks, using the recent Confluence OGNL injection as an example.

The talk then turns to runtime application self-protection, which runs inside the application through instrumentation. By tracking untrusted input from its source to sensitive sinks, it can tell whether a query's structure has changed and block only when intent is altered, which keeps alert volume low. The speaker also covers the trade-offs: performance overhead, dependence on specific languages and frameworks, installation by a different team, and application restarts when fixes ship. Payload-list testing is criticized as a poor basis for comparing the two.

The closing argument is that the two technologies complement each other rather than compete, much like seat belts and airbags. A WAF handles things such as DDoS protection and broad perimeter patching, while RASP provides context-aware blocking inside the app. Attendees are encouraged to use both where possible, and the Equifax breach is cited as an example of the gap a faster, layered response could have closed.