This document discusses Runtime Application Self-Protection (RASP) technology provided by Waratek Ltd. It summarizes that RASP allows applications to protect themselves at runtime without code changes. Waratek provides RASP for Java applications by running them in a protected container that isolates the application from vulnerabilities in the Java runtime environment and APIs. This allows for legacy applications and Java versions to be protected without updates.

1. © Copyright 2016
Copyright 2016 Waratek Ltd
Can you improve your application availability
and provide accurate, fast remediation of
security vulnerabilities?

2. © Copyright 2016
“More Secure Application Coding”
Cannot Solve the Problem!
• We can’t rely on developers to write secure code
• Even if they do write, perfect, secure code, YOUR developers are only
responsible for < 20% of the code that you actually run
• Large enterprises can identify far more vulnerabilities than they can
actually fix. Tens of Thousands of vulnerabilities reported by SAST/
DAST is not atypical in a large enterprise
• Patching and updating everything is often wholly unrealistic

3. © Copyright 2016
Runtime Application Self-Protection (RASP)
“Modern security fails to test and protect
all apps. Therefore, apps must be capable
of security self-testing, self-diagnostics and
self-protection. It should be a CISO top
priority.”
Stop Protecting Your Apps; It's Time for Them
to Protect Themselves - September 2014

4. © Copyright 2016
Runtime Application Self-Protection (RASP)
“We need to look at new technologies
which enable applications to defend
themselves, known as Runtime
Application Self Protection.”
“Investment in RASP should be prioritized
over the $12bn per annum spent on WAF,
NGFW, IPS.”

5. © Copyright 2016
Runtime Application Self Protection
Gartner rate RASP
as transformational
and place it at the
top of their priority
matrix.
benefit years to mainstream adoption
less than 2 years 2 to 5 years 5 to 10 years more than 10 years
transformational Runtime Application Self-
Protection
high Dynamic Application Security
Testing
Fraud Detection
Mobile Data Protection for
Workstations
Static Application Security Testing
Static Data Masking
Application Security as a Service
Cloud Access Security Brokers
Database Audit and Protection
Interactive Application Security
Testing
Mediated APIs
Mobile Application Security
Testing
SOA Testing
User and Entity Behavior
Analytics
DevSecOps
moderate Application Control
Enterprise Mobile App Stores
SIEM
Tokenization
Application Obfuscation
Application Security Professional
Services
Application Shielding
Dynamic Data Masking
Mobile Threat Defense
Protected Mobile Browsers
Software Composition Analysis
Web Application Firewalls
Application Vulnerability
Correlation
Crowdsourced Security Testing
Platforms
Format Preserving Encryption
Mobile Application Hardening
low
Source: Gartner Hype Cycle for Application Security, July 2016
Priority Matrix for Application Security

6. © Copyright 2016
Java highest area of concern
SANS State of application security 2015
SANS State of
application
security 2015
”… risks arise because these
languages are the ones
commonly used to build big,
feature-rich, business-critical
applications with a lot of
valuable code, especially
legacy code written by
developers who didn’t
understand secure
development—code that is
exposed to attack.”

7. Custom Business Logic
(WARs, EJBs, JARs)
3rd Party Libraries
Servers, Frameworks
(JEE)
Java APIs
(JRE)
Most application code (> 80%)
comes from outside the
enterprise with known and
unknown flaws

8. Custom Business Logic
(WARs, EJBs, JARs)
3rd Party Libraries
Servers, Frameworks
(JEE)
Java APIs
(JRE)
Waratek RASP protects
all layers of the
application stack
• Waratek provides Runtime Application Self-
Protection technology for Java applications
built on top of the Oracle JVM
• A Java Container is a protected in-JVM
container with built in application security
and quarantine controls
Waratek RASP

9. © Copyright 2016
Java RASP Containers
• The Java container separates apart the
vulnerable JRE code (where the insecure
Java APIs reside) from the low-level JVM
(the JIT compiler and GC)
• Application security controls inserted
between the Java Container and the JVM
protect and quarantine the Java application
Java RASP Container
Application Security Controls
Oracle JVM
Vulnerable JRE

10. © Copyright 2016
Java RASP Containers
• Application vulnerabilities: SQLi, XSS, CSRF, code injection etc.
• Legacy applications and runtimes
• Hardening
• No code changes
• No third-party APIs
• No appliances
• Simple, minimal configuration
• Accurate
• Fast
Implementation & remediation time:
< 30 minutes per App Instance on average
Java RASP Container
Application Security Controls
Oracle JVM
Vulnerable JRE

11. © Copyright 2016
Legacy Java
• Most enterprises have large
numbers of applications running
on older, legacy Java versions.
• Updating these apps to the
current Java edition is often
risky, time consuming, and
expensive.
19%!
1%!
5%!
13%!
46%!
10%!
6%!
Java versions detected through
enterprise endpoints
Other
Java 3.x
Java 4.x
Java 5.x
Java SE 6
Java SE 7
Java SE 8

12. © Copyright 2016
Java RASP Containers
• Java RASP Containers provide automatic protection for
legacy Java applications:
• No changes to the application or vulnerable JRE:
• The application does not see an API change.
• Deprecated calls still function.
• Serialized objects still function.
• The application is still using the API it was first tested against.
• Overnight compliance for legacy applications:
• Administration is on an up-to-date SUPPORTED JVM (because
the JRE and JVM can now be managed separately).
• The surrounding infrastructure can be updated.
Java SE 5 Application
Java SE 5 Container
Java SE 7/8 JVM
Network
Java SE 5 Exploit
App Sec Controls
Java SE 5 JRE

13. © Copyright 2016
Zero false positive SQL Injection
• Java Containers perform runtime data-tainting (“taint-tracking”) without any changes to application
code.
• Data-tainting, in real-time, marks as “untrusted” all user-input data to a Java app (like HTTP request
parameters).
• When “untrusted” user-input data is passed to an SQL query, tainted syntactic analysis is performed
to accurately and reliably detect SQL injection.
• When SQL injection is detected, the Java Container gracefully rejects the unsafe SQL query and the
application continues un-exploited.
• Zero code changes
• Zero regex
• Zero tuning
• Zero false positives
• Zero human intervention
Waratek is the industry’s first
non-heuristic code injection
detection technology!

14. © Copyright 2016
SQL Injection rule
# Example file rules!
file:read:/etc/:deny:warn!
file:read:/etc/passwd:allow:warn!
file:exec:*:deny:warn!
!
# Example network rules!
network:connect:www.google.com::deny:warn
network:accept:localhost::deny:warn!
!
# SQL injection mitigation for Oracle PL/SQL
sqli:database:oracle:deny:warn!
!
!
Zero Regex!
Zero tuning!
Zero false positives!
Zero human intervention!

15. © Copyright 2016
How We’re Different
• Waratek is the only RASP product based on virtualization technology and the
only technology that can protect legacy Java workloads to achieve equivalent
protection to critical patch updates
• Virtualization allows us to create a “secure container” that encapsulates ALL
layers of the Java application stack
• Only RASP solution deployed at scale rather than on individual apps
• Competitors use “filter” or “instrumentation” approaches that have significant
deficiencies:
• Prone to the same lack of accuracy as Web Application Firewalls
• Impacts performance
• Offers some protection at the business logic level ONLY
• Filters/agents are potentially susceptible to direct exploitation

16. © Copyright 2016
Waratek RASP Differentiation
• No code changes, no third party APIs, no appliances
• Entirely in process
• Visibility of entire application stack including JRE APIs, components, app
servers
• Non-heuristic remediation for SQLi i.e. no regex tuning, no signatures
required
• JRE and JVM lockdown
• Legacy Java hardening
• Virtual patching with no down time or interruption of service
• Re-host old/unsupported JREs on up-to-date JVMs transparently
• No user discernable performance impact

17. © Copyright 2016
Protection Without Compromise
Benefits Current Approach Waratek
Defends Against Attacks in Business Logic ✔ ✔
Defends Against Attacks in Full Software Stack ✔
Protects Vulnerable Legacy Java Applications without Code Changes ✔
Zero False Positives ✔
No Application Code Changes Required ✔
No Prior Knowledge of Application Behavior Required ✔
No Additional Servers, Sensors or Other Hardware Devices ✔
Detailed Application Level Forensic Data ✔
No Capital Expenditure Required ✔

18. © Copyright 2016
Waratek History
Developed a new category of
application security based on
containerization – Runtime
Application Self-Protection (RASP)
Founded as a technology research
organization in 2002; Commercial
security product released in 2014
60 global patents; 39 in the US
Dublin & Atlanta Headquarters
30 employees globally