RASP (runtime application self-protection)
Also known as: RASP, runtime application self-protection, mobile RASP
Definition
Runtime application self-protection (RASP) is security built into a mobile app that checks, while the app runs, whether the device, the app code and its connections can be trusted, and blocks, limits or reports the session when it detects rooting, tampering, debugging or a hostile network.
More about RASP
OWASP's Mobile Application Security Verification Standard lists RASP alongside code obfuscation, anti-debugging and anti-tampering as defence-in-depth measures that can increase an app's resilience against reverse engineering and specific client-side attacks [1].
OWASP also notes that the absence of these measures does not in itself constitute a vulnerability [1]. RASP adds to secure design and server-side validation rather than replacing them.
How this relates to LCode Technologies
LCode Technologies' D-Secure provides RASP for banking apps across five layers: application binary, network connectivity, transport, authentication and storage.
Frequently asked questions
Is RASP the same as app shielding?
Not exactly. RASP is runtime detection and response inside the app. App shielding is a broader vendor term that usually combines RASP with code obfuscation and anti-tampering.
Does RBI require RASP for banking apps?
RBI's Digital Payment Security Controls Directions list mobile app controls such as device binding and code obfuscation, but do not mandate RASP by name, and checking for rooted or jailbroken devices is optional. Banks should read the Directions for their own category.
Related reading
Sources
- MASVS-RESILIENCE: Resilience Against Reverse Engineering and Tampering — OWASP Mobile Application Security