In the evolving landscape of application security, traditional perimeter defenses are no longer sufficient. Imperva Runtime Application Self-Protection (RASP) represents a paradigm shift by embedding security directly into the application runtime. This article provides a comprehensive guide for Java developers to integrate and leverage Imperva RASP for real-time threat detection and protection.
Understanding Imperva RASP
RASP technology operates within your application runtime environment, providing:
- Real-time threat detection by analyzing application behavior and context
- Zero-day vulnerability protection without relying solely on signatures
- Application-specific security policies tailored to your codebase
- Automatic attack blocking for SQL injection, XSS, path traversal, and other OWASP Top 10 threats
Integration Approaches
Approach 1: Agent-Based Integration (Recommended)
The most common method involves deploying the Imperva RASP agent as a Java agent.
Step 1: Download and Configure the RASP Agent
Download the Imperva RASP agent JAR file from the Imperva support portal and create a configuration file rasp.properties:
# rasp.properties rasp.enable=true rasp.console.log.level=INFO rasp.security.enable=true # Security policies rasp.security.sql.injection.protection=true rasp.security.xss.protection=true rasp.security.path.traversal.protection=true rasp.security.command.injection.protection=true # Blocking mode rasp.security.block.attack=true rasp.security.learning.mode=false # Logging configuration rasp.log.directory=/var/log/imperva/rasp rasp.log.max.size=100MB rasp.log.max.files=10
Step 2: Launch Application with RASP Agent
java -javaagent:/path/to/imperva-rasp-agent.jar \ -Drasp.config.file=/path/to/rasp.properties \ -jar your-application.jar
Approach 2: Programmatic Configuration and Control
For dynamic control, create a configuration manager:
import java.io.*;
import java.util.Properties;
public class RaspConfigManager {
private static final String RASP_CONFIG_PATH = "/etc/imperva/rasp.properties";
private Properties raspProperties;
public RaspConfigManager() {
loadConfiguration();
}
private void loadConfiguration() {
raspProperties = new Properties();
try (InputStream input = new FileInputStream(RASP_CONFIG_PATH)) {
raspProperties.load(input);
} catch (IOException e) {
// Fallback to default configuration
setDefaultConfiguration();
}
}
private void setDefaultConfiguration() {
raspProperties.setProperty("rasp.security.enable", "true");
raspProperties.setProperty("rasp.security.block.attack", "true");
raspProperties.setProperty("rasp.security.sql.injection.protection", "true");
raspProperties.setProperty("rasp.security.xss.protection", "true");
}
public void enableProtection() {
raspProperties.setProperty("rasp.security.enable", "true");
saveConfiguration();
}
public void disableProtection() {
raspProperties.setProperty("rasp.security.enable", "false");
saveConfiguration();
}
public void setLearningMode(boolean enabled) {
raspProperties.setProperty("rasp.security.learning.mode",
Boolean.toString(enabled));
saveConfiguration();
}
private void saveConfiguration() {
try (OutputStream output = new FileOutputStream(RASP_CONFIG_PATH)) {
raspProperties.store(output, "Imperva RASP Configuration");
// Trigger configuration reload
triggerConfigReload();
} catch (IOException e) {
throw new RuntimeException("Failed to save RASP configuration", e);
}
}
private native void triggerConfigReload();
}
Custom Security Event Handling
Step 1: Create a Security Event Listener
import java.util.logging.Logger;
public class RaspSecurityEventListener {
private static final Logger logger =
Logger.getLogger(RaspSecurityEventListener.class.getName());
private final SecurityEventQueue eventQueue;
private final AlertService alertService;
public RaspSecurityEventListener(AlertService alertService) {
this.alertService = alertService;
this.eventQueue = new SecurityEventQueue(1000); // Max 1000 events in queue
startEventProcessor();
}
public void onSecurityEvent(SecurityEvent event) {
// Add event to processing queue
boolean added = eventQueue.offer(event);
if (!added) {
logger.warning("Security event queue full, event dropped: " + event.getType());
}
}
private void startEventProcessor() {
Thread processorThread = new Thread(() -> {
while (!Thread.currentThread().isInterrupted()) {
try {
SecurityEvent event = eventQueue.take();
processSecurityEvent(event);
} catch (InterruptedException e) {
Thread.currentThread().interrupt();
break;
}
}
});
processorThread.setDaemon(true);
processorThread.setName("RASP-Event-Processor");
processorThread.start();
}
private void processSecurityEvent(SecurityEvent event) {
// Log the security event
logger.severe(String.format(
"SECURITY VIOLATION - Type: %s, Severity: %s, Attack: %s, Source: %s",
event.getType(),
event.getSeverity(),
event.getAttackVector(),
event.getSourceIP()
));
// Send alert
alertService.sendSecurityAlert(createAlertFromEvent(event));
// Update security metrics
SecurityMetrics.recordAttack(event.getType(), event.getSeverity());
// Trigger custom response logic
if (event.getSeverity() == SecuritySeverity.CRITICAL) {
triggerIncidentResponse(event);
}
}
private void triggerIncidentResponse(SecurityEvent event) {
// Implement custom incident response
// - Block source IP
// - Revoke sessions
// - Notify SOC team
logger.warning("Triggering incident response for critical event: " + event.getId());
}
}
Step 2: Security Event Data Model
public class SecurityEvent {
private final String id;
private final SecurityEventType type;
private final SecuritySeverity severity;
private final String attackVector;
private final String sourceIP;
private final String userAgent;
private final String endpoint;
private final long timestamp;
private final String applicationId;
private final Map<String, String> context;
public enum SecurityEventType {
SQL_INJECTION,
XSS,
PATH_TRAVERSAL,
COMMAND_INJECTION,
FILE_INCLUSION,
INSECURE_DESERIALIZATION
}
public enum SecuritySeverity {
LOW, MEDIUM, HIGH, CRITICAL
}
// Constructor, getters, and builder pattern
public static class Builder {
private String id;
private SecurityEventType type;
private SecuritySeverity severity;
private String attackVector;
private String sourceIP;
private String userAgent;
private String endpoint;
private long timestamp = System.currentTimeMillis();
private String applicationId;
private Map<String, String> context = new HashMap<>();
public Builder withType(SecurityEventType type) {
this.type = type;
return this;
}
public Builder withSeverity(SecuritySeverity severity) {
this.severity = severity;
return this;
}
public Builder withAttackVector(String attackVector) {
this.attackVector = attackVector;
return this;
}
public Builder withSourceIP(String sourceIP) {
this.sourceIP = sourceIP;
return this;
}
public SecurityEvent build() {
return new SecurityEvent(this);
}
}
}
Spring Boot Integration
Step 1: Spring Boot Configuration
@Configuration
@EnableConfigurationProperties(RaspProperties.class)
public class RaspAutoConfiguration {
private static final Logger logger = LoggerFactory.getLogger(RaspAutoConfiguration.class);
@Bean
@ConditionalOnProperty(name = "imperva.rasp.enabled", havingValue = "true")
public RaspSecurityManager raspSecurityManager(RaspProperties properties) {
logger.info("Initializing Imperva RASP Security Manager");
return new RaspSecurityManager(properties);
}
@Bean
public SecurityEventPublisher securityEventPublisher() {
return new SecurityEventPublisher();
}
}
@ConfigurationProperties(prefix = "imperva.rasp")
public class RaspProperties {
private boolean enabled = true;
private boolean blockAttack = true;
private boolean learningMode = false;
private String logLevel = "INFO";
private String logDirectory = "/var/log/imperva/rasp";
private Security security = new Security();
public static class Security {
private boolean sqlInjectionProtection = true;
private boolean xssProtection = true;
private boolean pathTraversalProtection = true;
private boolean commandInjectionProtection = true;
// Getters and setters
}
// Getters and setters
}
Step 2: Spring Security Integration
@Component
public class RaspSecurityInterceptor implements HandlerInterceptor {
private final RaspSecurityManager securityManager;
private final SecurityEventPublisher eventPublisher;
public RaspSecurityInterceptor(RaspSecurityManager securityManager,
SecurityEventPublisher eventPublisher) {
this.securityManager = securityManager;
this.eventPublisher = eventPublisher;
}
@Override
public boolean preHandle(HttpServletRequest request,
HttpServletResponse response,
Object handler) throws Exception {
// Validate request parameters for attacks
if (securityManager.detectAttack(request)) {
eventPublisher.publishEvent(createSecurityEvent(request));
if (securityManager.isBlockingEnabled()) {
response.sendError(HttpServletResponse.SC_FORBIDDEN, "Request blocked by security policy");
return false;
}
}
return true;
}
private SecurityEvent createSecurityEvent(HttpServletRequest request) {
return new SecurityEvent.Builder()
.withType(SecurityEventType.valueOf(detectAttackType(request)))
.withSeverity(SecuritySeverity.HIGH)
.withSourceIP(request.getRemoteAddr())
.withUserAgent(request.getHeader("User-Agent"))
.withEndpoint(request.getRequestURI())
.withAttackVector(extractAttackVector(request))
.build();
}
}
Monitoring and Metrics
Step 1: Security Metrics Collector
@Component
public class SecurityMetrics {
private static final MeterRegistry meterRegistry = new SimpleMeterRegistry();
private static final Counter sqlInjectionAttempts =
Counter.builder("security.attack.sql_injection")
.description("Number of SQL injection attempts")
.register(meterRegistry);
private static final Counter xssAttempts =
Counter.builder("security.attack.xss")
.description("Number of XSS attempts")
.register(meterRegistry);
private static final DistributionSummary attackResponseTime =
DistributionSummary.builder("security.attack.response_time")
.description("Time taken to respond to attacks")
.register(meterRegistry);
public static void recordAttack(SecurityEventType type, SecuritySeverity severity) {
String attackType = type.name().toLowerCase();
Counter counter = Counter.builder("security.attack")
.tag("type", attackType)
.tag("severity", severity.name().toLowerCase())
.register(meterRegistry);
counter.increment();
}
public static void recordResponseTime(long milliseconds) {
attackResponseTime.record(milliseconds);
}
}
Step 2: Health Check Integration
@Component
public class RaspHealthIndicator implements HealthIndicator {
private final RaspSecurityManager securityManager;
@Override
public Health health() {
if (!securityManager.isEnabled()) {
return Health.down()
.withDetail("rasp", "RASP protection is disabled")
.build();
}
if (!securityManager.isInitialized()) {
return Health.down()
.withDetail("rasp", "RASP not properly initialized")
.build();
}
return Health.up()
.withDetail("rasp", "RASP protection active")
.withDetail("policies", securityManager.getActivePolicies())
.withDetail("blockingMode", securityManager.isBlockingEnabled())
.build();
}
}
Application Configuration
application.yml
imperva: rasp: enabled: true block-attack: true learning-mode: false log-level: INFO log-directory: /var/log/imperva/rasp security: sql-injection-protection: true xss-protection: true path-traversal-protection: true command-injection-protection: true management: endpoints: web: exposure: include: health,metrics,security-events endpoint: health: show-details: always
Testing the Integration
@SpringBootTest
@TestPropertySource(properties = {
"imperva.rasp.enabled=true",
"imperva.rasp.learning-mode=true"
})
public class RaspIntegrationTest {
@Autowired
private RaspSecurityManager securityManager;
@Test
public void testSqlInjectionDetection() {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setParameter("username", "admin' OR '1'='1'--");
request.setRemoteAddr("192.168.1.100");
boolean isAttack = securityManager.detectAttack(request);
assertTrue("SQL injection should be detected", isAttack);
}
@Test
public void testLegitimateRequest() {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setParameter("username", "john.doe");
request.setRemoteAddr("192.168.1.100");
boolean isAttack = securityManager.detectAttack(request);
assertFalse("Legitimate request should not be blocked", isAttack);
}
}
Best Practices
- Start in Learning Mode: Deploy initially in learning mode to understand false positives
- Gradual Rollout: Enable blocking mode gradually across environments
- Comprehensive Monitoring: Implement detailed logging and alerting for security events
- Regular Updates: Keep the RASP agent updated with the latest security policies
- Performance Testing: Conduct load testing with RASP enabled to measure impact
- Custom Policies: Develop application-specific security policies based on your threat model
Conclusion
Integrating Imperva RASP into your Java applications provides a critical layer of runtime security that complements traditional security measures. By embedding protection directly into the application runtime, RASP can detect and prevent attacks that bypass perimeter defenses. The programmatic integration approach outlined here allows for customized security policies, real-time monitoring, and seamless integration with existing Spring Boot applications and security frameworks.
This integration enables organizations to move from reactive security patching to proactive runtime protection, significantly enhancing their application security posture against modern threats.