<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-runtime-application-security
description: >-
  Deploy Runtime Application Self-Protection (RASP) and Web Application Firewalls
  (WAF) to detect and block attacks in production. Configure OWASP ModSecurity CRS,
  Falco runtime monitoring, and application-level security middleware.
domain: cybersecurity
subdomain: devsecops
tags:
  - rasp
  - waf
  - modsecurity
  - falco
  - runtime-protection
  - middleware
  - intrusion-detection
  - production-security
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Implementing Runtime Application Security

## Overview

Runtime application security detects and blocks attacks during execution through
WAFs, RASP agents, and security middleware. This skill covers deploying ModSecurity
with OWASP CRS, Falco for container runtime monitoring, and application-level
middleware for rate limiting, request validation, and anomaly detection.

Mode: `[MODE: BLUE]` — Production security through runtime detection and prevention.

## Prerequisites

| Requirement | Details |
|---|---|
| NGINX or Apache with ModSecurity module | Required |
| Falco for container/Kubernetes runtime monitoring | Required |
| Application framework (Express, Flask, Django, Spring) | Required |
| Prometheus/Grafana for security metrics | Required |

## Key Concepts

### ModSecurity with OWASP CRS

```nginx
# nginx.conf — ModSecurity integration
load_module modules/ngx_http_modsecurity_module.so;

http {
    modsecurity on;
    modsecurity_rules_file /etc/modsecurity/modsecurity.conf;

    server {
        listen 443 ssl;
        location / {
            modsecurity_rules '
                SecRule ARGS "@detectSQLi" "id:1001,phase:2,deny,status:403,msg:SQL Injection"
                SecRule ARGS "@detectXSS" "id:1002,phase:2,deny,status:403,msg:XSS Attack"
            ';
            proxy_pass http://app:8080;
        }
    }
}
```

### Falco Runtime Rules

```yaml
# falco_rules.yaml
- rule: Detect Shell in Container
  desc: Alert when a shell is spawned inside a container
  condition: >
    spawned_process and container and
    proc.name in (bash, sh, zsh, dash, ash) and
    not proc.pname in (cron, supervisord)
  output: >
    Shell spawned in container (user=%user.name container=%container.name
    shell=%proc.name parent=%proc.pname command=%proc.cmdline)
  priority: WARNING
  tags: [container, shell, mitre_execution]

- rule: Sensitive File Access
  desc: Detect read of sensitive files
  condition: >
    open_read and container and
    fd.name in (/etc/shadow, /etc/passwd, /proc/self/environ)
  output: >
    Sensitive file read (user=%user.name file=%fd.name container=%container.name)
  priority: CRITICAL
  tags: [container, filesystem, mitre_credential_access]
```

### Express.js Security Middleware

```javascript
// middleware/security.js
const rateLimit = require('express-rate-limit');
const helmet = require('helmet');

const securityMiddleware = (app) => {
  app.use(helmet());
  app.use(helmet.contentSecurityPolicy({
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'"],
      styleSrc: ["'self'", "'unsafe-inline'"],
      imgSrc: ["'self'", "data:"],
      connectSrc: ["'self'"],
      frameSrc: ["'none'"],
    }
  }));

  app.use('/api/', rateLimit({
    windowMs: 15 * 60 * 1000,
    max: 100,
    standardHeaders: true,
    legacyHeaders: false,
    message: { error: 'Too many requests' },
  }));

  app.use('/api/auth/', rateLimit({
    windowMs: 15 * 60 * 1000,
    max: 5,
    message: { error: 'Too many authentication attempts' },
  }));
};
```

### Falco in Kubernetes

```yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: falco
  namespace: security
spec:
  selector:
    matchLabels:
      app: falco
  template:
    spec:
      containers:
        - name: falco
          image: falcosecurity/falco:0.38.0
          securityContext:
            privileged: true
          volumeMounts:
            - name: proc
              mountPath: /host/proc
              readOnly: true
            - name: rules
              mountPath: /etc/falco/rules.d
      volumes:
        - name: proc
          hostPath:
            path: /proc
        - name: rules
          configMap:
            name: falco-custom-rules
```

## Workflow

### Step 1: Analyze Runtime Configuration

```bash
node scripts/agent.js --action analyze --config-dir /etc/modsecurity/ --output /tmp/runtime-analysis.json
```

### Step 2: Generate WAF Rules

```bash
node scripts/agent.js --action rules --app-type web --output /tmp/waf-rules.json
```

### Step 3: Check Security Headers

```bash
node scripts/agent.js --action headers --url http://localhost:8080 --output /tmp/headers.json
```

## Detection

```yaml
title: Runtime Application Security Detection
id: fdc0be29-6afc-4f48-87af-aa856606ed42
status: experimental
description: Detects suspicious activity related to implementing runtime application security techniques in devsecops context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*implementing*runtime*"
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.execution
falsepositives:
  - CI/CD pipeline executing authorized security scanning tools
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Runtime Application Security Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1190 |

## Verification

- [ ] WAF deployed in front of all public-facing applications
- [ ] OWASP CRS rules enabled and tuned
- [ ] Falco monitoring container runtime behavior
- [ ] Rate limiting enforced on authentication endpoints
- [ ] Security headers (CSP, HSTS, X-Frame-Options) present
- [ ] WAF alerts integrated into SIEM

## References

- [ModSecurity Reference Manual](https://github.com/owasp-modsecurity/ModSecurity/wiki)
- [OWASP CRS](https://coreruleset.org/)
- [Falco Documentation](https://falco.org/docs/)
- [Helmet.js](https://helmetjs.github.io/)
