RASP
Runtime application self-protection
Instrumentation inside a running application that detects and blocks attacks using the application’s own context, such as an injected query reaching the database driver (NIST SP 800-53 control SI-7(17)). It is a runtime mitigation, not a fix for the flaw.
Covered in
Guide
Operate edge rules without hiding application defects
Tune WAF and abuse controls against legitimate traffic, parser behavior and measurable business effects.
Guide
Map PCI DSS Requirement 6 to engineering practice and evidence
Turn PCI DSS v4.0.1 Requirement 6 into engineering work: secure development, review, patching, web-attack protection, payment-page script control and change management, with the records an assessor samples and the parts that became mandatory on 31 March 2025.
Practice: Local project: Repair a real proxy and shared cache