So You Are Comparing RASP and WAF?
Channel: BSidesKC
Date: 2021-11-03

One thing that you learn in the technology space is that change is constant. Companies, solutions, and people who sit on their laurels can find themselves in a position of never-ending catch up. For security operations and application security professionals who rely exclusively on web application firewalls (WAFs) or runtime application security protection (RASP), this talk should open your eyes to better understanding gaps. Tethered to traditional signature-based security approaches, WAFs simply aren't able to keep pace with the changes in the advanced threat landscape. But at the same time, RASP does not provide some of the same bot and DDoS protections that a WAF may provide. And yet, application security professionals are still directly comparing a WAF and RASP as to use one or the other, which is like comparing virus protection and endpoint detection and response (EDR). Join David in this talk as he explains the similarities and differences between a WAF and RASP. David will discuss things such as vulnerability deferment, bot detections, antiquated application protections, IP blocking, alert fatigue, etc. David will also dig in to how WAF and RASP should work harmoniously and why you should be utilizing the strengths and benefits of each in your overall application security protection scheme.
David Lindner
(Director, Application Security at Contrast Security)

David Lindner is the Director, Application Security at Contrast Security. David is an experienced Application Security Professional with over 18 years of experience in the computer security industry. During this time, David has worked within multiple disciplines in the security field, from application development, network architecture design and support, IT security and consulting, security training, and application security. Over the past 10 years, David has specialized in all things related to mobile applications and securing them. David has supported many​ different clients including financial, government, automobile, healthcare, and retail. In his spare time, David is seen on the golf course or honing his mobile testing skills by participating in numerous bug bounties.