Integrating Self-Protection into DevSecOps Framework for Defense Against Threat

As web applications increasingly support critical digital services, ensuring robust and adaptive security has become essential. Traditional security approaches such as firewalls, Static Application Security Testing (SAST), and Dynamic Application Security Testing (DAST) often fall short in protecting modern, cloud-native, and containerized infrastructures. This study proposes and evaluates an integrated DevSecOps framework that incorporates Runtime Application Self-Protection (RASP) to enhance real-time vulnerability detection and response capabilities. An experimental-comparative design was implemented using a custom Node.js application deployed in a CI/CD pipeline with GitLab, SonarQube, OWASP ZAP, and Datadog as the RASP solution. The research compares two configurations: one with SAST and DAST only, and another with the addition of RASP. Results show that the RASP-enabled pipeline achieved higher recall (0.625 vs. 0.400), improved F1-score (0.769 vs. 0.571), and significantly reduced high-risk vulnerabilities, such as SQL Injection, from 11 to 1 instance. Moreover, the RASP-enabled system was able to respond to threats within 129 milliseconds, while the baseline system had no runtime response capability. These findings confirm that integrating RASP into a DevSecOps pipeline enhances detection accuracy, reduces false negatives, and enables proactive, real-time defense without compromising development agility. The proposed framework aligns with national cybersecurity strategies and offers a practical solution for strengthening application security in enterprise environments.