The appropriate response depends on impact. Account revocation, transaction restrictions, key rotation and user support serve different purposes.
Evaluation approach
Identify affected releases and operations. Manage containment, evidence preservation and recovery separately. Keep user messages consistent with technical decisions.
Application example
Restrict requests from modified packages while confirming access for legitimate store releases.
Limits and considerations
Stopping all traffic is not a proportionate response to every event.
Contain losses while preserving evidence
Restrict affected sessions or operations, retain necessary evidence and keep service running safely where possible. Define response authority in advance.
Changing a RASP rule may be only part of the solution. Server vulnerabilities, account compromise or supplier problems need separate actions. Post-incident review should show the effects of decisions and the remaining risk.
Checks and decisions
- Contain impact
- Preserve evidence
- Test recovery
Measure success through controlled risk and user impact, not merely a silent alarm.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.