Sandboxing - CyberHoot Cyber Library

Sandboxing is a cybersecurity term relating to various techniques used to protect your network and computing infrastructure from compromise by malicious software (aka: Malware).

In one method, sandboxing provides a special hardened operating environment for 3rd party applications to execute in which is isolated from critical system resources and programs. In another method, email SPAM protection solutions open attachments using “Attachment Sandbox”, and watch for malicious behaviors, before allowing the attachment through to an employee’s inbox.

Sandboxing, whether used to protect your Operating System or your email, provides another layer of security that can prevent some malware from entering your business and harming you. But be forewarned, in the case of Email Sandboxes, hackers know these solutions exist and have built in evasion techniques to hide from SPAM sandboxing constraints!

Source: TechTerms

Related Terms: Administrator Rights, Least Privilege, Malware

What does this mean for an SMB?

SMB owners who question whether to adopt Sandboxing techniques for email protection should ask whether their SPAM solution supports this. If its available, enable it. Don’t have a SPAM solution protecting you? That’s not good, you need one…so get one. With respect to Sandboxing, it never hurts to inspect attachments before they get through to your email users with a Sandboxing solution.

For application Sandboxing, there’s not much for an SMB to do because application sandboxing is controlled and implemented by the application vendors themselves. All you can do is ask your vendors about what application assessments they are performing and monitor for critical vulnerabilities in their applications.

No solution is 100% full-proof which is why you should also provide awareness training to your staff to spot and avoid malicious attachments they might receive in phishing campaigns. Many times, the attachment is only available behind a Google Drive or Microsoft SharePoint login site so there is nothing to inspect in a sandbox. However, when your users provide their credentials to access the file, they are likely giving their credentials to the hackers via a fake website setup to harvest credentials!