Sandboxing is used to separate applications from secure resources.
The idea is to let an application run in a secluded zone that cannot reach other systems.
It can be implemented as a means to test new software or even to study the behavior of a malicious program.
A lot of security products actually use sandboxing to identify if a program is a threat strictly based
on behavioral indicators.
So if I have a program running in a sandbox environment that is constantly scanning networks and running
oddly then it is likely that the program is malicious and should not be allowed on the network.
Let's take a look at how Cisco amp uses a sandbox environment to analyze files.
Here I am in the Cisco amp for endpoints portal one of my favorite features of the portal is the file
analysis page on this page you can actually upload files that you're unsure of.
And Cisco will run the file within a sandbox environment and you can even watch a video of what happened
when the file launched on a PC in the sandbox environment.
So I do have a file that is suspicious to me an For I run it in a production environment.
I'm going to submit it to the file analysis page here and we're going to see if the sandbox environment
determines if this file is good or bad.
I upload my file and then once it finishes running the file in the sandbox environment will look at
the report for the file to see if it's malicious or not.
OK so it looks like the sandbox environment finished analyzing this file we uploaded it is rad which
tells me that it has been identified as being a malicious file.
I'll click on the report here.
And we get a nice report on the behavioral indicators that were found when this file was ran in a safe
sandbox environment and it looks like this definitely is a malicious file.
That shows that it's been flagged as a known Trojan.
So fortunately by utilizing a sandbox environment I was able to determine that the file was malicious
before it was launched on my network.
In addition to now Rick sandboxing there's also what's called system based sandboxing some system based
sandboxing implementations are available like Google chromium and HVM L5 these methods of sandboxing
introduce an entire layer of security around web browsers to protect connections to Web sites each time
a new web browser tab is opened a new process is created in its own sandbox.
So even if you were to accidentally go to a malware site the malicious data would be contained within
the source browser tab and would not have access to other web pages or the local system.