Is Sandboxing technology the answer?

Malware APT trends and tecnologies

Most of the security solutions in the market those days leverage sandboxing technologies to deal with Advanced Persistent Threats,  “0”days vulnerability, target attack and so on.

It would be interesting to analyze the good and the limits of this kind of technologies to be able to better choose our security solutions.

What is a Sandbox?

sandboxing means to create a “virtual”, “fake” image that can be targeted by malware attackers o unknown security problems.

Monitoring the change that happen to this decoy it is possible to understand if something strange is going on. The idea basically is that since the fake machine should perform just a serie of deterministic actions anything that goes out of the baseline is something that require further investigation.

So configuration changes to files or registry, unwanted external communications, different memory load everything can be used to understand if something is going weird.

The hardest part in creating a sandboxing system is that the target should look like a normal environment, while it has to be deeply monitored, far beyond the usual monitoring needs.

another hard point for sandboxing technology is that the decoy should be as close as possible to the used systems you want to protect, otherwise you could not be able to look at what is happening in the real environment.

Last, but not least, we should remember that some of malware and attack that are outside come against sandboxing technology using stealth or anti sandbox technology. While the first try to hide and be undetectable, the second try to understand if the target is a real or fake one, and in the second case stop any execution in order to not be detected.

Sandboxing techniques are effective and a powerful tools when dealing with security but should be implemented carefully.

we should take in account some considerations:

1) the less standard is your environment the less effective is the sandboxing approach. This is related not only to operating systems in the several version, patch level and so on, but also to all the software running on the platform.

If we think, as an example, to a microsoft environment we should be able to duplicate all the existing configuration: Windows version, service pack, Office version and patches, browsers and so on.

Now this seems easy but if we do not have a strict control we could be in need to create a great number of sandbox units in order to fit the various configuration. And I’m not considering hardware drivers….

2) a sandbox can be exploited

The sandbox itself can be exploited. Usually we are dealing with some sort of virtual image that is monitored by its drivers, this means that the sandbox itself is not immune to attacks. Target attacks or APT can have all the interests to leverage eventual vulnerability of the sandbox systems in order to be successful.

3) an evolving environment needs an evolving sandbox systems

as for the other security technologies the sandboxing is useless if not insert in a series of process that deal with the security, a process that has to take into account the evolution of the systems and user behaviours as well as of the external environment in terms of threats and technologies.

So are sandboxing technologies worth the effort? The answer is simply yes but in a clear security context. As for reputation technologies, sandboxing could not be, alone, the answer but sure is a powerful tool if used correctly. Beside marketing effort that sometimes present those technologies as the holy grall of security we should be aware that are just tools to be wisely used .

 

Antonio Ieranò
CSO, Cyber Security Architect, technical evangelist, consultant, writer, journalist and trainer
I am a Security Manager and architect, CSO, BDM, marketing specialist, and tech evangelist with over 20 years of experience serving as a community liaison, subject matter expert, and high-profile trainer for key technologies and solutions. My experience includes acting as the public face of Huawei technology and before Cisco security technologies; leading pan-European technical teams in development of new Cisco security products; and serving as a key public speaker and trainer on behalf of new high-tech products. My expertise spans IT development and implementation, marketing strategy, legal issues, and budget / financial management.

Specialties and Executive Expertise
IT Strategy, Technical Audits, Enterprise Architecture & Applications, Technical Sales Liaison, Solution Architecture, Network Design, Architecture, & Security, Vulnerability Assessment & Management, Systems Engineering, Data Privacy, Cloud Computing, Marketing Strategy, Budget Management, Social Media Marketing, High-Impact Presentations,incident handling, Forensics, Italian companies, Authentication, Infrastructure security, Security manager, Security issues, Attacks, Security infrastructure, Data encryption

Security and Technical Advisoring
Project Management
Business Development and Marketing

To the official site of Related Posts via Taxonomies.

CC BY-NC-SA 4.0 Is Sandboxing technology the answer? by The Puchi Herald Magazine is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.


4 thoughts on “Is Sandboxing technology the answer?

  1. Pingback: Advanced Persistent Threat | The Puchi Herald Magazine

  2. Pingback: Canada Goose Montebello

  3. Pingback: candy crush saga hack

  4. Pingback: https://bft.usu.edu/8g9x2

Comments are closed.