What is Sandboxing?

Defining Sandboxing

Sandboxing is often used as a threat detection method to execute suspicious objects detected on the network or on a host machine, possibly from unverified or untrusted third parties, suppliers, users or websites, without risking harm to the host machine or Operating System. By observing execution behaviors of suspicious objects, the Sandbox detects malware that is difficult to find using only static analysis. Sandboxing solutions can be implemented on-premise or in the cloud.

Why is Sandboxing Important?

With attacks coming from all angles, multiple detection methods are required for a sound defense. Sandboxing provides a key detection layer for malware that is difficult to identify through static analysis. By detonating suspicious objects in an isolated virtual environment, the user can determine if it is malicious and gain critical information on the code including IOCs that can be applied to other detection and prevention methods throughout the environment – all without risk.

Sandboxing, One of Many Methods for Threat Detection

Read our Datasheet

What are the Key Aspects of a Sandboxing Solution?

A sandboxing solution should be embedded within your threat detection capabilities and provide another layer of detection to:

  • Observe malware execution in mutex, registry, API call, file system access, network behavior and artifacts
  • Understand malware behavior by observing malware’s Internet access behavior in its full life cycle or simulating interaction with malware execution and recording the network behavior
  • Identify malware evasion behaviors such as delayed execution, environment diagnostics and checking human interaction
  • Share malware forensics with other security components for immediate prevention and used to protect against future attacks

Related Sandboxing Resources

Fidelis Network® Explained Video

White Paper: Overcoming Detection Gaps of Deep Packet Inspection Tools

ESG Research: Threat Detection and Response Technology Platforms Report

 SANS Evaluation of Fidelis Network® and Deception®

Return to the Education Center
squares

Get Started

See Fidelis Cybersecurity platforms in action. Learn how our fast, scalable Fidelis Elevate and Fidelis CloudPassage Halo platforms provide deep insights into the SOC to help security teams worldwide protect, detect, respond, and neutralize even the most advanced cyber adversaries.