Sandbox

What is a sandbox in simple words

A sandbox is an isolated environment created for safe testing, experiments or development. Just like in a children's sandbox, where children build castles out of sand without fear of breaking anything, in an IT sandbox you can run suspicious files or test new code without the risk of harming the main system.

The main rule of a sandbox: whatever happens in it stays in it. If a program turns out to be a virus, it is “locked” inside and cannot infect your computer or steal data. If a developer tests a new function, an error will not break the working site or application.

Sandboxes are widely used in cybersecurity for analyzing malware, in development for testing new code, in education for safely studying systems and in everyday work for running unverified applications. According to Gartner, by 2027 more than 70% of organizations will use sandboxes as part of their security strategy for threat analysis and testing. Read about protection from malware in the article Antivirus software.

How a sandbox works

A sandbox uses several key mechanisms to ensure isolation and security:

• Isolation: The sandbox creates a separate virtual environment isolated from the operating system and other programs. Isolation can be at the OS level (containers), at the hypervisor level (virtual machines) or at the application level (sandboxes for individual programs).
• Resource limitation: A program in a sandbox has access only to the resources allocated to it (memory, processor, disk) and cannot interact with the main system, modify system files or the registry.
• Monitoring: All program actions are recorded and analyzed: which files it tried to open or modify, which network connections it established, which system calls it executed. This allows understanding the behavior of malware.
• Cleaning: After the sandbox is closed, all changes are deleted and the environment returns to its original state. This guarantees that no traces of malicious activity remain.

Read about virtualization in the article Virtualization.

Where sandboxes are used

Sandboxes find application in various areas where safe testing or isolation is required:

• Information security: Running suspicious files and checking their behavior without the risk of infection. Malware analysis (viruses, encryptors, trojans), attack research and signature development for antiviruses.
• Software development: Testing new code in an isolated environment so as not to break the production version (the live server). Checking compatibility with different OS versions, testing updates.
• Education and experiments: Students and specialists can safely study systems without fear of errors or damage to important data. Conducting penetration tests.
• Running unverified applications: Executing programs from unreliable sources (for example, downloaded from torrents or received by email) in a safe environment.
• Testing in browsers: Isolated tabs for protection from malicious sites (for example, an isolated environment for executing JavaScript).

Popular sandbox solutions

There are many tools for creating sandboxes, from simple utilities to complex corporate platforms:

• Sandboxie: A popular solution for Windows that allows running programs in isolation from the main system. Suitable for everyday use.
• Windows Sandbox: A built-in solution in Windows 10/11 (Pro and Enterprise) for quickly creating an isolated environment. Lightweight and easy to use.
• Cuckoo Sandbox: A tool for automated malware analysis. Used in corporate SOCs for automating threat analysis.
• VirtualBox / VMware: Allow creating full-fledged sandbox virtual machines with an installed OS. Give full control over the environment.
• Firejail: A Linux solution for isolated application launching using kernel isolation mechanisms.

Read about virtual machines in the article Virtual machine.

Risks when working with a sandbox

Despite the high level of security, sandboxes are not absolutely impenetrable. There are risks that are important to consider:

• Sandbox evasion: Some complex viruses can detect that they are running in a sandbox (for example, by the presence of specific processes, memory size or operating time) and do not show malicious activity to avoid detection. Such viruses can activate only when running on a real system.
• Insufficient isolation: If the sandbox is configured incorrectly or has vulnerabilities, a malicious program can “escape” and infect the main system. For example, vulnerabilities in hypervisors are known that allow breaking out of a virtual machine.
• Performance: Running in a sandbox can be slower than in a normal environment due to the overhead of isolation and monitoring. For resource-intensive applications this can be a problem.

To minimize risks, it is recommended to use proven solutions, regularly update sandbox software, use several layers of isolation (for example, a virtual machine inside a physical host) and combine sandboxes with other protection means such as EDR and SIEM.