Sand­box­ing: purpose and ap­pli­ca­tion explained

Testing a new computer program for its func­tion­al­i­ty is an important step in software de­vel­op­ment. Even if the source code does not contain visible errors, un­ex­pect­ed com­pli­ca­tions may still occur during practical ap­pli­ca­tion. But testing an unrefined or unknown software program comes with certain risks. For instance, a program may alter or even damage the operating system when faulty or harmful code is installed. A sandbox can solve this dilemma. It offers you a way to test your software or third-party code in an isolated en­vi­ron­ment, without affecting the overall system.

In the IT world, the terms “sandbox” or “sand­box­ing” are becoming in­creas­ing­ly common. But what is sand­box­ing exactly and how is it used? Sandbox tech­nol­o­gy allows you to create an isolated test en­vi­ron­ment within a system. In this way, certain actions can be performed by a program, without it being able to cause damage to the hardware. Sand­box­ing is es­sen­tial­ly about pro­tect­ing your operating system by shielding it from faulty code or malware. In both software de­vel­op­ment and cyber security, sand­box­ing is now con­sid­ered a standard practice as it provides large companies the pro­tec­tion required to avoid system damage and cy­ber­at­tacks.

The concept of sand­box­ing is nothing new; it emerged during the de­vel­op­ment of the first PC systems. In the 1970s, pro­gram­mers used sandboxes for test purposes and sim­u­la­tions. They wanted to find out whether certain code could work within a closed en­vi­ron­ment. Initial security mech­a­nisms like Hydra did not only protect expensive hardware, but had other ad­van­tages: Sand­box­ing tech­nol­o­gy made it possible to record problems which would have arisen without isolation.

Nowadays, certain programs not only enable you to catch and redirect access to your reg­is­tra­tion database, but using virtual machines (VMs), you can even simulate an entire computer.

Sandboxes can be generated in a number of ways. Pre­vi­ous­ly, pro­gram­mers developed their own separate test en­vi­ron­ments, but now they have access to programs that can be put to immediate use. Depending on the operating system and suggested purpose, various versions and different ap­proach­es are available. This is important because a developer working on a brand new computer program will have different needs compared to a company primarily focused on pro­tect­ing its operating system from unknown code or cy­ber­at­tacks. As a general rule, the more aspects of a real system en­vi­ron­ment the sandbox ap­pli­ca­tion should simulate, the greater the resource re­quire­ments will be.

The following provides a brief overview of different sandbox versions and how they work:

• Sandbox programs: When it comes to sand­box­ing tech­nol­o­gy, a popular stand­alone program is Sandboxie which provides a ready-made sandbox for Windows users. Once activated, all write accesses to the hardware attempted by the po­ten­tial­ly harmful program are redi­rect­ed to a folder that you can define yourself prior to the test. Files saved in the sandbox can be moved into the real system on command. Within these ap­pli­ca­tions, you have the option to manage multiple sandboxes at the same time.
• Sandbox in the operating system: Some ap­pli­ca­tions allow you to use the sandbox directly in your program code, with the help of layers and levels. This sandbox is then part of your operating system, albeit self-contained. Like other sand­box­ing software, you enter certain pa­ra­me­ters for the duration of the re­spec­tive program, enabling a targeted sandbox analysis. With Windows 10 (from version 1903, build 18305), you receive the in­te­grat­ed Windows Sandbox as standard, which you can activate or de­ac­ti­vate yourself.
• Virtual machines: Virtual machines (VMs) are more extensive than in­di­vid­ual programs. A VM can be used much like a normal computer and is often located on a separate server due to its size. It’s possible to divide the VM into multiple guest systems. These pseudo-systems exist in­de­pen­dent­ly from one another and are fully isolated from the hardware. Well-known VMs include VMware, Java Virtual Machine, and FAU­ma­chine for Linux and macOS.
• Plug-in sandbox: The pro­gram­ming language Java provides an example of a plug-in sandbox. Here, the sandbox is used by Java applets. Applets are computer programs that are executed in a client web browser. However, thanks to the in­te­grat­ed sandbox, the program code loaded online is run within a separate en­vi­ron­ment, keeping the hard drive, working memory, and functions of your operating system protected.

There are many ways to use sand­box­ing. In general, the ob­jec­tives pursued with this tech­nol­o­gy can be split into two areas: software testing and cyber security. Below you can find a brief summary of which functions they fulfill.

Software testing: Sandboxes play a major role in testing a newly developed software program. The vir­tu­al­iza­tion of computer systems helps pro­gram­mers to develop a secure and func­tion­al ap­pli­ca­tion and test it in various en­vi­ron­ments. Sandbox testing is a tool that demon­strates to de­vel­op­ers where code needs to be adjusted. Sand­box­ing is sometimes used to separate programs running si­mul­ta­ne­ous­ly if they are not com­pat­i­ble with one another. Since code in the sandbox can be executed safely, IT experts use the tech­nol­o­gy to analyze malware and determine its effects on the operating system.

Cyber security: Even in con­nec­tion with browser security, sandbox tools are a popular solution in addition to effective firewall security systems. They protect the operating system from ma­nip­u­la­tion when launching critical ap­pli­ca­tions. In par­tic­u­lar, public in­sti­tu­tions and companies that work with sensitive data need to protect them­selves from advanced per­sis­tent threats (APTs). This includes concealed and recurring hacking attacks that take place over a prolonged period of time. Ad­di­tion­al­ly, regular internet users can surf the web more safely using a sandbox ap­pli­ca­tion. In fact, the current Chromium-based web browsers work with separate sandbox processes for each website or loaded plug-ins to prevent browser exploits.

There are many arguments in favor of using sand­box­ing tech­nol­o­gy. But the question remains of how secure sandboxes truly are when it comes to cy­ber­crime. In general, using a sandbox should not give you a false sense of security. After all, hacking attacks continue to advance just like modern security mech­a­nisms. Smart cy­ber­at­tacks recognize classic sand­box­ing en­vi­ron­ments and can cir­cum­vent them by first con­ceal­ing the harmful code as innocuous before in­stal­la­tion. For this reason, experts not only recommend using a silo-like stand­alone system, but also multiple sandbox tech­nolo­gies at different levels. The multi-sandbox array tech­nol­o­gy uses multiple sandboxes in the same cloud, for example.

Here is a quick review of the ad­van­tages and dis­ad­van­tages of sandboxes: