zero-day attack<\/a> is an exploit or hack that attacks a vulnerability the software developer either isn\u2019t aware of or doesn\u2019t yet have a patch to fix. Normal endpoint security tools generally can\u2019t detect, much less stop, a zero-day attack\u2014they simply don\u2019t have the threat intelligence to recognize them in time. Sandboxing unknown files or codes allows security teams to catch zero-day attacks before they can execute on the hidden vulnerabilities. <\/span><\/p>\nPrimarily, sandboxing is designed to recognize and stop advanced persistent threats (APTs). These are attacks with a deliberately lengthy dwell time (time on a network without detection) intended to steal corporate data. The goal is sustainable and continual theft, rather than a faster heist-like hack. Sandboxing allows endpoint security solutions to keep unknown programs under quarantine for as long as it takes to determine their intentions. This means that experts can observe if an unknown code gives access to unauthorized users or attempts to siphon data, and if so give it the boot. <\/span><\/p>\nWhat Weaknesses Do Sandboxes Have? <\/b><\/h3>\n
Sandboxing is not infallible. Sandboxing is not a substitute for traditional endpoint security tools such as firewalls, anti-malware, and web filtering. Rather it is another layer of security, a compliment to other tools, and should be treated as such when deployed. <\/span><\/p>\nSandboxes, especially traditional or legacy sandboxes, may not have the capabilities to actually remove a threat from the network. More advanced ones often will, but this is something that should be examined when selecting an endpoint security solution. It also underlines the need for sandboxing to be paired with other tools, especially those that specialize in threat removal. <\/span><\/p>\nFinally, some threats are designed to evade sandboxing and its detection. Some threats unfold slowly, over the course of days, never indicating its true intentions until much later. This can fool both sandboxes and experts, who may allow a malicious code through without realizing it. Other threats use encryption to mask their malicious codes\u2014legacy sandboxing tools generally can\u2019t read encrypted codes. Experts might be deceived as well. After all, encryption may obscure legitimate codes, especially those involved with privacy.<\/span><\/p>\n
![\"sandboxing\"](\"https:\/\/solutionsreview.com\/endpoint-security\/files\/2018\/03\/sandboxing-mod.jpg\")
<\/p>\n![\"Download](\"https:\/\/solutionsreview.com\/endpoint-security\/files\/2019\/01\/endpoint-security-speedbump-cta.jpg\")
<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div><\/span><\/p>\n