Hello all,
I've had a look through the documentation, but can't find any information about what URL access forti sandbox needs to function properly. We'd like to lock down the internet access the devices have, but need to make sure we don't cause any problems.
Can anyone point me in the right direction?
Well, the main task in building a sandbox is disguising it to be one. That is, if the malware finds out that the environment is restricted or somewhat 'different' from a regular host, it might decide to lay low and wait for better days, thus avoiding detection. That's the last thing you want.
Therefore, the internet access for FSA VMs must not be restricted or blocked in any way. The sandbox will monitor the malware's behavior and judge accordingly. I trust FTNT that it will stop the host communication once it is sure that this is indeed a malware. I'd say that in 99% of all infections the main damage is done to the infected host, not other hosts on the internet. At least in the beginning, before downloading more malware from a C&C server. So, malware action will not run forever, and in favor of keeping the disguise up you should allow unrestricted access to the internet.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
