Author: Edwin Baez

TO:               Prof. Jason Ellis
FROM:         Edwin Baez
DATE:          10/27/2021
SUBJECT:    Expanded Definition of Sandbox

Introduction 

 The purpose of this document is to explore the meaning and history of the term Sandbox. The term sandbox is used often in the software testing world, just as it was used pre-machines to define a play area. In this document, I will compare and contrast various definitions of the word Sandbox and how they are used in our world today.

Definitions 

The definition of Sandbox found in the Merriam-Webster dictionary is “a box or receptacle containing loose sand”[1,p1]. This is, of course, the old yet still relevant definition. Sandboxes are basically playpens for kids to let their imaginations run wild, but the term has long progressed since those days. According to the same Merriam-Webster dictionary, “a controller environment supervised by a regulatory authority within which existing regulations are relaxed or removed to allow businesses to more freely experiment with new products and services”[1, p1]. This definition is referring to the business use of the word, stating how a Sandbox is an environment that is controlled and supervised to test new products and services. For example, a business like Apple needs to test out its HTML code to see if those flashy new images look good on their website without bringing down their website. For experiments and test features like that, they use a Sandbox environment. Furthermore, there is a cyber security aspect to the definition. According to an article written on ProofPoint, “The purpose of the sandbox is to execute malicious code and analyze it.”[3,p1]. This definition shows how cyber security specialists use a sandbox as a tool to run code and decipher whether they are malicious or create any type of vulnerability in a system.

Context 

Though used in different manners, the term Sandbox essentially comes to a general meaning of testing with low risk. An author writes, “the idea of a sandbox provides an apt metaphor for the type of collaboration and interaction that should take place in the open, communal office spaces”[4]. This quote talks about how sandboxes are used as a space for a business or businesses to interact and try out new features without risking or harming their business. It’s more spoken of as a testing ground rather than a counter-measure. It’s like those times as a kid when we were being taught how to use PowerPoint and it had all these different fonts and slide animations. We would try all of them first in a separate PowerPoint so our work would not suffer any casualties and then once we decided on a font and/or slide animation we would implement it into our original work. In some way, we’ve all used a form of sandbox for our work.

Furthermore, a different author writes, “Sandbox testing proactively detects malware by executing, or detonating, code in a safe and isolated environment to observe that code’s behavior and output activity”[2]. This quote uses Sandboxes as a means of testing code for security purposes and not allowing a breach by isolation using a Sandbox. Unlike the business branch side of things, this way of using a Sandbox is indeed a counter-measure. It’s basically a bomb testing site but for code and incoming malware. One may say it’s taking batting practice before a game, just testing your swing, ball vision, and ability to make contact on that specific day. I used the statement “on that specific day” because it’s actually how this version of running a Sandbox works. Codes are unpredictable, there are things that even the developer himself doesn’t know would happen if the code is executed. One day your program may work flawlessly and the next day can be corrupt without even changing anything, maybe you missed a letter or number that allows the code to run more than a day or maybe a spelling mistake. All in all, this form of Sandbox is perfect for “detonating a bomb”.

Working Definition 

My major is Computer Systems branching into Cyber Security. As one can tell, the term Sandbox is very important in my field as many codes have to be tested. In my field, I would say a Sandbox is a safe zone where any developer or security analyst can try out any code or any level of work and look for vulnerabilities or decipher any malicious intent in the coding.

References 

[1]  “Sandbox.” Merriam-Webster.com Dictionary, Merriam-Webster, https://www.merriam-webster.com/dictionary/sandbox. Accessed 15 Oct. 2021.

[2] Forcepoint. 2021. What is Sandbox Security?. [online] Available at: <https://www.forcepoint.com/cyber-edu/sandbox-security> [Accessed 16 October 2021].

[3] Proofpoint. 2021. What is a Sandbox Environment? Definition & Setup | Proofpoint US. [online] Available at: <https://www.proofpoint.com/us/threat-reference/sandbox> [Accessed 16 October 2021].

[4] Clarke, D., 2021. The Serious Business of Sandboxes. [online] strategy+business. Available at: <https://www.strategy-business.com/article/The-Serious-Business-of-Sandboxes> [Accessed 16 October 2021].