There was a Hak5 episode talking about sandboxing some time ago, they did a comparison. It came down to the susceptibility of the user, and the ability of the software to allow you to save downloaded files to your box. For instance, Comodo in the test did really well because it did not allow most of the files to be downloaded to disk. Most of the others allowed you to save it to the pc, where you could decide to run it in a sandbox or not. Most users are not going to do so with everything they download.

What interested me more so however, was a discussion on programs that would allow you to run suspicious files in a virtual environment, and report activity, such as opening ports, or downloading other files, ect, Unfortunately, it seems that these are all either online, or commercial. if anyone knows of a program that can be ran locally, with similar functionality, please let me know.

I dont see it working unless you can force users to open certain extensions in a sandbox, maybe using applocker or something.

Interesting concept, but how can you apply it to a whole team?

Like any enterprise software you need support for it. Worse, these restrictions are demanded by a gov client, which is very paranoid about security. So ... having a Chinese software processing their data... not a very good idea

Actually, the demand is that every time an applet is loaded a prompt will appear, and the user should accept it. For example, going to Google main page would mean to click OK seven times. This should prevent some web appl attacks. The problem is that the users will not be able to browse anymore, and they need this option in order to do their job (for other clients).

I was thinking that a better browser protection will make the agency withdraw the request.

I tried Avast sandboxing at home and at work. At home it works just fine, but at work it doesn't work so well. I can browse to some sites, but not to others. I think that you cannot browse to a site with an invalid certificate. As an example our Nessus has the self-created, unsigned, certificate, so I wasn't able to go tp the Nessus web page.

Now, I don't know if I should ask the help of the Avast team (we aren't even their clients), or to try to find another solution to this problem.

Indeed the use of those restrictions would make the life of the users a real hell.
Practically you cannot browse the internet anymore.

Luckily, this policy affects a limited number of users.

Probably, using a VM for gov related tasks would be a good idea, but it is not so easy to sell it to management.

I'll see.

Thanks!