We'll cover one more security consideration at the end.
This issue involves isolating programs in a perfect world you would not need to run any applications
that are not trusted.
This is not the case though.
Sometimes you have to run a line of business application that was created several years ago by a person
who is no longer the company's employee.
It could also be that employees have grown used to purchase a piece of software and are reluctant to
switch to anything newer
A solution is isolating these programs.
How is this achieved.
First of all isolating may involve the key security boundary that is a computer you can set aside a
dedicated computer for running this one application the computer will then obviously not be in a domain.
The solution is secure but not very functional.
Users are unlikely to want to have to switch between three computers to be able to work efficiently
can also virtualize the software using a second security boundary an operating system.
You can watch a virtual system and install software in it.
This is an expedient solution that is easy to implement as a Windows 7 system has this mechanism has
an inbuilt function you can run virtual PCs in Windows 7 this feature is available from Microsoft's
website.
Then in prepared virtual machines you can install any software to make integration seamless programs
that are installed in virtual systems can be launched from the start menu of a host system
after you click on an icon a virtual machine is started in the background.
The software is run in the virtual environment.
Everything is working fine.
The virtual machine is obviously not in a domain the same passwords aren't stored there.
It's quite secure.
You can also give up standard security boundaries and attempt to isolate a program by running in a sandbox.
One of the earlier lectures discussed the fact that Internet Explorer is to some extent sandbox to or
isolated
this refers to Internet Explorer running at a low security level when it's in the protected mode.
We also said that the sandbox isn't a true instance of isolation an Internet Explorer process can read
user data and forward it to the Internet but can't modify it.
This usually isn't exactly what we want when we talk of data security
to remedy the situation.
You can use third party software.
There are many solutions available both free and commercial in this presentation we'll see an example
of this software.
The program we'll use is called sandbox.
IEEE Sandboxie is a popular and easy to use application you can run any software in sandbox mode.
The program is designed to virtualize and intercept communications between a started application and
a system
all files written to buy a specific program will be written in a protected area.
Sandbox will also disable a program from reading data that is outside the sandbox.
The program addresses software isolation and security issues as well as enhances privacy.
You can clear or create a sandbox at any moment and return to a point before configuration changes in
the software were applied.
Let's now quickly see how intuitive and transparent for a user it is to virtualize a program using tools
like sandbox IEEE will select a program that we want to run sandbox.
It can be anything we'll choose wireshark don't simply run it select Run sandbox from the context menu
the option will appear after you install sandbox i.e. next.
You should select the sandbox in which the program will run usually there is more than one sandbox that
can be created for example for specific applications.
If you don't want them to exchange data will you use the default sandbox when you run your program.
Nothing has visibly changed from a user standpoint.
The program is running.
You can see that it's virtualise and protected from the yellow border framing the program's window
taking a look at the sandbox menu.
You can see that the program run sandbox if it's necessary.
You can delete the contents of the default sandbox or recover it to a prepared point.
Sandbox provides a guarantee that the program you run has no direct chance of interacting with anything
that is outside the sandbox.
This is a simple and elegant solution.
This module discussed administrative techniques and approaches for controlling user run software the
module emphasized the importance of regular software updates.
It also covered methods or system functionalities designed to determine what programs can be allowed
to run and what programs will be blocked.
This involved a discussion of rules that identify software and mechanisms that can allow you to run
insecure programs in a relatively secure manner.
This included virtualization and software isolation in a sandbox thinking.