Security Operations · Topic 2 of 14
Sandboxing and Deception Technology
Security+ sandboxing and deception technology: honeypots, honeynets, honeyfiles, honeytokens and canary accounts that expose attackers early.
- 5 min
- A sandbox runs untrusted code in isolation so that harm stays contained.
- Sandboxes are used for malware analysis, browser isolation, app isolation and testing.
- Some malware detects a sandbox and hides its behavior.
What it is
Sandboxing runs code in an isolated environment so that anything harmful it does stays contained. Deception and disruption technology sets traps that no legitimate user should touch, so any contact with them is a strong sign of an attacker.
Both are mitigating controls. A sandbox limits the damage of untrusted code, and deception gives early warning and slows an attacker down.
How it works
Sandboxing
A sandbox is an isolated environment where code can run with limited access to the rest of the system. If the code is malicious, the damage stays inside the sandbox and the sandbox can be thrown away.
| Use | Example |
|---|---|
| Malware analysis | An unknown email attachment is opened in a sandbox and its behavior is recorded |
| Browser isolation | Web content runs in a separate process with restricted rights |
| Application sandboxing | Mobile and desktop apps can reach only their own data unless granted permission |
| Testing | New software or patches are tried in an isolated copy before production |
Email security gateways often detonate attachments in a sandbox before delivery. The sandbox watches for actions such as changing system files, contacting unknown servers or encrypting data.
A sandbox is not perfect. Some malware detects that it is running in a sandbox and behaves normally until it reaches a real system, and escape flaws are sometimes found.
Deception and disruption technology
These tools are decoys. Because no legitimate user has a reason to touch them, alerts from them have very few false positives.
| Tool | What it is | What triggers the alert |
|---|---|---|
| Honeypot | A fake system that looks like a real target | Any connection or login attempt |
| Honeynet | A network of honeypots that looks like a real network segment | Any activity inside it |
| Honeyfile | A fake file with an attractive name, such as a password list | The file is opened or copied |
| Honeytoken | Fake data, such as a credential, API key or database record | The data is used anywhere |
| Canary account | A decoy user account that nobody should ever sign in to | Any sign in attempt or use of the account |
The aim is early detection and learning how attackers behave. A honeypot also wastes the attacker's time, which is the disruption part: effort spent on a decoy is effort not spent on real systems.
Honeytokens and canary accounts
A honeytoken can be a fake cloud access key placed in a configuration file, or a fake customer record in a database. If the key is ever used, or the record appears in a data dump, the organization knows that the file or database was stolen.
A canary account works the same way for identity. For example, a decoy account with an attractive name such as a backup administrator is created but never used. Any attempt to sign in with it shows that an attacker is exploring accounts or has stolen credential data.
Placing decoys safely
| Rule | Reason |
|---|---|
| Isolate honeypots from production | A captured honeypot must not become a path to real systems |
| Make decoys believable | Obvious fakes are ignored by skilled attackers |
| Send decoy alerts to monitoring | A trap that nobody watches gives no benefit |
| Never give canary accounts real rights | A decoy account must not open real data if it is misused |
| Record what the attacker does | The logs show tools and techniques for future defense |
How the exam asks about this
- "A document named passwords is placed on a file share and sends an alert when opened." -> A honeyfile.
- "An account that no one uses alerts when anyone tries to sign in with it." -> A canary account.
- "An unknown attachment must be run safely to see what it does." -> A sandbox.
What to remember for the exam
- A sandbox runs untrusted code in isolation so that harm stays contained.
- Sandboxes are used for malware analysis, browser isolation, app isolation and testing.
- Some malware detects a sandbox and hides its behavior.
- A honeypot is a fake system. A honeynet is a network of honeypots.
- A honeyfile is bait in a file. A honeytoken is bait data, such as a fake credential or record.
- A canary account is a decoy account that alerts when anyone tries to use it.
- Any contact with a decoy is suspicious, so these alerts are high confidence.
- Honeypots must be isolated from production networks.
If a question says "a document that sends an alert when opened" or "a fake credential left in a database", the answer is a honeyfile or honeytoken, not a honeypot.
Common mistakes
Mixing up a honeypot with a honeyfile. A honeypot is a whole fake system. A honeyfile or honeytoken is a single piece of bait.
Confusing a canary account with a service account. A service account does real work for an application. A canary account does nothing and exists only to raise an alarm.
Treating a sandbox as a guarantee. Evasive malware may wait, check for a virtual machine or act only on real hardware.
Connecting a honeypot to the production network. Once captured, it can be used to reach real systems.
Deploying decoys without monitoring. The value of a trap is the alert it raises.
Deception tools are not a replacement for real controls. They add detection on top of segmentation, hardening and access controls.
Check yourself
A fake database record exists only to trigger an alert when someone uses it. What is it?
A honeytoken, a form of deception technology.
What is a canary account?
A decoy account that no legitimate user signs in to, so any attempt to use it raises an alert.
Why is a sandbox used for unknown email attachments?
It runs the file in isolation and records its behavior, so any harm stays inside the sandbox.
Topic 2 of 14 in Security Operations
Test yourself on Security Operations
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.