Evaluate The Security Operations Company Symantec On Sandboxing [2021] -

Symantec’s sandbox does not perform deep memory introspection (e.g., scanning for unlinked or injected code after execution). It relies primarily on execution traces. This makes it weaker against fileless malware or scripts that live exclusively in memory. 3. SOC Operational Experience User Interface & Workflow The CMA console is functional but dated. It presents a process tree, network flows, and extracted IOCs (hashes, domains, IPs). However, it lacks the intuitive, timeline-based visualizations of modern competitors. Analysts often report difficulty quickly identifying the moment of malicious intent within a long execution log.

Executive Summary Symantec (now part of Broadcom) has integrated sandboxing as a core component of its Integrated Cyber Defense (ICD) platform, primarily via the Symantec Content and Malware Analysis (CMA) appliance and its cloud-based variant, the Malware Analysis Cloud . While Symantec was a pioneer in signature-based antivirus, its transition to dynamic, behavior-based sandboxing has been a mixed evolution. The evaluation concludes that Symantec’s sandboxing is robust for enterprise integration but lags behind best-of-breed specialists (e.g., Joe Sandbox, VMRay, CrowdStrike Falcon Sandbox) in evasion resistance and analysis depth. 1. Architecture & Deployment Strengths Deep Native Integration Unlike standalone sandbox vendors, Symantec’s strength lies in its ecosystem. CMA natively ingests files from Symantec Email Security.cloud, Web Security Service (WSS), Endpoint Protection (SEP), and Network DLP. This allows for automated, policy-driven detonation of suspicious objects without requiring third-party APIs. For a SOC team already using Symantec, this reduces friction and mean time to triage. Compared to purpose-built sandboxes

Symantec offers both on-premise CMA appliances (for air-gapped or high-latency environments) and a cloud analysis farm. The hybrid model allows sensitive files (e.g., financial, legal) to be analyzed on-prem while high-volume email/web traffic is routed to the cloud, balancing compliance with scale. or specific VM artifacts (e.g.

CMA supports Windows, macOS, Linux, Android, and common document formats (Office, PDF, archives). It also includes specific IoT/ICS protocol analysis, which is uncommon among generalist sandboxes, making it viable for industrial control SOCs. 2. Detection Capabilities (The Core Function) Behavioral Analysis Quality Symantec uses a combination of dynamic analysis (process tree, registry, network connections) and kernel-level monitoring. It effectively captures typical malware behaviors: process hollowing, reflective DLL injection, and persistence mechanisms. independent tests (e.g.

This is Symantec’s most significant shortfall. Compared to purpose-built sandboxes, CMA historically struggles with advanced environment-aware malware —samples that check for mouse movement, CPU temperature, uptime, or specific VM artifacts (e.g., MAC OUI prefixes common to VMware/Hyper-V). While Symantec has added sleep-editing and time-bomb detection, independent tests (e.g., SE Labs, MRG Effitas) frequently show that 10-15% of evasive malware can remain undetonated in CMA, where competitors like FireEye (now Trellix) or CrowdStrike catch nearly all.