ASD ISM 1389 Analyse executable files in sandboxes
What it says
Executable files imported via gateways or CDSs are automatically executed in a sandbox to detect any suspicious behaviour.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishFiles coming through gateways are tested in a safe environment to catch suspicious activities.
This control means that any software or program files coming into your organisation should first be tested in a safe, separate environment to see if they behave badly. It's important because if these files are harmful and you don't catch them early, they could damage your systems or steal sensitive information from your business.
Free. Save your status, tasks and notes.
Why it matters
Without sandbox execution and analysis of gateway/CDS-imported executables, malware may bypass controls, causing data compromise and service disruption.
How to implement
IT team: Set up a sandbox environment on a separate set of computers that can safely run new or untrusted software.
This means creating a secure, isolated space in your computer systems where files can be tested without risking your main business systems.
System administrator: Use automated tools to scan and test executable files that come through your email or file transfer systems.
Choose software that can automatically run and observe these files in the sandbox to look for anything unusual.
Security officer: Monitor the results from your sandbox environment.
Regularly check the reports generated by the sandbox tools to ensure no suspicious behaviour has been detected.
Procurement team: Ensure that any software solutions purchased for sandboxing are regularly updated.
This involves checking for software updates and applying them promptly to keep your security measures effective.
Training coordinator: Educate staff about the risks of downloading random files from the Internet or suspicious emails.
Conduct workshops showing them how automated sandboxing works and why it's a key part of keeping the business safe.
Keep it running
Keep sandbox images and detonation rules current, and automatically execute all gateway/CDS-imported executables to capture suspicious runtime behaviour.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Sandbox environment setup documentation: Request a diagram or description that explains how the sandbox environment is set up and isolated from operational systems.
Look at
Clear separation between the sandbox and main networks.
Good evidence
Includes detailed network diagrams and isolation protocols.
- Check 2 of 5What an auditor asks for
Ask for
Log files from sandbox testing: Obtain copies of logs generated from executing files within the sandbox.
Look at
Whether the software successfully identified and monitored files without affecting the organisation's main systems.
Good evidence
Outcome includes logs indicating testing activity and results without interference.
- Check 3 of 5What an auditor asks for
Ask for
Security tool purchase and maintenance records: Request documents that show what tools are used for sandboxing and their maintenance schedule. Ensure the tools are listed and that updates are regular.
Good evidence
Includes a list of software with dates of recent updates and licences.
- Check 4 of 5What an auditor asks for
Ask for
Incident reports related to sandbox testing: Check if there are reports of potential threats that were caught in the sandbox before reaching the main systems.
Look at
Documented cases where sandbox testing has prevented issues.
Good evidence
Shows documented incidents where threats were contained.
- Check 5 of 5What an auditor asks for
Ask for
Training schedules and materials: Obtain records of staff training sessions covering sandbox usage and awareness.
Look at
Attendance records, training content, and frequency.
Good evidence
Includes detailed sessions with staff feedback and improvements based on feedback.
Mappings
Closest match in ISO/IEC 27001: A.8.7, Protection against malware, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.7.
ISM-1389 requires executable files imported via gateways or CDSs to be automatically executed in a sandbox to detect suspicious behaviour. This implements a specific malware detection technique that supports the broader requirement in Annex A 8.7 to implement protection against malware. Annex A 8.7 also covers additional malware controls beyond sandboxing at ingest points.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.