In the case of social engineering attack vector is an email sent with a malicious attachment like XSL file, I am not really understanding where we will need Sandbox solution if we can just use CDR (content disarm and reconstruction) solution (in many cases much cheaper for organization)

  • There is no secure. Only secure enough. Every organization has to decide for itself when they have reached "secure enough" – Conor Mancone Dec 28 '19 at 4:11

CDR and analysis inside a sandbox are both techniques which have their own problems. Sandboxes can be bypassed by clever attackers by basing the behavior of the malware on environment and time and thus not showing malicious behavior inside the sandbox.

CDR instead somehow must assume what kind of payload is allowed in the first place in order to remove everything which is not allowed. This might lead to removing too much payload or too few - like removing every macros from Office documents or every Javascript from PDF even though there are actual valid and innocent use cases for both. CDR can also not handle every kind of content, which means that any content it cannot handle either needs to be blocked completely or need to be blindly passed through.

If a very strict configured CDR (i.e. only allow very few and clearly innocent things) works for you then it might be the best option. This would be similar to configuring a firewall to only allow clearly good incoming and outgoing connections. But such very strictly configured firewall is often unusable in the real world since there are not only clearly good and clearly bad things bad there is also a grey area of things which actually might be innocent or bad but where this cannot be trivially be found out: like posts to Twitter might be fine but might also be communication of malware. And the same problem with the grey area exists when using a very strictly configured CDR.

Thus it might be necessary to use the CDR in a less restrictive way so that it does not accidentally destroy innocent content. But this also means more risk that bad content can pass through. This risk then again might be reduced by using additional security measures, like having CDR policies based on the (claimed) sender of the mail or by using a sandbox or similar technologies to further analyze not clearly innocent (but not clearly bad either) content.


CDR Overview

CDR (Content Disarm and Reconstruction) describes the process of creating a safe copy of an original file by including only the safe elements from the original file, as defined by the document manufacturer (e.g. Adobe for PDF, MSFT for Word etc.).

CDR Advantages

  1. High Security
    • Protects from known and unknown attacks.
    • Deterministic – Since the system works based on a predefined list of file elements, the reconstructed files are 100% safe. Diversions from the expected format specifications (exploits) or unsafe elements, are not included in the reconstructed document.
  2. High Usability
    • Fast – Processing a file usually takes less than a second. Longer processing times will still be substantially faster than alternatives.
    • File Types and Size – Supports all commonly used formats and some non-standards, can process any file size.

CDR Disadvantages

  1. In order to ensure safety, CDR disables or removes active content and executable elements from the input file. This includes macros / scripts and embedded executables. This functionality is fully policy controlled and can be disabled for certain users in the organization by specifying exclusions (e.g. different levels of CDR for different user groups)

Sandbox Overview

A Sandbox is a security mechanism that detects malicious behavior in files. It does so by allowing the file to run in a controlled environment and observing its activity.

Sandbox Advantages

  1. Examines the outcome instead of the code - Can detect new versions of known attacks regardless of any changes made to the delivery mechanism.

  2. Works on virtually all files types (with the right configuration) and components.

Sandbox Disadvantages

  1. May be evaded in some cases – Modern malicious programs often attempt to detect the sandboxing environment. They either try to detect markers of the virtual environment (e.g. p-fish testing) or perform a simple CAPTCHA (a simple challenge-response test to determine whether or not the user is human) before misbehaving. The malicious software may act like a legitimate software when running in the sandbox environment, but act maliciously when detecting that it’s running on a “real” user’s computer.

  2. Usability –

    • Latency – Many sandbox solutions state that processing time (for files that weren’t previously processed) may take more than two minutes. Users often find this disturbing in some environments (e.g. email).
    • File Size Limit – in order to ensure performance, some sandbox solutions place a limit on the maximum file size that can be scanned (as low as 60MB on some systems).
  3. Cost and Scalability - Sandboxes are difficult to scale. The amount of resources required (more than 1 minute of a full VM per file) may pose a challenge when using it to fully-secure large environments.  

The Ideal Solution - Combining the Two

In order to enjoy the benefits of both worlds, it is recommended to combine both systems. CDR will protect from known and unknown threats and will allow scale and speed; A sandbox will manage executables and active content. This allows the sandbox to work only on files that were not treated by CDR, thus lowering volume and increasing its processing time efficiency. As most organizational traffic consists of non-executable documents, this method can reduced sandbox load by 90% - 95%, lowering the total costs and improving the average latency.


I would like to add to and correct some of the initial comments regarding CDR. I would also like to highlight that I work for Votiro.

There are many vendors who claim that they provide CDR. Most of the solutions on the market are taking a document and converting it to an image. This process is highly secure but not productive at all. We call this Level 1 CDR.

Other Vendors strip active content and flatten the original document. This is the same cat and mouse game that traditional anti-virus and NextGen Anti-virus solutions are doing. This process is not productive and requires something bad to have happened in the past which is now represented as bad in the future. This also produces Frankenstein documents. We at Votiro call this Level 2 CDR.

The last and best approach is to preserve all content with template-based reconstruction technology. Each and every element is preserved and the original documents stay intact. CDR is performed on all individual embedded objects inside the document. This process creates a perfect replica of the original document. We do this by removing anything that could have been malicious in the original document by placing only clean objects into the new template. Votiro Calls this Level 3 CDR technology.

This deterministic approach allows you to be confident that your end users are not receiving malicious documents. It also removes the need for Sandboxing which adds 4 to 10 minutes per document processed. Antivirus is also no longer needed since the data is cleansed before it is received by the endusers. With the Votiro CDR process, documents are processed in microseconds allowing users faster access to safe data without the delay. Your users would not need to worry about clicking on documents processed by Votiro CDR.

  • This reads more like a marketing document for your specific product and not general advice. – schroeder Jan 12 at 9:52
  • "founders of CDR and #1 vendor in this space" citation needed. It also does not add to the answer. – schroeder Jan 12 at 12:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.