Sandbox environment for document preview and analysis
Attachments or other documents can be transmitted to a sandbox environment where they can be concurrently opened for remote preview from an endpoint and scanned for possible malware. A gateway or other intermediate network element may enforce this process by replacing attachments, for example, in incoming electronic mail communications, with links to a document preview hosted in the sandbox environment.
1. A computer program product comprising computer executable code embodied in a non-transitory computer-readable medium that, when executing on one or more computing devices, performs the steps of:
receiving an electronic mail communication addressed to an endpoint and containing a document as an attachment;
adding a link in the electronic mail communication in place of the attachment, the link configured for accessing the document in a sandbox environment from the endpoint by connecting the endpoint to a document preview rendered from the sandbox environment;
communicating the electronic mail communication to the endpoint;
receiving a request from the endpoint to open the document by detecting a selection of the link;
forwarding the document to a sandbox environment, wherein the sandbox environment is configured to open the document, perform a malware detection on the document, and support a remote interaction with the document in the sandbox environment from the endpoint by rendering the document preview with the sandbox environment, connecting the endpoint to the document preview, and remotely displaying the document preview to the endpoint; and
transmitting a presentation of the document from the sandbox environment, as opened within the sandbox environment, to the endpoint for display on a monitor of the endpoint.
2. The computer program product of claim 1 wherein receiving the request includes receiving the request within a user interface of the endpoint.
3. The computer program product of claim 1 wherein the presentation of the document includes an interactive preview of the document.
4. The computer program product of claim 1 wherein the presentation of the document includes an editable preview of the document.
5. A method for accessing a document sent as an attachment, the method comprising:
transmitting an electronic mail communication to an endpoint, the electronic mail communication including a link in the electronic mail communication in place of the attachment, the link configured for accessing the document in a sandbox environment from the endpoint by connecting the endpoint to a document preview rendered from the sandbox environment;
receiving a request from the endpoint to open the document by detecting a selection of the link;
forwarding the document to a sandbox environment, wherein the sandbox environment is configured to open the document, perform a malware detection on the document, and support a remote interaction with the document in the sandbox environment from the endpoint by rendering the document preview with the sandbox environment, connecting the endpoint to the document preview, and remotely displaying the document preview to the endpoint; and
transmitting a presentation of the document from the sandbox environment, as opened within the sandbox environment, to the endpoint for display on a monitor of the endpoint.
6. The method of claim 5 wherein the document includes an attachment to an electronic communication received at the endpoint.
7. The method of claim 5 wherein the document includes at least one of a word processing document, a spreadsheet, a portable document format document, or a presentation document.
8. The method of claim 5 wherein receiving the request to open the document includes receiving a right click of an icon for the document within a user interface displayed by the endpoint.
9. The method of claim 5 further comprising permitting a download of the document to the endpoint if malicious code is not detected during the malware detection when the document is opened within the sandbox environment.
10. The method of claim 5 further comprising providing an indication of risk for the document to the endpoint based on the malware detection.
11. The method of claim 5 wherein the document is a file locally stored on the endpoint.
12. The method of claim 5 wherein the document is an attachment to an electronic mail message.
13. The method of claim 5 wherein the document is a remote document identified by a uniform resource locator.
14. The method of claim 5 wherein the request to open the document is an automated request from a background process configured to scan an electronic mail inbox for attachments.
15. A system for securing an endpoint against malware contained in documents opened on the endpoint, the system comprising:
a computing device coupled to a network;
a processor; and
a memory bearing computer executable code configured to perform the steps of transmitting an electronic mail communication containing a document as an attachment to an endpoint, the electronic mail communication including a link in the electronic mail communication in place of the attachment, the link configured for accessing the document in a sandbox environment from the endpoint by connecting the endpoint to a document preview rendered from the sandbox environment, receiving a request from the endpoint to open the document by detecting a selection of the link, forwarding the document to the sandbox environment, wherein the sandbox environment is configured to open the document, perform a malware detection on the document, and support a remote interaction with the document in the sandbox environment from the endpoint by rendering the document preview with the sandbox environment, connecting the endpoint to the document preview, and remotely displaying the document preview to the endpoint, and transmitting a presentation of the document from the sandbox environment, as opened within the sandbox environment, to the endpoint for display on a monitor of the endpoint.
16. The system of claim 15 wherein receiving the request includes receiving the request within a user interface of the endpoint.
17. The system of claim 15 wherein the presentation of the document includes an interactive preview of the document.
18. A computer program product comprising computer executable code embodied in a non-transitory computer-readable medium that, when executing on a gateway of an enterprise network, performs the steps of:
receiving an electronic mail communication containing a document as an attachment;
removing the document;
forwarding the document to a sandbox environment for interactive access from an endpoint, wherein the sandbox environment is configured to open the document, perform a malware detection on the document, and support a remote interaction with the document in the sandbox environment from the endpoint by rendering a document preview with the sandbox environment, connecting the endpoint to the document preview, and remotely displaying the document preview to the endpoint;
adding a link in the electronic mail communication in place of the attachment, the link configured for accessing the document in the sandbox environment from the endpoint by connecting the endpoint to the document preview rendered from the sandbox environment; and
forwarding the electronic mail communication with the link to the endpoint.
19. The computer program product of claim 18 further comprising code that performs the step of causing the sandbox environment to open the document and render the document for display at the endpoint in response to accessing the sandbox environment from the endpoint with the link.
20. The computer program product of claim 18 further comprising code that performs the step of notifying a threat management facility if malicious code is detected during the malware detection when the document is opened within the sandbox environment.
21. The computer program product of claim 18 wherein removing the document includes conditionally removing the document based on a reputation of the document.