Ads by TechWords

See your link here
Receive the latest technology news and information.
Security
Computerworld Daily News (First Look and Wrap-Up)
Computerworld Blogs Newsletter
The Weekly Top 10
Cloud Computing
View all newsletters




Privacy Policy
 

Microsoft tightening security defaults in IE 7

One change was suggested by a summer intern at the company

December 12, 2005 12:00 PM ET

IDG News Service - Microsoft Corp. has detailed several changes in the way its upcoming Internet Explorer 7 browser will classify Web sites for security, aiming to reduce the likelihood that users will fall victim to malicious code.
The current version, Internet Explorer 6, has four classifications for Web sites -- Internet, local intranet, trusted and restricted -- which allow users to apply different security rules for how the browser interacts with groups of Web sites. The browser uses the settings to determine, for example, whether it will run ActiveX controls without first alerting the user.
The company has been working on improvements to prevent the browser from running malicious code in less restrictive security zones, wrote Microsoft engineers Vishu Gupta, Rob Franco and Venkat Kudulur in Microsoft's IE weblog.
The local intranet zone is not really relevant for home users, the engineers said. Instead, a change has been made to Internet Explorer 7 so that when a PC is not on a managed corporate network, the browser will treat apparent intranet sites as if they were on the Internet.
"This change effectively removes the attack surface of the intranet zone for home PC users," they wrote. They attributed the idea for the change to a summer intern working at the company.
However, if a machine is running on a domain, Internet Explorer 7 will automatically detect the intranet site and revert to the intranet zone settings. Network administrators will be able to set group policies to ensure that the browser runs as desired, the engineers wrote.
With Microsoft's upcoming Windows Vista operating system, the Internet zone will run in what the company calls "protected mode," to help protect against attacks that Internet Explorer has been victim to in the past. Another feature, ActiveX Opt-In, will reduce potential damage from malicious ActiveX controls in the Internet zone, the engineers said. Those changes will be reflected in a new security-level setting for the Internet zone, "medium high."
The "Trusted Sites" zone, which provides a lot of autonomy for specific Web sites selected by the end user, will also change. It will now have a default security setting of "medium," the same as the Internet zone in Internet Explorer 6. Users will be able to lower the setting if they want to, the engineers wrote.


Reprinted with permission from

IDG.net
Story copyright 2009 International Data Group. All rights reserved.

Jump to comments

Security

Additional Resources

EFD vs. HDD - What You Need to Know
WHITE PAPER
Enterprise flash drives provide a new Tier 0 storage layer capable of delivering high I/O performance at a very low latency. Proper use of EFDs in an Oracle environment can deliver increased performance compared to fibre channel drives. Read the recommendations for identification of the best DB components for EFDs.
Gartner Research Report: Magic Quadrant for Application Delivery Controllers, 2009
WHITE PAPER
The market for products to improve the delivery of application software over networks remains dynamic and innovative. Vendors focused on solving enterprises' most-pressing application problems have become the top players.
Eight Criteria for Server Load Balancing
WHITE PAPER
Server load balancers are a simple yet highly effective means to scale an application environment while ensuring its availability. Today's solutions should also address application performance and security. Read about the top eight criteria you should consider when choosing a server load balancer and how Citrix NetScaler meets those requirements.

White Papers & Webcasts

Death to PST Files
Download Now  

Web 2.0, Social Media and the Dark Web - A Web Criminals Paradise?
In this discussion, learn about the challenges of protecting your users from the potentially unsafe content hidden in the "Dark Web".

eGuide: Enterprise Security
Smart Security Strategies for 2010. Read now!  

Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...


IT Jobs