Close
  • Latest News
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Logo
  • Latest News
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Cybersecurity
    • Cybersecurity

    Microsoft Planning IE7 Security Zone Lockdowns

    By
    Ryan Naraine
    -
    December 9, 2005
    Share
    Facebook
    Twitter
    Linkedin

      Microsoft Corp. has announced plans to make several key default changes to Internet Explorer 7s security zones to further harden the browser from malicious hacker attacks.

      The built-in zones, used in IE to enforce security rules for Web sites by grouping them into categories, will be changed to scrap the use of the “Intranet” zone unless the computer has joined a domain.

      According to details posted on the official IE Blog, Microsoft will also making significant default changes in the “Internet Zone” and “Trusted Sites” zone to provide defense-in-depth against some dangerous IE attack vectors.

      “The Internet zone, where most users browse, will be tightened down with two very notable changes. The Internet zone will run in Protected Mode on Windows Vista,” the company explained. “ActiveX Opt-In will also help reduce the attack surface of ActiveX controls in the internet zone.”

      With the “Trusted Sites” zone in IE6, Microsofts Vishnu Gupta said the company found that many users do not understand how powerful a site becomes when they make it a Trusted Site. “For example, a Trusted Site in IE6 can automatically install signed ActiveX controls on the users machine. As a safety precaution in IE7, we have set the default for the Trusted Sites zone to Medium, the same level as the Internet zone in IE6,” Gupta explained.

      He said customers who depend on the IE6 level of the Trusted Sites zone will be able lower settings back to IE6 levels with a slider on the “Security” tab of “Internet Options” or through policy settings.

      /zimages/4/28571.gifClick here to read more about security features in IE7.

      The most significant default change will be the way the browser deals with the “Intranet Zone,” a setting that is primarily designed for sites built by a network administrator.

      “Because security zones allows more power to some Web sites, zones also open the possibility of zone-spoofing attacks: If there is a flaw in IEs zone detection logic, a malicious Web site could try to run in a less restrictive security zone than they should run in. With URL parsing and other improvements in Windows XP SP2 and IE7, we have helped to ensure this doesnt happen,” he explained.

      “We realized that the intranet zone (and its lower restrictions) is not relevant at all to the typical home user running IE. This change effectively removes the attack surface of the intranet zone for home PC users,” he explained.

      In an enterprise IT setting, IE7 will check if a machine has joined a domain and automatically detect intranet sites and run them with settings for the Intranet zone.

      /zimages/4/28571.gifClick here to read about Microsofts plans for a “low rights” IE7.

      “There will be cases where IE might not detect an enterprise IT network correctly. For example, a PC might be on a workgroup rather than a domain or it may not have joined the domain. For those cases, network admins will be able to set group policy on the settings for the Intranet to make sure that IE behaves as they wish. Even if the network admin cant set policy, IE will show an information bar when visiting a probable intranet site. If a user wants to re-enable their intranet zone, theyll be able to,” Gupta added.

      The IE makeover will also feature a “low-rights” security feature to prevent cross-domain vulnerabilities from installing malicious software on users machines.

      Microsoft will also discontinue the use of the SSLv2 (Secure Socket Layer) protocol in IE7 and use the stronger TLSv1 (Transport Layer Security) protocol—part of an overall plan to improve the security and user experience for HTTPS connections.

      The new browser will also block navigation to HTTPS sites that present problematic digital certificates.

      Beyond the security improvements, IE7 promises support for IDN (International Domain Names), tabbed browsing, built-in RSS and seamless search that will include choices of search providers. The browser also will improve Web page printing capabilities such as the automatic “fit-to-page” feature.

      /zimages/4/28571.gifCheck out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.

      Ryan Naraine

      MOST POPULAR ARTICLES

      Cybersecurity

      Visa’s Michael Jabbara on Cybersecurity and Digital...

      James Maguire - May 17, 2022 0
      I spoke with Michael Jabbara, VP and Global Head of Fraud Services at Visa, about the cybersecurity technology used to ensure the safe transfer...
      Read more
      Cloud

      Yotascale CEO Asim Razzaq on Controlling Multicloud...

      James Maguire - May 5, 2022 0
      Asim Razzaq, CEO of Yotascale, provides guidance on understanding—and containing—the complex cost structure of multicloud computing. Among the topics we covered:  As you survey the...
      Read more
      Big Data and Analytics

      GoodData CEO Roman Stanek on Business Intelligence...

      James Maguire - May 4, 2022 0
      I spoke with Roman Stanek, CEO of GoodData, about business intelligence, data as a service, and the frustration that many executives have with data...
      Read more
      IT Management

      Intuit’s Nhung Ho on AI for the...

      James Maguire - May 13, 2022 0
      I spoke with Nhung Ho, Vice President of AI at Intuit, about adoption of AI in the small and medium-sized business market, and how...
      Read more
      Android

      Samsung Galaxy XCover Pro: Durability for Tough...

      Chris Preimesberger - December 5, 2020 0
      Have you ever dropped your phone, winced and felt the pain as it hit the sidewalk? Either the screen splintered like a windshield being...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2021 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×