Microsoft tightening security defaults in IE 7

Microsoft Corp. has detailed several changes in the way its upcoming Internet Explorer (IE) 7 browser will classify Web sites for security, aiming to reduce the likelihood that users will fall victim to malicious code.

The current version, IE 6, has four classifications for Web sites — Internet, local intranet, trusted and restricted — which allow users to apply different security rules for how the browser interacts with groups of Web sites. The browser uses the settings to determine, for example, if it will run Active X controls without first alerting the user.

The company has been working on improvements to prevent the browser from running malicious code in less restrictive security zones, wrote Microsoft engineers Vishu Gupta, Rob Franco and Venkat Kudulur in Microsoft’s IE Web log, at

The local intranet zone is not really relevant for home users, the engineers said. Instead, a change has been made to IE 7 such that, when a PC is not on a managed corporate network, IE will treat apparent intranet sites as if they were on the Internet.

“This change effectively removes the attack surface of the intranet zone for home PC users.” they wrote. They attributed the change to an idea from a summer interrn working at the company.

However, if a machine is running on a domain, IE 7 will automatically detect the intranet sites and revert to the intranet zone settings. Network administrators will be able to set group policies to ensure the browser runs as desired, the engineers wrote.

With Microsoft’s upcoming Windows Vista OS, the Internet zone will run in what the company calls “protected mode,” to help protect against attacks that IE has been victim to in the past. Another feature, ActiveX Opt-In, will reduce potential damage from malicious Active X controls in the Internet zone, the engineers said. Those changes will be reflected in a new security level setting for the Internet zone, “medium high.”

The “Trusted sites” zone, which provides a lot of autonomy for specific Web sites selected by the end user, will also change. It will now have a default security setting of “medium,” the same as the Internet zone in IE 6. Users will be able to lower the setting if they want to, the engineers wrote.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Featured Articles

Cybersecurity in 2024: Priorities and challenges for Canadian organizations 

By Derek Manky As predictions for 2024 point to the continued expansion...

Survey shows generative AI is a top priority for Canadian corporate leaders.

Leaders are devoting significant budget to generative AI for 2024 Canadian corporate...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now