Setting Up Security Alerts and Trusted Publishers

Hackers are typically not stupid-they are actually some pretty intelligent people who are using their smarts for unsavory purposes. Examples include homograph and phishing attacks, which are Web-based fraud schemes that mimic well-known, trusted brands. Phishing uses spoofed messages disguised to look like the real thing (an e-mail message that contains Microsoft logos and links) but is really a trick to lure you into providing personal information. Homographs are words that have the same spelling as the real thing (Microsoft) but actually have a different meaning. For instance, you might see a link to www.microsoft.com that looks like it uses the English alphabet, but the i is actually a Cyrillic character from the Russian alphabet. Because you can’t tell the difference, you could click the link and land on an untrustworthy Web site.

PowerPoint 2007 has an automatic default that warns you when it detects links to and files from suspicious Web sites. Do we recommend you turn off these security alerts? Of course not. You can do it in Trust Center Privacy Settings if you really want to, however. If the security alerts are annoying you because they routinely pop up involving files from someone you know has valid credentials, you might want to add this person to your trusted publishers list. A trusted publisher is a developer who creates macros, ActiveX controls, add-ins, or other application extensions and who meets all of the following criteria:

• The code project is signed by the developer with a digital signature.

• The digital signature is valid.

• The digital signature is current.

• The certificate associated with the digital signature was issued by a reputable certificate authority.

• The developer who signed the code project is a trusted publisher.

The criteria are critical-if you try to run published code that does not meet all of the criteria, the Trust Center will disable the code by default, and the Message Bar will still appear to notify you of a potentially unsafe publisher.

Caution 

Be certain that you have had successful interactions with a developer before you add one to your trusted publishers list You should add only trustworthy sources. If you receive a security alert dialog box for a developer, you will have the option of trusting all future documents from them. When a security alert dialog box appears for the publisher you want to add to your trusted publishers list, select Trust All Documents From This Publisher, and click OK.