Using Security Zones

You can use security zones, an Internet Explorer feature, to view incoming email messages and Web pages that might contain scripts that you want to run on your computer. Although many scripts that come in an email message are useful, some can be very harmful and can contain viruses or otherwise damage your hard drive. You can use security zones to control what happens when you receive an email message that contains a script. You can choose an appropriate security zone for each Web page you access and prevent malicious content from damaging your computer.

There are four security zones, each with its own default security level. The four security zones are

• Local Intranet Zone This zone is for sites on your local corporate intranet. You likely trust these sites completely. The default security level is set to Medium.

• Trusted Sites Zone This zone is for sites outside your local intranet that you trust completely. The default security level is Low.

• Internet Zone This is the zone that most Web sites will use. The default security level for this zone is Medium.

• Restricted Sites Zone This zone is for sites you don't trust. Its security level is High.

You can manually change the security level for any zone. The different security levels and their effects are listed in Table 25.1.

Table 25.1. Security Level Definitions

Level	Restrictions
High	No potentially damaging content is downloaded or executed on your computer.
Medium	Outlook warns you before running any potentially hazardous content.
Medium-Low	Most content will run without prompts. Unsigned ActiveX controls will not be downloaded.
Low	Outlook accepts all content without warning.

Security zones are usually discussed with respect to Internet Explorer. However, Outlook can render HTML content and even display Web pages as folder home pages. Some of the other content that Outlook can render that might fall under the umbrella of security zones includes

• ActiveX controls

• Downloads

• Java code

• Cookies

• Scripts

Some of this content might be perfectly safe, but if you're not sure, it's best to set your security settings to the most restrictive settings.

In Outlook 2003, all rendered HTML content falls under the Restricted Sites zone. The default security level for this zone is High. That means no potentially damaging content will be downloaded to your computer.

NOTE

A high security level means that you're generally well protected from potentially harmful scripts that attempt to run when you open or view a message. It does not, however, mean that you're completely safe from damaging content. For every security hole that's patched, either in Internet Explorer or Windows, there's a hacker in existence who will try to find another one. If you're planning to use your computer for anything other than playing Solitaire, you should have a good, up-to-date antivirus program installed on your computer.

If you have a good antivirus product installed on your computer, you can change the security level for a particular zone or even choose a different security zone for Outlook to use. To change a zone's security level, use the following steps:

1. Select Tools, Options, and click the Security tab.

2. If you want to change the zone Outlook uses, change the Zone drop-down list and choose either Internet zone or the Restricted Sites zone.

   CAUTION

   You should really leave Outlook in the Restricted Sites zone. Regardless, you should make sure that you aren't allowing too much potentially dangerous content to run in Outlook and that you have a good antivirus product installed.

3. To change the settings for the selected zone, click the Zone Settings button to display Figure 25.21.

   Figure 25.21. You can change the settings for any Web content zone.

   

4. Click OK to Outlook's warning that you're about to change the way scripts and active content can run.

5. Select the zone you want to edit from the list at the top of the Security dialog box and click Custom Level to display Figure 25.22.

   Figure 25.22. Use the Security Settings dialog box to choose specific settings for all sorts of potentially dangerous content.

   

6. For most settings listed in the Security Settings dialog, you can choose Disable, Enable, or Prompt. A few have other options such as High, Medium, and Low, or Disable and Enable. By default, in a high security zone, most of your choices are set to Disable or High. If you need to change any of the selections, it's best to set the option to Prompt rather than enabling the option. Choosing Prompt will at least notify you before a potentially harmful script or ActiveX control is executed on your system.

7. If you want to reset the security zone to a different general security level, choose the level from the Reset To drop-down list and click the Reset button.

8. When you're done editing the security settings, click OK three times to return to Outlook.