Mitigating Potential Security Threats

Recent changes to security-related features within Microsoft Office 2003 have caused changes to how the Microsoft Office 2003 package is installed. In past versions, the default configuration provided for previous versions usually included a different means of storing and acknowledging certificates of trust as well as fewer options for administrators to restrict the startup of Microsoft ActiveX controls. Now, ActiveX controls have six possible startup configurations.

There are several other improvements that are not obvious due to changes at the source code level that reduced buffer overflow attacks and changed how attachments to e-mail messages are run. These changes in how Office applications are installed and run is an attempt to help reduce possible security threats.

But even with all these new changes, it is still up to the administrator to create and test an installation of Office that meets the security needs of the company. This may require a full evaluation of all the sections of Office applications that access the Internet; receive or send e-mail messages; receive attachments; run ActiveX controls, add-ins, or macros; and determine how passwords are created and maintained.

Ultimately, Office applications are only as secure as the network, operating system, and passwords used to help secure access to data created by the applications. This section intends to lay out general guidelines for administrators who are new to the security features of Office and show how administrators can augment the built-in security-related features with simple changes in how Office is deployed and used on users’ computers.

Evaluate security-sensitive features

There are several features of Office 2003 that have security-sensitive areas. Specifically, any feature with a method for accessing the Internet or allowing access to the network is considered a possible security risk. Use of virus-checking software mitigates most problems associated with these entry points, but diligence about protecting intrusion from external communication lines should also be maintained. This can be mitigated in a few ways: by keeping virus-checking software current with updates available from the virus-checking software manufacturer, by creating a proxy server (firewall) to disable access to undesired Web sites, or by reducing the access of external TCP/IP to open ports on your local network.

Administrators may also want to disable access to some features and settings of Office 2003 applications. To do so, consult the policy templates (ADM files) for each Office application and also examine the policies for the operating system to determine if any of the settings may help provide for a more secure computing environment.

Evaluate all external software

Executables purchased from software manufacturers other than Microsoft should always have a valid digital signature as part of a certificate obtained from a certificate authority. If a product is purchased and it does not have a valid certificate of trust, it is recommended that you not install it. However, if installing the product is absolutely necessary, evaluate the product prior to distributing it to users within the company. During the evaluation, carefully examine the product to make sure it only performs as expected and does not intentionally or unintentionally distribute a virus.

Note

Activation or installation of any executable added to an Office application usually forces the process of acceptance of the certificate of trust. If a request to accept a certificate of trust is not presented during the installation or startup of a new executable, it is possible the certificate of trust has been accepted previously or your macro security setting is set to Low.

Reduce access points that pose security threats

Reducing the threat of an attack is partially accomplished by minimizing entry points for attack and installing virus-checking software that is kept up to date.

Reducing the threat of an attack is based on several factors, which may force a change in business practices. Some of these changes may include:

• Installing a firewall (proxy server).

• Implementing password access to the network.

• Enforcing password and rights management to servers and shares within the corporate network.

Each of these is a critical step to reducing the threat of attack. However, it usually requires training users to help them recognize when they are not practicing safe security methods. The first line of real defense for corporations for reducing their vulnerability to attack is to train users to practice safe computing methods. Instructing users to not open suspicious e-mail messages or run unapproved programs downloaded from the Web or brought in from home will eliminate several entry points for worms, viruses, and Trojan horse programs.

There are other methods for reducing the exposure to possible attacks. They are associated with installing only the required software to get the work done and turning on only the options required for business purposes.

Remove unused features

If an application is set to install by default and you do not need it, set it to Not Available or Not Available, Hidden, Locked in either the Custom Installation Wizard or Custom Maintenance Wizard. Most of the necessary work to accomplish this task should be performed prior to deploying Office to users. A test computer should be created for evaluating the various configurations of Office you create using these tools. The necessary configuration changes you create should be identified and included in the transform that is used to install Office. Use the Custom Maintenance Wizard for any post-installation reconfiguration of Office security settings.

Secure non-secure settings

Any data access points to the Internet, network, or floppy drive are vulnerable to attack. There are several policies available in the policy templates (accessed through the Group Policy snap-in) to help reduce the threat these access points can present. Options, processes, or dialogs used to set or gain access to these ports should be evaluated and checked to be sure the settings comply with your corporate policies for safe computing. Several of these policies are available in the system.adm, conf.adm, and inetres.adm templates (%windir%\system32\grouppolicy\adm or %windir%\inf).

Apply digital signatures to documents and internally developed macros

By attaching digital signatures to documents, it is possible to increase the safety of a document, since you have a good idea of who created it. If your company uses digital signatures for documents, then you might want to intercept the SaveAs menu option and force the use of the ActiveDocument.Signatures.Add method that will display a dialog of the digital signatures the user can apply to the current document prior to saving it. Use of the Signatures.Add method requires the use of digital signatures supplied by a certificate authority.