Internet Explorer Security

What is security on the Internet?

The Internet works by sending information from computer to computer until the information reaches its destination. When information is sent from point A to point B, every computer in between has an opportunity to look at what's being sent. This can pose a security problem.

For example, suppose you are viewing a clothing catalog on the World Wide Web and you decide to buy a shirt. This requires that you type information into an order form, including your credit-card number. You know the clothing company in question is reputable, so you type your credit-card number and other information, and then send the completed form. Your information passes from computer to computer on its way to the clothing company. But suppose one of the computers in between has been infiltrated by criminals who watch the data passing through that computer until they see something interesting, such as your credit-card number.

Another security problem relates to how files and programs are sent and received between Web sites and your computer. With no security protection, you could run or download files and programs from the Internet that can damage your computer and the information stored on it.

How often do things like this happen? It's hard to say, but the important thing is that they're technically possible. And, as the Internet grows, they could happen more and more.

What are security certificates

A certificate is a statement guaranteeing the identity of a person or the security of a Web site. Internet Explorer uses two different types of certificates.

• A "personal certificate" is a kind of guarantee that you are who you say you are. You specify information about yourself, such as your username and password. This information is used when you send personal information over the Internet to a Web site that requires a certificate verifying your identity.
• A "Web site certificate" states that a specific Web site is secure and genuine. It ensures that no other Web site can assume the identity of the original secure site. Web site certificates are also dated when they are issued. When you try to open an organization's Web site, Internet Explorer verifies that the Internet address stored in the certificate is correct and that the current date precedes the expiration date. If the information is not current and valid, Internet Explorer can display a warning.

To view security certificates

1. On the View menu in the browser, click Internet Options.
2. Click the Content tab.
3. In the Certificates area, click the Personal, Sites, and Publishers buttons to view the current certificates.
4. For Help on an item, click at the top of the dialog box, and then click the item.

What are security zones

Internet Explorer divides your Internet world into zones, so that you can assign a Web site to a zone with a suitable security level.

You can tell which zone the current Web page is in by looking at the right side of the Internet Explorer status bar. Whenever you attempt to open or download content from the Web, Internet Explorer checks the security settings for that Web site's zone.

There are four different zones:

1. Local Intranet zone: This zone contains any addresses that don't require a proxy server. The addresses included in this zone are defined by the system administrator in the Internet Explorer Administrator's Kit (IEAK). The default security level for the Local Intranet zone is Medium.
2. Trusted Sites zone: This zone contains sites you trust-sites that you believe you can download or run files from without worrying about damage to your computer or data. You can assign sites to this zone. The default security level for the Trusted Sites zone is Low.
3. Restricted Sites zone: This zone contains sites you don't trust-that is, sites that you're not sure whether you can download or run files from without damage to your computer or data. You can assign sites to this zone. The default security level for the Restricted Sites zone is High.
4. Internet zone: By default, this zone contains anything that is not on your computer or an intranet, or assigned to any other zone. The default security level for the Internet zone is Medium.

In addition, any files already on your local computer are assumed to be completely safe, and no security settings are applied to them. This allows you to open and run files and programs on your computer without prompting or interruption. You cannot assign a folder or drive on your computer to a security zone.

Setting up security zones requires you to

• Set a security level for each zone
• Assign a Web site to a security zone

How you assign security levels and Web sites is completely up to you. The actions for each level are already defined, but you can also create custom settings for the security level.

Generally, you would trust Web sites on an intranet the most, and would probably set your security setting to Low for that zone. Most programs could then be run or downloaded from those sites with little or no notification.

On the other hand, Web sites in the Restricted Sites zone may be those from which you want to avoid running or opening any scripts or active content.

To set a security level for each zone

1. On the View menu in the browser, click Internet Options.
2. Click the Security tab.
3. In the Zone list, select the zone you want to set the security level for.
4. Click the security level.

Note : For Help on an item, click at the top of the dialog box, and then click the item.