Internet Explorer’s security zones are key elements to browsing the web and using the internet without fear. By default, all websites you visit are assigned to the Internet zone, and Internet Explorer severely restricts the action of sites in the Internet zone. If you’re concerned about security, you can lock down security zones even more tightly if you like.
By default, Internet Explorer allows you to work with four security zones:
+ The Internet zone includes all sites that are not included in any other category.
+ The Local Intranet zone is for sites on your local network, typically behind a firewall.
Note
Normally, the Local Intranet zone has fewer restrictions than the Internet zone; however, in a default installation of Windows Vista these settings are disabled and the Local Intranet zone has the same settings as the Internet zone The first time you open a page from an intranet location, you’re prompted to relax the intranet settings In general, you should leave these settings at their default level unless you’re running ActiveX controls on an intranet and need the extra functionality that comes with the relaxed settings
+The Trusted Sites zone (empty on a clean installation of Windows) allows you to specify sites where you allow certain actions—such as running ActiveX controls or scripts—that you might not permit on other sites in which you have a lower degree of trust. The Trusted Sites zone is the only zone where Internet Explorer’s Protected Mode security is disabled.
+ The Restricted Sites zone (also empty on a clean installation) allows you to specify sites where you want to specifically disallow actions that might otherwise be permitted. This zone is the default for HTML-formatted e-mail you read using Microsoft Outlook or Windows Mail.
How Security Zones Affect the Way You Browse
When you open a webpage using Internet Explorer, Windows checks to see which security zone that page is assigned to and then applies restrictions to that page, based on the settings for that zone. Initially, any sites you connect to internally (that is, your own company’s sites, which you access by means of an intranet connection) are automatically assigned to the Local Intranet zone, and if you choose to enable intranet settings the Local Intranet zone is accorded a “medium-low” level of security settings. All other sites on the Internet are lumped into the Internet zone, which is given a “medium-high” level of security settings. As you roam the Internet, if you come upon a site that you trust implicitly, you can move that site into the Trusted Sites zone. Internet Explorer, by default, applies a “medium” level of security settings to the Trusted Sites zone. When you discover a site that warrants a high degree of wariness, you can move that site into the Restricted Sites zone. The security settings that apply there, by default, are described as “high.”
Adding Sites to a Zone
To change the zone in which a site resides, or to reconfigure the security settings associated with a zone, you use the Security tab of the Internet Options dialog box (click Tools, Internet Options, and then click the Security tab). Internet Explorer uses a different icon to depict each zone.
Whenever you visit a site, the icon and name of the site’s zone appear at the right side of the status bar.
To add a site to your Trusted Sites or Restricted Sites zone, follow these steps:
1. On the Security tab of the Internet Options dialog box, select Trusted Sites or Restricted Sites.
2. Click Sites. You’ll see the following dialog box (or one similar if you selected Restricted Sites).
3. The URL for the current site appears in the Add This Website To The Zone box. Edit or replace this value if necessary and then click Add.
By design, the Trusted Sites zone is most appropriate for use with secure sites, where you already have a high degree of confidence that the site you’re interacting with is legitimate. Thus, the default settings for this zone require that Internet Explorer verify that the site’s server is secure (in other words, that it begins with https:) before establishing a connection. To add a non-SSL site to the list, clear the check box at the bottom of the Trusted Sites dialog box. (After adding the site, you can select the check box again.) When you add a domain (such as http://www.microsoft.com) to either of these zones, all URLs located within that domain are assigned to the zone you selected.
Note
The URLs http://microsoft.com and http://www.microsoft.com are not considered to be in the same domain; if you want to add all possible pages for a domain to a security zone, you must consider all possibilities To add all possible pages on a particular domain, enter only the top-level domain name (microsoft.com) and leave off the prefix
By default, Internet Explorer populates the Local Intranet zone with the following:
+ All intranet sites that you haven’t moved into either the Trusted Sites zone or the Restricted Sites zone.
+ All sites that bypass your proxy server, if one exists on your network.
+ All network servers accessed via UNC paths (\\server_name)
To remove one or more of those categories (so that the affected category joins the Internet zone), select Local Intranet in the Internet Options dialog box and then click Sites. You’ll see the dialog box. Clear the appropriate check boxes.
If you want to add a site to the Local Intranet zone, click the Advanced button. Then type the site’s URL and click Add.
Changing a Zone’s Security Settings
Any site placed in a security zone is subject to the same privileges and restrictions as all other sites in that zone. Thus, if you change the overall security settings associated with the zone, you change the security settings for all of its member sites. You can change the security settings for a zone to one of the predefined groups by following these steps:
1. On the Security tab of the Internet Options dialog box, click the icon for the zone you want to adjust.
Caution
If you’ve previously made any customizations to security settings for a particular zone, those settings will be wiped out as soon as you click Default Level If you’ve made specific changes to allow a program or site to work correctly, be sure you document those settings so you can reapply them after changing other security settings.
2. In the Security Level For This Zone section of the dialog box, click the Default Level button to reveal a slider control (if the slider isn’t already visible).
3. Move the slider up to apply more stringent security measures, or down to be more lenient. As you move the slider from level to level, the description to the right of the slider summarizes the current level’s settings.
To fine-tune the settings for a zone, or to read all of the particulars about the current level of settings, click Custom Level. In the Security Settings dialog box that appears, you can use the option buttons to adjust individual settings.
If you’ve customized a security zone’s settings and you want to start over from a completely clean slate, open the Security Settings dialog box, choose a predefined level from the Reset To list, and then click Reset.
