Configure and Troubleshoot Security for Windows Internet Explorer 7 (part 2) - Internet Explorer’s Protected Mode

Internet Explorer’s Protected Mode

When a process gets launched—by a user, for example—the process is allowed to do only what the user’s level of privilege (rights and permissions) allows. This is true for all processes that run on a computer, including startup services. Startup services usually run under the privilege of a user account that is called the System account. So when a bad guy exploits a vulnerability in (hacks) an application running on a computer, the bad guy acquires the same level of privilege as the user account that was used to launch the hacked application. The bad guy can do only what that user is allowed to do on the computer.

Because Internet Explorer is the application you use to attach to public servers all over the very dangerous Internet, it is the application that gets most exposed to the bad guys and malware. To make your system more secure while you are potentially exposing yourself to the malware and bad guys, Microsoft runs IE7, by default, in Protected Mode any time you are connected to restricted sites, the Internet, or the local intranet. The only zone that Protected Mode is not automatically enabled for is Trusted Sites.

Protected Mode reduces the level of privilege for the user account that launched Internet Explorer. This way, if malware (or a bad guy) attacks and compromises the browser, it can access only a bare minimum of resources on your computer. Protected Mode isolates IE7 from all other applications that are running on the computer and limits the browser to writing only to the Temporary Internet Files folder without explicit user approval. If the browser attempts to write to any other area, the UAC prompt is displayed.

You can observe whether Protected Mode is currently enabled by viewing the status bar, on the lower edge of your browser. Protected Mode is enabled by default for websites in the Internet, Local Intranet, and Restricted zones.

You can access the configuration for Protected Mode by double-clicking this area on the status bar or by accessing the Security tab in Internet Options (from the File menu or the command bar: Tools > Internet Options).

In the Custom Level Security Settings dialog box, as shown in Figure 4, you can adjust settings to Disable, Enable, or Prompt you for approval as your browser accesses .NET components, Signed and Unsigned ActiveX controls, and file downloads.

If you use Internet Explorer 7 to attach to intranet resources by using their Universal Naming Convention (UNC) path, you may receive a warning. To avoid getting this warning, you can add the UNC path to the Trusted security zone on the Security tab in Internet Options, as shown in Figure 5.

Fix Settings for Me...

IE7 monitors the security settings and alerts you if your settings put you at risk. If your IE7 security settings put you at risk while browsing, a warning bar drops down from the address bar to alert you.

You can identify which settings are below the recommended settings by viewing the security settings in Internet Options > Security, where you see a red Security shield on the misconfigured zone. If you select the Custom level button for that zone, any security items highlighted in red are below recommended security settings.

You can right-click the drop-down alert and select the Fix Settings for Me option, as shown in Figure 6, to restore the security settings to their original, recommended levels, like the Medium-High configuration for the Internet zone.

Figure 6. If you have reconfigured your IE security setting, putting you at risk, you can reset security back to its default, secure settings by selecting the Fix Settings for Me option.