untangling_the_web

DOClD: 4046925
UNCLASSIFIEDIi..e~ e .... leIAL tJ3E e'~LY
Browser Concerns
Using Internet Explorer's Privacy and Security Controls
One of the biggest underlying problems vis-a-vis Internet security is that virtually all
Microsoft products.! " including Internet Explorer, come with all the doors open and
unlocked, figuratively speaking. You must take upon yourself to find the open doors,
shut them, and lock them tight. The guiding principle for browser security is to place
high restrictions on all web sites by default, while giving trusted sites only limited
security restrictions. This will allow trusted sites to function with limited or no
problems.
Because of the many changes occurring with Microsoft products, including the
release of Internet Explorer 7 in October 2006 and the Vista operating system in
January 2007, as well as the growth in popularity of the Firefox browser, I am no
longer focusing on instructions for specific software. Instead, I will discuss the broad
issues surrounding browser privacy and security and point you to sites where you
can learn the details of securing your own particular browser and other software.
In August 2005, Microsoft released an upgrade to IE version 6 that was only
available to users of Windows XP SP2. For more information on IE6 for Windows XP
SP2, I recommend these sites to readers who still use IE6:
Windows XP Service Pack 2: What's New for Internet Explorer and Outlook Express
http://www.microsoft.com/windowsxp/sp2/ieoeoverview.mspx
Comparison of the Internet Explorer Security Zones in Windows XP Service Pack 2
http://surfthenetsafely.com/ieseczone5.htm
Then, on November 1, 2006, Microsoft began offering Internet Explorer 7, since
renamed Windows Internet Explorer, as a high-priority update via Windows
Automatic Updates. Microsoft is no longer updating its browser for any operating
systems other than XP Service Pack 2, Windows Server 2003, and Windows Vista.
177 "The Ten Immutab le Laws of Security ," Microsoft Security Essays,
(14 November 2006) .
178 The advent of Windows XP Service Pack 2 in 2004 addressed some of these "open door" privacy
and security issues , but certainly not all of them . The safest rule is never to assume any product is
secure and always read the instructions on how to implement higher levels of privacy and security. A
good starting place for Windows security help is Microsoft Technet Security.
(14 November 2006).
UNCLASSIFIEDNFOR OFFICIAL ~&E g~Jb¥ 525