Microsoft Support Number OR Call Toll-Free @ 1-844-478-2887

Tuesday, May 25, 2010

Office 2010 and Security

Microsoft Office 2000, released over 10 years ago, was the last version for which security was not a large priority. Each successive version of Office has made significant improvements to the point where Office 2007 has, by any reasonable accounting, an excellent security record.

Now Microsoft seeks to step up security further in Office 2010. This web page collects documents on security features of the latest version of the suite.

Blocking and mitigating exploits is only one area where improvements were made, but they are important ones:
• Data Execution Prevention (DEP) support for Office applications—As we reported before release, Office 2010 (unlike 2007) opts in to DEP (Data Execution Prevention) by default. This alone should block whole classes of attacks. It's much more effective in concert with ASLR (Address Space Layout Randomization). Microsoft avoids discussing whether Office 2010 opts in to ASLR, which it must do in order to benefit from it, but my own default installation of Office 2010 on Windows 7 does opt-in.
• Office File Validation—This component checks files for proper format structure before allowing them to open. Many malicious Office (and other product) file attacks rely on improper file formats.
• Expanded file block settings—Office users and administrators can use the Trust Center and Group Policy to control which types of files users can open and save to.
• Protected View—Files which come from untrusted locations are viewed in a special sandboxed environment. The user gets to review them before enabling them for full features. [click here for full size.]

Encryption and authentication are also major themes of the new version. The new apps have more flexibility in using different cryptographic algorithms. Encrypted files now have integrity checking to see if they've been tampered with without decrypting them. Digital signature support can now verify documents even when the signing certificate has expired.,
The encryption and authentication features are aimed at larger organizations, but the exploit mitigation and blocking features work for everyone, and for the most part automatically. Attacks on Office documents have become far less popular in recent years, and unheard of using the new versions with the new document formats. This trend should accelerate with Office 2010.
Post a Comment