Security on the Internet: Overview

Alerts and certificates

Displaying security alerts

Managing security certificates

Active Content

Controlling cookie downloads

Deleting a cookie

Disabling or enabling a cookie

Viewing cookie information

Downloading ActiveX Controls

Running Java applets

Viewing the Java messages log

Using scripting

Internet ratings

What are Internet Ratings?

Screening out inappropriate content

Adjusting the type of content others can see

Allowing others to view unrated content

Allowing others to view restricted content

Using a ratings bureau

Security zones

What are security zones?

Setting a security level for each zone

Assigning a Web site to a security zone

Security on the Internet: Overview

The Internet works by sending information from computer to computer until the information reaches its destination. So when data is sent from point A to point B, every computer in between has an opportunity to look at what's being sent. This can pose a security problem.

For example, suppose you see a clothing catalog on the World Wide Web, and you decide to buy a shirt. This requires that you type certain facts, including your credit card number, into an order form. You know the clothing company in question is reputable, so you type your information, and then send the completed form. Your information passes from computer to computer on its way to the clothing company. Unfortunately, one of the computers in between has been infiltrated by criminals who watch the data passing through that computer until they see something interesting, such as your credit card number.

Another security problem relates to how files and programs are sent and received between Web sites and your computer. With no security protection, you could run or download files and programs from the Internet that can damage your computer and the information stored on it.

Microsoft Internet Explorer helps to protect you and your data by supporting the following security standards:

• Secure Sockets Layer (SSL) 2.0 and 3.0 and Microsoft Windows NT® allow you to send information to secure sites with safety and confidence. Secure sites are equipped to prevent unauthorized people from seeing the data sent to and from those sites. When you are viewing a secure site, Internet Explorer displays a lock icon on the Status Bar.
• Site certificates verify a Web sites identity so that you can feel secure that credit card numbers and other information you send over the Internet go to the owner of the certificate and no one else.
• Security zones let you assign Web sites different level of security based on your level of confidence.
• Security alerts warn you before you visit, submit, or download items that have the potential of threatening your security.

Related Topics
Displaying security alerts
Managing security certificates

To display security alerts

1. On the Edit menu, click Preferences.
2. Under Web Browser, click Security.
3. Select the check boxes that correspond to alerts you want to see.

• Alerts are useful reminders that you are sending sensitive information, such as credit card numbers, over the Internet.
• A lock icon on the Status Bar at the bottom of the browser window indicates a secure site. If you don't see the Status Bar, click Status Bar from the View menu.

Related Topic
Assigning a Web site to a security zone

To manage security certificates

When you try to open an organization's Web site, Internet Explorer verifies that the Internet address stored in the certificate is correct and that the current date precedes the expiration date. Internet Explorer verifies the following:

• The address of the web site matches the certificate
• The current date is within the certificate's valid date range
• The issuing certificate authority (CA) is on the CA list

1. On the Edit menu, click Preferences.
2. Under Web Browser, click Security.
3. Select a certificate from the list, and then do one of the following:
   • To delete a certificate, click Delete.
   • To view certificate information, such as the expiration date or fingerprint, click View.
4. To set up a password so that others will not be able to make changes to your certificates, click Set Password.
5. To return to your default settings, click Reset to Defaults. This restores any certificates that you have removed and deletes your password.

To control cookie downloads

1. On the Edit menu, click Preferences.
2. Under Receiving Files, click Cookies.
3. From the When Receiving Cookies menu, select a setting.

Related Topics
Deleting a cookie
Enabling and disabling a cookie
Glossary (cookies)
Viewing cookie information

To delete a cookie

1. On the Edit menu, click Preferences.
2. Under Receiving Files, click Cookies.
3. In the list, select the cookie you want to delete.
4. Click Delete.
   The next time you visit the site whose cookie you deleted, a new cookie will be downloaded.

To disable or enable a cookie

This feature applies only if the When Receiving Cookies feature is set to Ask For Each Site or Ask For Each Cookie.

1. On the Edit menu, click Preferences.
2. Under Receiving Files, click Cookies.
3. In the list, select the cookie whose setting you want to change.
4. Click Accept Cookie/Decline Cookie.
   The actual text on the button will change depending on the state of the cookie that you have selected.

To view cookie information

1. On the Edit menu, click Preferences.
2. Under Receiving Files, click Cookies.
3. In the list, select the cookie whose information you want to view.
4. Click View.

To download ActiveX Controls

1. On the Edit menu, click Preferences.
2. Under Web Browser, click Web Content.
3. Select the Enable ActiveX check box.

To run Java applets

1. On the Edit menu, click Preferences.
2. Under Web Browser, click Java.
3. Select the Enable Java check box.
4. Select a Java Virtual Machine.
5. If you want a warning message to appear when an error occurs, select the Alert on Exception check box.
6. If you want the Java output to be stored in the Java messages log, select the Log Java Output check box.
7. If you want Java errors to be stored in the Java messages log, select the Log Java Exceptions check box.
8. If you have downloaded Java classes from the Internet to your computer and want to use them, click Add and locate the folder containing the Java classes.
9. Select one of the following options from the Byte-Code Verification menu.

   Don't Check Code	The lowest form of verification. Neither byte code on your local drive nor on the network are inspected.
   Check Remote Code	Only applets coming from the network are inspected. Any byte code that may previously have been installed on your local drive will not be verified.
   Check All Code	The highest form of verification. Byte code coming from both your local drive and the network is inspected.

10. Select one of the following from the Network Access menu:

    Applet Host Access	Medium-level security: After an applet is downloaded, it can send and receive information only to and from the server from which it was downloaded.
    No Network Access	High-level security. After an applet is downloaded, it cannot access any servers on the Internet.
    Unrestricted Access	Low-level security. Java applets can send and receive information to and from any server on the Internet.

11. To prevent Java applets from reading, creating, or modifying files on your local hard disk, select the Restrict Access To Non-Java Class Files check box. When this box is selected, Java applets have access only to files essential to the program.

• Downloading Java applet files may take longer over slow modems. If you are not interested in Java applets, you can improve performance by disabling Java.

Related Topic
Viewing the Java messages log

To view the Java messages log

• On the View menu, click Java Messages.

Related Topic
Running Java applets

To use scripting

1. On the Edit menu, click Preferences.
2. Under Web Browser, click Web Content.
3. Select the Enable Scripting check box. If a Web page uses JavaScript or JScript and the Scripting check box is not selected, you might be able to view the elements, but you will not be able to use them. For example, if a script is used to create a pop-up menu, you might be able to see the menu items, but nothing will happen when you select a menu item.
4. From the Active Scripting Error Alerts menu, select the amount of information you want to see when a scripting error occurs.
5. Select the Show Unsupported Scripting Languages Errors check box to see alerts when you display a page that uses a scripting language not supported by Internet Explorer, such as Visual Basic Scripting Edition.

What are Internet Ratings?

With Internet Ratings support, Internet Explorer provides a way to help you control the types of content that your computer can access on the Internet. After you turn on Internet Ratings, only rated content that meets or exceeds your criteria can be displayed. You can adjust the settings.

Specifically, Internet Ratings support allows you to:

• Control access to Internet Ratings settings. You turn Internet Ratings on and view the settings by setting up a password. You need the password to change any Internet Ratings settings, so write down your password for future reference.
• View and adjust the ratings settings to reflect what you think is appropriate content in each of four areas: language, nudity, sex, and violence.
• Adjust what types of content other people can view with or without your permission. You can override content settings on a case-by-case basis.
• View and change the ratings systems and bureaus you use.

Internet Ratings is set to the most conservative (least likely to offend) settings when you first enable it. You can adjust these settings to match your own preferences.

Not all Internet content is rated. If you choose to allow other people to view unrated sites on your computer, some of those sites could contain inappropriate material.

Related Topics
Adjust the types of content that others can see
Screen out inappropriate content
Allow others to view restricted content
Allow others to view unrated content

To screen out inappropriate content

1. On the Edit menu, click Preferences.
2. Under Web Browser, click Ratings.
3. Click Enabled.
4. If you have never set Internet ratings, click Change Password.
5. Type a new password. By default, no password is provided.
6. Confirm your new password by typing it again.
7. Choose rating levels for violence, sex, nudity, and language.
   A description of the selected level is provided.

Tips

• Remember your password. You will need to type it any time you change the Ratings settings.
• By default, Internet Explorer uses the rating system provided by the Recreational Software Advisory Council (RSAC). For more information about RSAC see http://www.rsac.org/. (Note that this link points to a site that is not under the control of Microsoft. Please read our disclaimer.)
• You can download other rating services and use them instead of RSAC. To do so, click Add Service in the dialog box, and locate the new service.

To adjust the type of content others can see

1. On the Edit menu, click Preferences.
2. Under Web Browser, click Ratings.
3. Click Enabled.
4. If you have never set Internet ratings, click Change Password.
5. Type a new password. By default, no password is provided.
6. Confirm your new password by typing it again.
7. Choose new rating levels for violence, sex, nudity, and language. A description of the selected level is provided.

To allow others to view unrated content

1. On the Edit menu, click Preferences.
2. Under Web Browser, click Ratings.
3. Type the supervisor password for your computer.
4. Click the Options button.
5. Select the User Can View Sites That Have No Rating check box.

Allowing others to view restricted content

To allow others to view restricted content

1. On the Edit menu, click Preferences.
2. Under Web Browser, click Ratings.
3. Type the supervisor password for your computer.
4. Click the Options button.
5. Select the Supervisor Can Type A Password to Allow User To View Sites That Have No Rating check box.

Related Topics
Allowing others to view unrated content

To use a ratings bureau

1. On the Edit menu, click Preferences.
2. Under Web Browser, click Ratings.
3. Click Options.
4. In the Ratings Bureau box, type the address of the ratings bureau you want to use.

• Using a ratings bureau can slow down Internet access time.

What are security zones?

You can tell which zone the current Web page is in by looking at the left side of the Status Bar. Whenever you attempt to open or download content from the Web, Internet Explorer checks the security setting for that Web site zone.

There are four different zones:

• Local Intranet zone: This zone contains any addresses that are on your organization's Intranet. Addresses may be added to this zone by your system administrator. The default security level for the Local Intranet zone is Medium.

• Trusted Sites: This zone contains sites you trust--sites that you believe you can download or run files from without worrying about damage to your computer or data. You can assign sites to this zone. The default security level for Trusted Sites zone is Low.

• Restricted Sites: This zone contains sites you don't trust--that is, sites that you're not sure whether you can download or run files from without damage to your computer or data. You can assign sites to this zone. The default security level for the Restricted Sites zone is High.

• Internet zone: By default, this zone contains anything that is not on your computer or an intranet, or assigned to any other zone. The default security level for the Internet zone is Medium.

Setting up a security zone requires you to do the following:
Set a security level for each zone
Assign a Web site to a security zone

How you assign security levels and Web sites is completely up to you. The actions for each level are already defined, but you can also create custom settings for the security zone.

Generally, you would trust Web sites on an intranet the most, and would probably set your security setting to Low for that zone. Most programs could then be run or download from these sites with little or no notification.

On the other hand, Web sites in the Restricted Site zone may be these from which you want to avoid running or opening any scripts or active content.

To set a security level for each zone

1. On the Edit menu, click Preferences.
2. Under Web Browser, click Security Zones.
3. In the Zone menu, select the zone for which you want to set the security level.
4. Select a security level.

Tip

• For a detailed description of each option, click the Help button in the Preferences dialog box.

Related Topics
Assigning a Web site to a security zone
What are security zones?

To assign a Web site to a security zone

1. On the Edit menu, click Preferences.
2. Under Security, click Security zones.
3. From the Zone menu, click the Trusted Sites zone or Restricted Sites zone.
4. Click Add Sites.
5. Click Add.
6. Enter the address (URL) for the Web site, and then click OK.

Notes

• You cannot add Web sites to the Internet zone, which includes everything that does not belong to any other zone and is not on your local computer, or the Local Intranet zone, which includes Web addresses that are defined by your System Administrator.

Related Topics
Setting a security level for each zone
What are security zones?