Macro Security

A macro is a sequence of program commands that have been recorded and saved and can be executed with a single command. Outlook has its own macro capabilities. More germane to the topic of security, however, are the macros in programs such as Microsoft Word and Excel. Such macros are part of the document file and as such are included when the file is sent as an e-mail attachment. A malicious macro can be set to execute automatically when the file is opened and can potentially wreak havoc on your system and data files. Such viruses are called macro viruses.

Anti-virus programs catch most macro viruses, and the precaution of not opening attachments from unknown sources is another layer of protection. The final layer of protection against macro viruses is the macro security level in your programs.

Macro security applies to all Office programs, and it is set in the Trust Center. The Trust Center is an Office component, not specifically part of Outlook or any other any program. On Outlook, you access the Trust Center by selecting Trust Center from the Tools menu. Then, in the list on the left, click Macro Security. The Macro Security screen is shown in Figure 28-16.

Figure 28-16. Setting macro security in the Trust Center.

[View full size image]

You can see that the options mention signed macros. Digital signing is a way that the person who creates a macro can “sign” it so that the recipient can be assured that it comes from a trusted source. You’ll learn more about digital signatures later in this chapter. You can choose from four levels of macro security, described here from the strictest to the least strict:

• No Warnings and Disable All Macros: No macros, whether signed or not, are ever run.

• Warnings for Signed Macros; Unsigned Macros are Disabled: For a signed macro, the program displays a warning and asks you whether it should be run. Unsigned macros are never run. This is the default macro security level.

• Warnings for All Macros: The program displays a warning for any macro, signed or unsigned, and asks you whether it should be run.

• No Security Check for Macros: All macros are run without a warning. For reasons that are probably obvious, this level is not recommended.

The default level of macro security for all Office programs is recommended. You can always set a lower level temporarily if you want to run some unsigned macros from a trusted source.