Macros, dialog boxes, and user forms that you write are computer programs, albeit usually rather small ones. But because macros, like any other computer program, can access the user's hard drive and manipulate other sensitive areas of the computer, they can do damage.

Office 2010, Server 2008, and the operating systems Vista and Windows 7 include a variety of security features designed to protect the user from malicious code—macro, virus, Trojan horse, or whatever. But some security features are specific to Office documents and the macros, dialog boxes, and user forms they can contain.

Note that an evil macro can do its damage automatically. It's not necessary for the user to deliberately launch it from the Macros dialog box or from within the VBA Editor. Some specially named procedures automatically launch themselves. For example, if you name one of your procedures Document_Open Sub, all the code within that Sub executes spontaneously when the user opens its host document:

Private Sub Document_Open()

This can be handy, of course. Perhaps you'll want to write some code in this procedure that automatically sets up your preferred zoom level or completes some other housekeeping task that you always perform when opening a document. But the fact that the user doesn't need to specifically choose to run this macro means that a virus can be put into this procedure.

Malicious code can enter a user's computer in three vehicles: macros, ActiveX controls, and add-ins. Microsoft provides users with various approaches to VBA security, including the following:

Office 2007 introduced the concept of two types of documents. For the first time, the user can save documents that simply cannot contain any macros or other potentially malicious code. By default, any new Word document is of the .docx type, not the .docm (macro-enabled) type. In other words, a document must be deliberately created as a macro-enabled document. And because it also must have a .docm filename extension, everybody else (including Word when opening the document) knows that it contains possibly dangerous code. Administrators can use Group Policy to enforce rules concerning which file types are permitted. But the default .docx file type is free of potentially risky executables (code that can execute).

Other Office applications also have pairs of macro-disabled, macro-enabled file types. Excel has .xlsx and .xlsm files, and PowerPoint has .pptx and .pptm files.

New in Office 2010 are tools that common users, administrators, and IT professionals can employ to further secure Office applications from attack:

For additional details about security improvements, see the section later in this chapter titled "New Security in Office 2010."

Real Security in an Insecure World

All the virus-detection software, firewalls, digital signatures, and other security efforts in the world won't protect you or your colleagues if somebody on your network opens email attachments, downloads dodgy executables, or otherwise invites trouble into your environment.

Even if everybody is aware of the dangers and follows the best security practices, viruses and other troubles can still get in. After all, antivirus applications are always playing catch-up. A new virus is released, and then the antivirus forces identify it and send out a new update.

On the plus side, currently it's pretty rare to find macros employed as a vehicle for spreading viruses. And, of course, if you're writing the VBA code yourself—as a reader of this book—you can certainly trust the source of your macros. It's you!

Because threats are constant, and because it's ultimately impossible to guarantee that you will never get a virus (in spite of taking great pains to prevent them), you should ensure that you are taking additional precautions to at least mitigate damage.

Malicious software falls into two broad categories:

• Code that attempts to do damage to you by, for example, erasing files or slowing your computer down so much that it becomes painful to use. The goal here is to create a mess you have to clean up.

• Code that attempts to find out your secrets to do damage to you by, for example, stealing your identity to ruin your credit or to drain your bank account. The issue here is violation of your privacy, a different kind of mess you have to clean up.

If you're concerned about privacy, you should encrypt any documents containing sensitive information. Fortunately, with Office 2007 the formerly weak Office encryption scheme was replaced with a highly secure one. Additionally, Office 2010 has further toughened the built-in encryption schemes as well as adding a new integrity checking technology for encrypted files. PowerPoint, Word, and Excel all permit you to encrypt files and then decrypt them by providing a password. Click the Office button, click the Prepare option in the left pane, and then click Encrypt Document.

If you're worried about a virus attack, be sure to back up your documents (you should do this anyway, in case of a drive crash, fire, theft, and so on). These days, with terabyte external drives selling for around $100, it's practical to store your entire computer system—documents, programs, inbox email, everything—as an image on an external drive. That way, you wouldn't even have to reinstall applications in the event of a serious problem. You can use third-party backup systems. Or use Windows's built-in system by choosing Start

To secure an application against rogue VBA code, you can use the Office Trust Center to choose the level of security that you want the application to use when running VBA code. Click the File tab, then choose Options. Click the Trust Center button in the left pane, and click the Trust Center Settings button.

You can also specify which sources to trust and how much to trust them. A trusted source might be someone who works for the same company as you or someone who has a digital certificate from a third party you trust, such as the VeriSign certification authority. Because you (in this example) trust VeriSign, you therefore trust the third party to whom VeriSign has issued a digital certificate. Office 2010 adds a trusted time-stamping feature to the digital signature technology.

To establish that your own code is fine for the applications to trust, you sign a document or template project that contains customizations or macro project items (code modules, class modules, or user forms) with a digital signature generated by a digital certificate that uniquely identifies you or your company. This chapter shows you this technique first because it sets the stage for specifying the level of security to use.

To secure your code, you can lock a macro project with a password so that nobody can open the code. Doing so serves both to prevent anyone from tinkering with your code and either stopping it from working or rendering it harmful and to protect your intellectual property: If nobody can see your code, they can't steal your ideas. The section "Locking Your Code" shows you how to do this.

VBA provides a security mechanism for securing macro projects with digital signatures. The digital signatures provide a means of establishing the provenance of the projects, which should help you decide whether to trust the code. If you trust the source of the code to produce benevolent code, you can open the project and run the code. If you suspect the source or the information of being malignant, you can either avoid opening the project or open the project with the code disabled.

The same goes for other people: If others are concerned about macros, you may need to sign your projects so that other people know where they come from and who created them. Once you've signed the projects, the code is available to any application that has specified you as a trusted source for macro projects. (This assumes users have chosen one of the Disable options in the Macro Settings dialog box. You'll see how to set the security level later in the section "Specifying a Suitable Security Setting.")

The following sections discuss what digital certificates are, what they mean in practical terms, how you obtain them, and how you use them to create digital signatures.

Getting a Digital Certificate

There are several types of digital certificates: those you create yourself as described earlier, those you get from your company or organization, and those you get from a commercial certification authority, or certificate authority (CA).

A digital certificate you create yourself is of little use to people beyond you and those who trust you, whereas a certificate from a commercial certification authority should be good enough for general use in the world. A certificate issued by your company falls in the middle range of trustworthiness: In many cases, the company will have obtained the certificate from the commercial certification authority, which means the commercial certification authority has established to its satisfaction that the company is trustworthy. Whom the company chooses to trust with the certificate is another matter and introduces another complicating link into the chain of trust. However, server software such as Windows 2003 Server include independent certification-authority services that do not require a certificate from a commercial certification authority, so you should be careful which certificates you trust. See the section "Whose Certificate Is It, and What Does It Mean?" later in this chapter for a discussion of how to discern a certificate's provenance and meaning.

Creating a Digital Certificate of Your Own

The quickest and easiest way of getting a digital certificate is to create one yourself. This kind of certification only works on the computer on which the certificate was created.

To understand how digital certificates work, you'll probably want to create several of your own and practice with them on sample files. By designating some of your digital certificates as trusted publishers and leaving others untrusted, you can get a clear idea of how digital certificates work without having to use suspect code on your system.

To open the Create Digital Certificate dialog box (see Figure 19.1), choose Start

Type the name for the certificate in the text box, and then click the OK button. The SelfCert application creates the certificate and installs it automatically.

Getting a Digital Certificate from Your Company

Your second option is to get a digital certificate from a digital certificate server that your company has. The details of this procedure vary from company to company. The certificates the company provides via its digital certificate server are generated in the same fashion as the digital certificates distributed by the commercial certification authorities discussed in the next section. However, a company distributes the certificates from a pool that it has allocated, without needing to apply to the certification authority for each certificate as it's needed, or creates the certificates of its own accord without getting them from a certification authority.

Figure 19.1. You can self-sign a certificate, but Office only permits such certification to be trusted within the computer where the certificate was created.

Getting a Digital Certificate from a Commercial Certification Authority

Your third choice is to get a digital certificate from a commercial certification authority such as these:

• VeriSign (www.verisign.com)

• Thawte, Inc. (www.thawte.com, a VeriSign company)

• GeoTrust (www.geotrust.com, another VeriSign company)

• DigiCert (www.digicert.com)

• Comodo (www.comodo.com)

VeriSign's computers handle four trillion lookups per day, but the company plans to spend $300 million over the next decade to increase that capacity to four quadrillion.

Several types of certificate are available, depending on what you want to do. If you're creating and distributing software, you'll probably want to consider one of the certificates targeted at developers.

The procedure for proving your identity varies depending on the CA and the type of certificate you want. Generally speaking, the greater the degree of trust that the certificate is intended to inspire, the more proof you'll need to supply. For example, you can get a basic certificate on the strength of nothing more than a verifiable email address, but this type of certificate is unlikely to make people trust you. Other certificate types require you to appear in person before a registration authority with full documentation (such as a passport, driver's license, or other identity documents). Such certificates inspire more trust.

Installing a Digital Certificate

Once you have a digital certificate, you need to install it so that Windows and the applications that will use it know where it's located.

Self-Certifications Are Automatically Registered

The Office SelfCert program automatically registers the certificates it creates on the computer on which it creates them. If you created a digital certificate for yourself, you shouldn't need to install it on the same computer. If you want to practice installing it, you'll need to use a different computer.

To install a digital certificate, follow these steps (you must be logged on as Administrator to view the Certificates dialog box):

1. Click the Start button. A Search programs and files (Start Search in Vista) field opens just above the Start button.

2. In the Search Programs and Files field, type certmgr.msc.

3. When certmgr.msc appears in the Programs list, click it. You'll likely be asked if you want to give yourself permission to take this step. Go ahead and grant the permission by clicking the Continue button.

   You now see the Certificates dialog box shown in Figure 19.2.

   

   Figure 19.2. Windows provides the Certificates dialog box to manage digital certificates.

   As you can see in Figure 19.2, I, Richard, granted code signing certification to myself, also Richard, as described earlier in this chapter in the section "Creating a Digital Certificate of Your Own."

4. Click the Trusted Publishers folder in the left pane of the Certificates dialog box.

5. Choose Action

   

6. Click the Next button in the wizard to locate the file you want to import.

7. Click Next to display the Certificate Store page of the wizard, shown in Figure 19.4.

   

   Figure 19.3. Windows includes the Certificate Import Wizard to manage digital certificates.

   

   Figure 19.4. On the Certificate Store page of the Certificate Import Wizard, choose the certificate store in which to store the certificate you're importing.

8. Choose how to store the certificate:

   • To have Windows store each certificate automatically in the default certificate store for the certificate's type, select the Automatically Select the Certificate Store Based on the Type of Certificate option button.

   • To control where Windows stores the certificates, select the Place All Certificates in the Following Store option button. To specify the store, click the Browse button to display the Select Certificate Store dialog box, shown in Figure 19.5. Choose the certificate store (for example, Personal) and click the OK button. To specify a particular location within a certificate store, select the Show Physical Stores check box, and then click the plus (+) sign next to the store in question to display its subfolders. Select the folder you want, and then click the OK button.

   

   Figure 19.5. Use the Select Certificate Store dialog box to specify the certificate store in which you want to store the certificate. The screen on the left shows the categories of stores; the screen on the right shows the physical stores.

9. Click the Next button to finish setting up the import procedure. The Completing the Certificate Import Wizard dialog box is displayed to confirm the choices you've made.

10. Review your choices, and then click the Finish button. The Certificate Import Wizard imports the certificate and then confirms that the operation was successful.

If you decide to import the certificate into the root certificate store rather than one of the other stores, Windows displays a Security Warning dialog box (see Figure 19.6) to make sure you understand that placing the certificate in the root store will make Windows automatically trust any certificate issued by the CA. Double-check the certificate, as it probably belongs in another store.

Now that you've imported the certificate, it appears in the Certificates dialog box on the appropriate page.

Exporting a Digital Certificate

You may need to export a certificate for backup so that you can keep it safely on removable media away from your computer or so that you can install it on another computer. For security, you should not store the digital certificate on your hard drive after you install it, because storing it there is a security risk.

Figure 19.6. Windows displays a Security Warning dialog box when you're about to import a certificate into the root certificate store.

To export a certificate, select it in the Certificates dialog box and click the Export button. Windows starts the Certificate Export Wizard, which walks you through the process of exporting the certificate. If you choose to export the private key with the certificate, be sure to protect it with a password.

Removing a Digital Certificate

To remove a digital certificate from Windows's digital certificate store, follow these steps:

1. Display the Certificates dialog box (follow steps 1, 2, and 3 in the section earlier in this chapter on installing a certificate).

2. Click the folder in the left pane that contains the digital certificate in question, and then select the certificate you want to remove.

3. Click the red X icon, or choose Action

   

Signing a Macro Project with a Digital Signature

Once you've completed a macro project and have it ready for distribution, you sign it with a digital signature so that applications that use a high level of security can use it.

Figure 19.7. Two of the warnings the Certificate Manager displays when you're about to remove a digital certificate.

To sign a macro project digitally, follow these steps:

1. In the VBA Editor, navigate to the document or template project that contains the macro project.

2. Select the project in the Project Explorer.

3. Choose Tools

   
   

   Figure 19.8. Use the Digital Signature dialog box to specify the digital signature for a macro project.

   If the Digital Signature dialog box lists the certificate you want in the Sign As area, simply click the OK button to use that certificate.

4. Click the Choose button. If you have more than one certificate, you'll see a Select Certificate dialog box. (If you have only one certificate, you'll see the Windows Security dialog box where you can confirm your choice, as shown in Figure 19.9. You should then skip to step 7.)

   

   Figure 19.9. Use this Windows Security dialog box to confirm your choice of certificate with which to sign the macro project.

5. Click the certificate you want to use for the macro project.

6. Click the OK button to apply the selected certificate and close the Select Certificate dialog box.

7. Click the OK button to close the Digital Signature dialog box.

8. Click the Save button on the Standard toolbar, press Ctrl+S, or choose File

   

Removing a Digital Signature from a Macro Project

To remove a digital signature from a macro project, follow these steps:

1. In the VBA Editor, navigate to the document or template project that contains the macro project.

2. Select the project in the Project Explorer.

3. Choose Tools

   

4. Click the Remove button. Both the Certificate Name readout in the area labeled The VBA Project Is Currently Signed As and the Certificate Name in the Sign As area of the Digital Signature dialog box will display [No Certificate] to indicate that the project currently has no digital certificate assigned to it.

5. Click the OK button to close the Digital Signature dialog box.

You can always reapply the digital signature to the project whenever you wish, as described earlier in this chapter.

Whose Certificate Is It, and What Does It Mean?

When you receive a digitally signed project, you'll want to find out who has signed it and what type of digital certificate they used. To view the details of a digital certificate, follow these steps:

1. In the VBA Editor, navigate to the document or template project that contains the macro project.

2. Select the project in the Project Explorer.

3. Choose Tools

   

4. Click the Details button to display the Certificate dialog box (see Figure 19.10).

Figure 19.10. Use the Certificate dialog box to examine the properties of a certificate.

If you want to view the details of one of your own certificates, click the Choose button in the Digital Signature dialog box, choose the certificate in the Select Certificate dialog box, and then click the View Certificate button to display the Certificate dialog box.

You can also view a certificate by double-clicking its entry in the Certificates dialog box.

The Certificate dialog box has three pages:

• The General page displays basic information about the certificate: for what purpose the certificate is intended, to whom it's issued, by whom it's issued, and the period for which it's valid.

• The Details page of the Certificate dialog box, shown in Figure 19.11, contains specifics on the certificate. Click one of the fields in the list box to display its value in the text box below.

• The Certification Path page of the Certificate dialog box shows the path by which the certificate has been issued from the issuing authority to the current holder. To check one of the links in the chain, select it in the Certification Path list box and click the View Certificate button (if it's available). You'll see the Certificate dialog box for the certificate in question. You can then follow the certification path for that certificate if you choose or click the OK button to dismiss the second (or subsequent) Certificate dialog box and return to the previous one.

Figure 19.11. The Details page of the Certificate dialog box contains a host of details about the certificate.

When you finish exploring the certificate, click the OK button to close the Certificate dialog box.

To use VBA macros safely, you or a user of your code must use the Office Trust Center to choose a suitable level of security—high enough to avoid the threats posed by malicious or incompetent code but low enough that it doesn't prevent you from running useful, safe code.

Specifying a Suitable Security Setting

First, set a suitable level of security for your purposes. To open the Options dialog box in Access, Word, Excel, or PowerPoint, click the File tab, then choose Options. Click the Trust Center button in the left pane. Then Click the Trust Center Settings button, and click Macro Settings (see Figure 19.12). The various settings are self-explanatory. However, if you are working in documents that you've created yourself and saved as the .docm type, having written your own macros, you can temporarily choose the Enable All Macros option. At least while you're practicing with the examples in this book, you can trust your own documents. However, if you are opening macro-enabled document files (.docm or the other files from PowerPoint or Excel with an m appended to the filename extension), you should specify a less risky setting in your Trust Center macro settings.

However, there's an easier way that some will prefer. You can alternatively (and more safely) employ one of the disable options shown in Figure 19.12, but while doing development work with VBA (such as experimenting with the code in this book), just ensure that you save your .docm documents in one of the trusted locations. You can see the list of trusted locations by clicking the Trusted Locations button shown in the left pane in Figure 19.12.

Figure 19.12. On the Macro Settings page of the Trust Center dialog box, choose the level of security you want to use when running macros.

New Security in Office 2010

Notice three security features listed in the left pane in Figure 19.12 that are new in Office 2010:

• Trusted Documents

• Protected View

• File Block Settings

Open the Trusted Documents page in the Trust Center dialog box and you'll see the options illustrated in Figure 19.13:

Figure 19.13. On this page of the Trust Center dialog box, choose whether you want to trust individual documents on a case-by-case basis.

When you trust an individual document, you're telling Office that it can stop notifying you or otherwise blocking executable content (such as macros or ActiveX controls) in this document. Thus you can override on a case-by-case basis the macro settings (see Figure 19.12) that you've specified.

Figure 19.14 shows the new Protected View option. This is similar to starting Windows in Safe Mode. In Protected View, executables are disabled. This sort of protection is sometimes referred to as a sandbox. The protected document is in effect quarantined, so it theoretically can't do any harm to your computer or its contents. Theoretically because as we all know, no security is perfect. Note that in its description of Protected View in Figure 19.14, Microsoft carefully states that this mode will "help minimize harm": no claim of invulnerability. All the Protected View options are turned on by default, so files you get from the Internet and Outlook attachments, for example, are automatically tossed into the sandbox when opened.

Figure 19.14. Protected View puts potentially dangerous documents in a sandbox.

The File Block Settings page, shown in Figure 19.15, gives you the ability to block individual file types from opening or open them in Protected View. Here you can also specify which types of files can be saved. Notice at the bottom of this page that you specify what choosing the Open option means:

• Do not open selected file types means documents are totally blocked.

• Open selected file types in Protected View means you can open documents in the sandbox for reading only.

• Open selected file types in Protected View and allow editing means you can open documents in the sandbox for editing.

If you want to delve more deeply into Office 2010 security features, take a look at this web page and the links therein:

http://technet.microsoft.com/en-us/library/cc179050(office.14).aspx

Figure 19.15. File Block Settings specify what types of documents you want blocked or sandboxed.

Can Even a Simple .txt File Harbor a Virus?

You might wonder why the Plain Text Files option is shown in the File Block Settings page shown in Figure 19.15. It would seem that a simple Notepad .txt file couldn't contain any dangerous executable code (any more than a stop sign could fire a bullet at you). After all, it's just words, right?

Nope. Even opening simple .txt files can install a virus. How? The bad guys use trick filename extensions. Executable files (programs or viruses) usually have an .exe filename extension, but by default Windows hides filename extensions. So you see Word, not Word.exe in Windows Explorer. Also, Windows files can be named with multiple extensions. So, you can have a dangerous file named OpenMe.txt.exe, but thanks to the extension-hiding, the filename that you actually see is OpenMe.txt. You go ahead and double-click it thinking it will open in Notepad like most .txt files. Your hard drive explodes. Well, maybe not a detonation, but all your files could be wiped or there could be some other nasty virus surprise. OpenMe.txt was merely posing as a .txt file, and inside was a monster.

Specifying Whom to Trust

VBA provides two ways of designating trusted publishers: by trusting publishers identified in templates and add-ins already installed on the computer and by permitting you to add new trusted publishers that are embedded in documents you open.

Whom Does the Computer Trust Already?

To find out whom the computer trusts already, open the Trust Center by clicking the File tab; then choose Options. Click the Trust Center button in the left pane, and click the Trust Center Settings button. Click the Trusted Publishers option in the left pane. Figure 19.16 shows the Trusted Publishers page of the Security dialog box for Excel 2003.

Figure 19.16. The Trusted Publishers page in the Trust Center lists the computer's current group of trusted sources for code or customizations.

Adding a Trusted Publisher

To add a trusted publisher, open a document or template that contains VBA code from the source you want to add. The application will detect the untrusted code and will display a Security Alert dialog box (see Figure 19.17 and Figure 19.18).

Figure 19.17. When you open a file (or load an add-in) that contains code from a source that isn't currently specified as trusted, the application displays the Microsoft Word Security Notice dialog box.

If the file contains a valid digital signature but it's not in your list of trusted publishers, you see the dialog box displayed in Figure 19.18.

If you want to add a publisher to your list of trusted publishers, click the option button at the bottom of Figure 19.18. To temporarily permit this particular document's risky contents, click the Enable This Content option button.

Figure 19.18. When you open a file (or load an add-in) that contains code from a source with a valid digital signature, you have the option of adding this publisher to your list of trusted publishers.

The Security Alert dialog box shown in Figure 19.18 tells you several things:

• The name and location of the file containing the untrusted code.

• The name of the person or company that signed the code.

• Whether the digital signature on the certificate is trustworthy. (In the figure, it isn't.)

From the Security Alert dialog box, you have several options:

• You can click the Show Signature Details link to display the Certificate dialog box and then inspect the certificate as discussed earlier in the chapter. You'll probably want to take this step first with a file you're not sure about. Examining the certificate may help you decide on one of the next two choices.

• If the Enable This Content option button is available, you can click it to open the file with the procedures and customizations enabled.

• You can click the close button on the Security Alert dialog box to close the dialog box without opening the file. Doing so is useful both when you don't want to deal with the question and when you want to set a different level of security before opening the file. For example, if you have the high level of macro security set and you encounter the Security Alert dialog box, you might want to duck the decision so that you can set a lower level of security in the Trust Center (enable macros, for example) instead. That setting will allow you to enable the procedures in the document or template temporarily without adding their creator to your list of trusted publishers.

Once you've specified a publisher as trusted, any of the VBA-enabled applications will open files containing procedures from that source.

Removing a Previously Trusted Publisher

To remove a previously trusted source from your list of trusted publishers, follow these steps:

1. Click the Start button. A Search Programs And Files (Start Search in Vista) field opens just above the Start button.

2. In the Start Search field, type certmgr.msc.

3. When certmgr.msc appears in the Programs list, click it. You'll likely be asked if you want to give yourself permission to take this step. Go ahead and grant the permission by clicking the Continue button.

4. Click the Trusted Publishers folder in the left pane of the Certificates dialog box.

5. Click the Certificates folder to display the trusted publishers.

6. In the list box, click the trusted source that you want to remove to select it.

7. Click the red X button (or choose Action

   

To prevent anyone from viewing the contents of a macro project, you can lock it with a password. You'll usually want to do this before distributing a project to your colleagues. If your workplace is particularly volatile, you might even want to lock projects under development on your own desktop as well. The argument against locking a project on which you're still actively working is that the lock adds a step to accessing the modules and forms in the project—but if you need the security, it's well worth the small amount of effort involved.

Follow these steps to lock a document or template project:

Figure 19.19. Use the Protection page of the Project Properties dialog box to lock the project.

Once you've done that, the project is locked and can't be viewed or edited without the password. When you choose to edit a procedure in the project from the application or try to expand the project in the Project Explorer in the VBA Editor, the Project Password dialog box appears, as shown in Figure 19.20 (unless you have macros disabled in the Trust Center settings).

Figure 19.20. When you open a locked project, you need to enter the password for the project in this Project Password dialog box.

Type the password in the Password text box and click the OK button to display the contents of the project. (If you enter the wrong password, the application or the VBA Editor displays the Project Locked message box followed by the Project Password dialog box for you to try again.)

To unlock a project, open it in the VBA Editor (supplying the password), display the VBA Project Properties dialog box (by right-clicking the project's name in the Project Explorer, then choosing the Project Properties option from the context menu), clear the Lock Project For Viewing check box on the Protection page, and click the OK button. Save the file that contains the project.