Microsoft Office macros represent significant efficiency but also a vulnerability when not managed correctly.  The ability to automatically execute tasks and code is a double edged sword when entire systems may be impacted.  Verification and testing of macros is mandatory, underpinned by secure distribution, policy, and digital signatures.  Rare is the environment without macros where disabling them completely becomes an option.  Consider macros beyond the Microsoft space.  Do not trust any macros that have not been vetted.  Revoke the ability of users to modify the macro policy settings.  Train staff on macro safety.  Restrict macro privileges.  Enable auditing and alerting.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s