Office will block internet macros. Get ready
Office will soon block VBA macros in files from the internet by default. Good news, if you plan for the files that break.
Microsoft announced last week that Office will block VBA macros in files that came from the internet, by default. No more yellow “Enable Content” button sitting one click away from an infection. Excel 4.0 macros are being switched off by default too.
This is a big deal. Macro documents have been one of the most common ways ransomware starts for years: an invoice in a Word file, “enable content to view”, and it’s over.
Get ready before it reaches your users:
- Find the macros you actually use. Finance and operations often depend on a few spreadsheets.
- Trust them properly: store them in trusted locations or sign them, instead of telling people to unblock files.
- Don’t teach people to remove the “mark of the web”. That’s exactly what attackers will ask them to do.
- Set the policy yourself now through Group Policy or Intune, so you control the timing.
Expect attackers to move to other file types, such as ISO and ZIP files with shortcuts inside. Block those as email attachments where you can.