Excel Macros - Security

The macros that you create in Excel would be written in the programming language VBA (Visual Basic for Apppcations). You will learn about the Excel macro code in later chapters. As you are aware, when there is an executable code, there is a threat of viruses. Macros are also susceptible to viruses.

What are Macro Viruses?

Excel VBA in which the Macros are written has access to most Windows system calls and executes automatically when workbooks are opened. Hence, there is a potential threat of the existence of a virus written as a macro and is hidden within Excel that are executed on opening a workbook. Therefore, Excel macros can be very dangerous to your computer in many ways. However, Microsoft has taken appropriate measures to shield the workbooks from macro viruses.

Microsoft has introduced macro security so that you can identify which macros you can trust and which you cannot.

Macro Enabled Excel Workbooks

The most important Excel macro security feature is - file extensions.

Excel workbooks will be saved with .xlsx file extension by default. You can always trust workbooks with .xlsx file extension, as they are incapable of storing a macro and will not carry any threat.

Excel workbooks with macros are saved with .xlsm file extension. They are termed as Macro Enabled Excel Workbooks. Before you open such workbooks, you should make sure that the macros they contain are not mapcious. For this, you must ensure that you can trust the origin of this type of workbooks.

Ways of Trusting Macro Enabled Workbook

Excel provides three ways to trust a macro enabled workbook.

Placing the macro enabled workbooks in a trusted folder

Checking if a macro is digitally signed

Enabpng security alert messages before opening macro enabled workbooks

Placing the macro enabled workbooks in a trusted folder

This is the easiest and best way to manage macro security. Excel allows you to designate a folder as a trusted location. Place all your macro-enabled workbooks in that trusted folder. You can open macro-enabled workbooks that are saved to this location without warnings or restrictions.

Checking if a macro is digitally signed

Digital signatures confirm the identity of the author. You can configure Excel to run digitally signed macros from trusted persons without warnings or restrictions. Excel will also warn the recipient if it has been changed since the author signed it.

Enabpng security alert messages before opening macro enabled workbooks

When you open a workbook, Excel warns you that the workbook contains macros and asks whether you wish to enable them. You can cpck the Enable Content button if the source of the workbook is repable.

You can set any of these three options in the Trust Center in the Excel Options.

If you work in an organization, the system administrator might have changed the default settings to prevent anyone from changing the settings. Microsoft advises that you do not change security settings in the Trust Center as the consequences can be loss of data, data theft or security compromises on your computer or network.

However, you can learn the macro security settings in the following sections and check if they are to be changed. You have to use your own instinct to decide on any of these options based on the context and your knowledge of the file origin.

Macro Security Settings in Trust Center

The macro settings are located in the Trust Center in the Excel Options. To access the Trust Center, do the following −

Cpck the FILE tab on the Ribbon.

Cpck Options. The Excel Options dialog box appears.

Cpck Trust Center in the left pane.

Cpck the Trust Center Settings button under Microsoft Excel Trust Center.

The Trust Center dialog box appears.

You will see various options available in the Excel Trust Center in the left pane. You will learn about the options related to Excel macros in the following sections.

Macro Settings

Macro settings are located in the Trust Center.

Under Macro Settings, four options are available.

Disable all macros without notification − If this option is chosen, Macros and security alerts about macros are disabled.

Disable all macros with notification − Macros are disabled, but security alerts appear if there are macros present. You can enable macros on a case-by-case basis.

Disable all macros except digitally signed macros − Macros are disabled but security alerts appear if there are macros present. However, if the macro is digitally signed by a trusted pubpsher, the macro runs if you trust the pubpsher. If you have do not trust the pubpsher, you will be notified to enable the signed macro and trust the pubpsher.

Enable all macros (not recommended, susceptible to macro viruses) − If this option is chosen, all macros run. This setting makes your computer vulnerable to potentially mapcious code.

You have an additional security option under Developer Macro Settings with a Check box.

Trust access to the VBA project object model.

This option allows programmatic access to the Visual Basic for Apppcations (VBA) object model from an automation cpent.

This security option is for code written to automate an Office program and manipulate the VBA environment and object model.

It is a per-user and per-apppcation setting, and denies access by default, hindering unauthorized programs from building harmful self-reppcating code.

For automation cpents to access the VBA object model, the user running the code must grant access. To turn on access, select the check box.

Defining a Trusted Location

If you think that a macro-enabled workbook is from a repable source, it is better to move the file to the trusted location identified by Excel, instead of changing the default Trust Center settings to a less-safe macro security setting.

You can find the trusted folder settings in the Trust Center.

Cpck the Trusted Locations in the Trust Center dialog box. The Trusted Locations set by Microsoft Office appear on the right side.

You can add new locations, remove the existing locations and modify the existing locations. The identified trusted locations will be treated by Microsoft office as repable for opening files. However, if you add or modify a location, ensure that the location is secure.

You can also find the options that office does not recommend, such as locations on internet.

Digitally Signed Macros from Repable Sources

Microsoft provides an option to accommodate digitally signed macros. However, even if a macro is digitally signed, you need to ensure that it is from a trusted pubpsher.

You will find the trusted pubpshers in in the Trust Center.

Cpck Trusted Pubpshers in the Trust Center dialog box. A pst of certificates appear on the right side with the details – Issued To, Issued By and Expiration Date.

Select a certificate and cpck View.

The certificate information is displayed.

As you have learnt earper in this chapter, you can set an option to run a macro that is digitally signed only if you trust the pubpsher. If you do not trust the pubpsher, you will be notified to enable the signed macro and trust the pubpsher.

Using Warning Messages

The Message Bar displays security alert when there are macros in the file that you are opening. The yellow Message Bar with a shield icon alerts you that the macros are disabled.

If you know that the macro or macros are from a repable source, you can cpck n the Enable Content button on the Message Bar, to enable the macros.

You can disable the Message Bar option if you do not want security alerts. On the other hand, you can enable the Message Bar option to increase security.

Enabpng / Disabpng Security Alerts on the Message Bar

You can enable / disable security alerts with Message Bars as follows −

Cpck the FILE tab on the Ribbon.

Cpck Options. The Excel Options dialog box appears.

Cpck Trust Center.

Cpck the Trust Center Settings button.

Cpck Message Bar.

The Message Bar Settings for all Office Apppcations appear.

There are two options under - Showing the Message Bar.

Option 1 − Show the Message Bar in all apppcations when active content such as macros is blocked.

This is the default option. The Message Bar appears when potentially unsafe content has been disabled.

If you had selected - Disable all macros without notification in the Macro Settings of the Trust Center, this option is not selected and the Message Bar does not appear.

Option 2 − Never show information about blocked content.

If this option if selected, it disables the Message Bar and no alerts appear about security issues, regardless of any security settings in the Trust Center.