Here's a fun cybersecurity contradiction...
We spend years teaching users:
"DON'T OPEN RANDOM FILES FROM THE INTERNET."
Then we hire IT people whose entire job is basically:
"Hey, can you download this random file from the internet and figure out why it doesn't work?" 😂
Vendor sends a file? Open it.
Customer sends a database? Take a look.
Someone sends a "sample" to reproduce an issue? Sure thing.
And that's why I think controls like this are especially important for technical teams.
Today's setting...
Open Registry Editor & Go to:
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Office\16.0\Access\Security
BlockContentExecutionFromInternet
Set it to: 1
This setting tells Microsoft Access to block content execution from databases that originated from the Internet.
In other words:
👍 Open the database? Sure.
Let the code inside immediately start doing stuff? Maybe let's not. 😅
Microsoft Access databases aren't necessarily just boring tables full of customer names and invoice numbers. They can contain active content, including VBA, & VBA can interact with the operating system, manipulate files, call other applications and perform actions using the context of the person who opened it. That's useful functionality.
It's also exactly why blindly trusting an Access database downloaded from the Internet isn't a fantastic security strategy. And here's where I think IT teams sometimes get overlooked.
We spend a TON of time training end users about phishing.
- "Don't open unexpected attachments."
- "Don't download unknown files."
- "Don't click that link."
Meanwhile, your help desk technician gets an email saying:
"Hey, this database isn't working. Can you take a look?"
And opening weird stuff is literally part of their job.
IT administrators, help desk technicians, developers and consultants regularly handle files that normal users would have absolutely no reason to touch.
- Vendor files.
- Customer files.
- Troubleshooting packages.
- Sample databases.
- Proof-of-concept files.
- Stuff downloaded from GitHub.
Stuff downloaded from a forum post written by xXQuickBooksGod420Xx in 2013. You know..."trusted enterprise resources" 😂 That's why technical ability doesn't automatically make someone immune to malicious content.
What this setting does:
Blocks content execution from Access databases identified as originating from the Internet. It adds protection without simply banning Access altogether
What it does NOT mean:
-Every Access database is malicious
-Your users can't use Access anymore
-You can stop teaching people about phishing
- Chad from Accounting can finally open every attachment titled "FINAL_INVOICE_REAL_FINAL.accdb"
Sorry Chad.
We're still watching you. 👀