MS Office Policy Settings
[Policy] > [Basic Decontamination Policy] > [MS Office] Settings
MS Office tab is specialized for Microsoft Office documents such as Word, Excel, and PowerPoint.DecontaminationDefines the policy.
This setting is a security threat element that can be included in the document (macro, OLEobject,ActiveXYou can finely adjust whether to remove or keep items such as __PH_0__.
⚠️ The permission to set the basic de-identification policy is granted to [Administrator Type - System Administrator], and
Administrator permission settings can be found under [Administrator Settings] > [Account and Permission Management].
Detailed Description of Settings Items
| Policy Name | Description |
|---|---|
| Object Deletion Settings in Document | Set whether to remove OLE objects (images, shapes, charts, etc.) included in MS Office documents. --- OLE (Object Linking and Embedding) is a feature that allows you to insert or link objects from other programs within a document. There is a risk of malware execution as external programs can be run through OLE objects. |
| Object retention settings within the document | Specifies the type of OLE object to keep without deleting when using "Document Object Deletion Settings". Pbrush, Picture is fundamentally classified as a graphic object and maintenance is recommended. Input example) Pbrush;Picture; --- Objects in the document (e.g., images, shapes, charts, OLE objects, etc.) are various visual or functional elements included in the document. This setting allows you to maintain specific objects to maximize consistency within the document. |
| Macro Processing Settings in the Document | Set whether to remove VBA (Visual Basic for Applications) macros included in MS Office documents. VBA macros are codes that automatically execute when a document is opened, and they are a major pathway for the execution of malicious code. |
| Remove DDEAUTO setting in the document | Set whether to remove the automatic data connection feature between documents, DDEAUTO (Dynamic Data Exchange Automatic Update). DDEAUTO is considered a security threat as it can automatically execute external programs when a document is opened. |
| Remove ActiveX Control Settings in Document | Set whether to remove ActiveX controls included in the document. ActiveX controls are executable objects such as buttons and checkboxes, and are considered a security threat due to the possibility of executing external code. |
| Setting ActiveX Content to be Maintained in the Document | Specify the name of the ActiveX control to exclude from the removal target. PictureFrame is classified as a picture object by default, and maintenance is recommended. Input Example) PictureFrame; |
| Blocking settings for documents prior to MS Office 97 | Set whether to import legacy documents saved in formats prior to MS Office 97. Word 6.0, Excel 95 and other legacy document formats are considered security threats due to their weak document structure and numerous known security vulnerabilities. |
| Remove OLE External Link Settings in Document | Sets whether to remove OLE external links included in the document. OLE external links are considered a security threat as they can automatically reference or execute external files or links when the document is viewed. |
| Remove hyperlink settings in the document | Set whether to remove hyperlinks included in the document. Hyperlinks can lead to malicious sites or cause security threats through external connections. |
Input Rules and Precautions
- When specifying an object or ActiveX content, the input is
세미콜론(;)divided by,Distinguishes between uppercase and lowercase letters. - 'Specify objects to retain in the document' or 'Specify ActiveX content to retain' refers to each removal setting that
ONIt only applies when. - Files prior to MS Office 97 are structurally unstable and have a high possibility of containing malware, soRecommended to blockdoes.
- Removing hyperlinks and OLE links is advantageous for security as they can introduce malicious files through external paths.
Reference Notes
| Terminology | Definition | Security Threats | example |
|---|---|---|---|
| OLE (Object Linking and Embedding) | Inside the document, another document or fileInsert or Connectfunction | The inserted executable file or object isAutomatically run when opening the documentcan perform malicious actions | Included in the Word document.exe, Excel file |
| VBA (Visual Basic for Applications) | Used in MS OfficeMacro Programming Language | Malicious VBA code can execute automatically and affect the system. | Excel Macro Button, Automation Script |
| macro (Macro) | Automating repetitive tasksCommand Collection Mostly written in VBA | Malware can operate without the user's knowledge when executed. | Execute command immediately upon document opening |
| DDEAUTO (Dynamic Data Exchange Auto) | Data between documentsAutomatically synchronizefunction | External documents can execute malicious scripts or commands. | Excel Automatically Reflects Data from External Word Documents |
| ActiveX | For feature extension within the documentControl Tools (button, media, etc.) | External code execution is possible, allowing for the inclusion of malicious control code. | Execute external URL on control click in Excel |
| hyperlink (Hyperlink) | to external websites or files within the documentLink to connect | malicious site or fileInducing Connectionpossible | "Click here" link |
| Documents before MS Office 97 | .doc, .xlsand legacy version MS Office documents | structurally weak,Lack of security features | Word 97 document, Excel 95 document, etc. |
- This setting applies only to MS Office file types (DOC, DOCX, XLS, PPT, etc.).
- After changing the settings, you can check the records and restore them in the [Policy Change History] menu.