Security Status Bar

Although many users have become quite familiar with Secure Sockets Layer (SSL) and its associated security benefits, a large proportion of Internet users remain overly trusting that any Web site asking for their confidential information is protected. Internet Explorer 7 addresses this issue by providing clear and prominent visual cues to the safety and trustworthiness of a Web site.

Previous versions of Internet Explorer place a gold padlock icon in the lower-right corner of the browser window to designate the trust and security level of the connected Web site. Given the importance and inherent trust value associated with the gold padlock, Internet Explorer 7 and later versions display a Security Status bar at the top of the browser window to highlight such warnings. By clicking this lock, users can quickly view the Web site identification information

In addition, Internet Explorer displays a warning page before displaying a site with an invalid certificate.

Finally, if a user continues on to visit a site with an invalid certificate, the address bar, now appears on a red background.

Phishing

Phishing-a technique used by many malicious Web site operators to gather personal information- is the practice of masquerading online as a legitimate business to acquire private information, such as social security numbers or credit card numbers. These fake Web sites, designed to look like the legitimate sites, are referred to as spoofed Web sites. The number of phishing Web sites is constantly growing, and the Anti-Phishing Working Group received reports of more than 10,000 different phishing sites in August 2006 that were attempting to hijack 148 different Web sites.

Note For more information about the Anti-Phishing Working Group, visit http://www.antiphishing.org/.

Unlike direct attacks, in which attackers break into a system to obtain account information, a phishing attack does not require technical sophistication but instead relies on users willingly divulging information, such as financial account passwords or social security numbers. These socially engineered attacks are among the most difficult to defend against because they require user education and understanding rather than merely issuing an update for an application. Even experienced professionals can be fooled by the quality and details of some phishing Web sites as attackers become more experienced and learn to react more quickly to avoid detection.