Office macro security doesn't have to be all or nothing

What are macros and what’s the problem?

Macros are small programs added to Microsoft Office files that automate repetitive tasks. They are useful for creating document templates or automating calculations within Excel and are often included in business processes.

Macros contain code to perform their functions, and unfortunately, they represent a security risk as malicious actors can embed malware and try to bypass security controls and gain access to systems. Allowing macros to run can create a risk for data and identity theft, ransomware, and other cyber security incidents.

To mitigate this risk, organisations must have a way to identify the macros that are safe and used for legitimate purposes and allow them to run while blocking other macros and mitigating the risk that they present.

What can be done?

Common options are to block macros that originate from the Internet, or by whitelisting storage locations macros can run from, but these are only partial measures that don’t fully address the risk.

The best way to manage Office macro security is to have every macro assessed before it can be used and to only allow macros with a digital signature to run. A digital signature provides assurance that the macro was created by a trusted source.

Assessing macros and applying digital signatures gives the best level of security control, but the assessment process can be time consuming and can be beyond the technical capability of the business uses who create Office macros. Macrosine makes managing Microsoft Office macro security easy.

How important is it to control macros?

In addition to the cyber security risks, Office macro security is well and truly on the radar for regulatory compliance bodies in Australia and around the world. Security controls related to Office macros are now requirements in the following security standards:

  • The Australian Cyber Security Centre (ACSC) Essential Eight strategies to mitigate cyber security incidents (Essential Eight) …learn more

  • The Australian Digital Health Agency (ADHA) Security Requirements for My Health Record Connecting Systems Conformance Profile …learn more

  • Australian Energy Sector Cyber Security Framework (AESCSF) ...learn more

  • Australian Protective Security Policy Framework (PSPF) ...learn more

So how can Macrosine help?

Macrosine is so simple that anyone in your organisation can use it. Simply upload your files for the highest level of security scanning. If the file is safe Macrosine will apply a digital signature and make it available to download.

A man with glasses working on a laptop in an office with a woman in the background at her desk.

Built with compliance-in-mind

Australia: Supports alignment with frameworks such as Essential Eight, PSPF, AESCSF, APRA CPS 234, ADHA controls, ISO 27001 and NIST.

New Zealand: Supports alignment with NZISM, NIST and ISO 27001 security controls through automated macro assessment, digital signing and auditability.

Blue background with a glowing right-pointing arrow symbol in the center.

Beyond Office macros

Macrosine helps organisations apply the same governance principles used for Office macros to PowerShell scripts, providing greater confidence that approved code is safe, trusted and ready for use.