Users can determine exactly what a Web page can do in each zone. For example, a page in a trusted zone could download and run any ActiveX control, whereas an untrusted site could only download signed controls from commercial ISVs or none at all, officials said.
Users can create additional zones and modify the security settings for each zone.
The zones also can be defined by systems administrators through policy settings, which are unavailable to end users. Microsoft is incorporating Java security capabilities into IE 4.0 as well, which will enable users to limit which Java applets can be downloaded from a trusted zone, or allow only signed Java applets to be run. Contained within the signature of a Java applet will be information about what that applet wants to do, such as reading or writing to a hard disk. Users can limit these functions in certain zones. For example, a signed applet might be able to read, write and establish a network connection.