Well, there's not much more to it than the title says, and it seems to me a security issue...
Example; at startup adobe flash player update checker (which I blocked in ZoneAlarm Control Center / ("Program Control / Programs") connects to the internet to check the version. That shouldn't be possible, should it?

What do I do to have ZA initialised at startup BEFORE any program connects to the internet?

Thanks in advance