Defining Security Parameters

An acceptable software policy explains what an organisation does to help prevent the installation and use of unapproved software. Any program on a computer could contain a weakness an attacker can use, so the policy controls what software is allowed and how it gets onto the devices. It is not the same as an acceptable use policy, which covers how staff behave online rather than what software sits on the devices.

Why unapproved software is risky

• Malware can be hidden inside a program from an untrusted source and then spread across the network, so the whole organisation is affected, not just the one computer.
• Conflicts happen when a program does not work with the organisation's hardware, its operating system version or another program already installed, which can cause crashes and lost work.

How software gets approved

Users are usually forbidden from installing software or even updates themselves, because a helpful-looking tool can still be a risk. If someone needs something new, they either choose from an approved list or make a request. On the request they must justify why the job cannot be done without it — for example, a designer at a print firm explaining that a client sends artwork in a format the current program cannot open. An IT manager then considers the request, checking the licence cost and whether the program fits the existing setup before approving or refusing it.

What the policy protects against

Operating system safeguards support the policy: where a user account has no administrative rights, the operating system simply refuses to install new software.

A software audit is a check of the software installed on the computers an organisation owns. It compares what is actually on each machine with what the organisation believes should be there, and anything that does not match is put right.

Software audits and monitoring are how an acceptable software policy is enforced. The policy states the rules, but only an audit shows whether they are really being followed, because nobody can know by memory what is sitting on hundreds of machines. Monitoring software does the same job automatically by logging what each computer holds, so an audit does not have to rely on someone checking every machine by hand.

What an audit checks

An audit is not just a licence count. It checks four things:

Imagine a chain of six garden centres runs an audit. It finds the automatic ordering tool in the stock program switched on for all staff, though only the manager orders stock, so it is switched off for everyone else. It finds the stock program on 40 computers when only 28 tills run it, so 12 licences are dropped at renewal. It finds a laptop with a drawing package nobody bought a licence for, so that copy is removed. It finds two anti-virus products installed side by side, each paid for yearly, so the second subscription is cancelled.

Each finding saves money or keeps the organisation within the law, which is what the acceptable software policy is trying to achieve.

A usage audit uses a monitoring program installed across an organisation's computers to log which programs are installed and when each one is opened or used. The monitoring program quietly records, for every machine, the software found on it and the times that software is launched, then reports back. Over a few weeks this builds a picture of what is actually being used, rather than what people say they use.

What the log shows

Because the monitoring program timestamps every launch, the audit can flag programs that have not been opened recently: staff set a threshold, such as a term, and anything untouched within it appears in the report. A program that nobody has started on any computer for months is a strong signal that it is not needed. Each flagged program can then be investigated: perhaps one team still relies on it occasionally, or perhaps it was left behind when a project finished. If no one needs it, it can be uninstalled.

For example, a college's monitoring program might show that a video editing package was opened regularly until a media project ended, and has not been launched on any of the college's computers since. IT staff check with the media tutor, confirm the project is finished, and remove the software.

Why this supports the acceptable software policy

• Reducing vulnerabilities: every installed program is another piece of code that could contain a security flaw. Removing software nobody uses takes away those flaws before an attacker can exploit them.
• Avoiding licence costs: many programs are paid for per installation or per user. Uninstalling unused copies means the organisation stops paying to license idle software, and can renew fewer licences.
• Evidence, not guesswork: the log gives concrete proof of what is installed and used, so decisions to remove software are based on recorded facts and no one loses a tool they depend on.

In each case the audit makes the acceptable software policy easier to enforce, because it shows which software is present, who is using it and whether it earns its place.

A licence audit uses an auditing program to scan the computers owned by an organisation and compare what it finds. It looks for inconsistencies between different computers, such as one machine running an older version of a program than another, or a program appearing on a computer where it should not be. The audit produces a report that IT staff can act on.

What the report lists

For each computer, the auditing program records which programs are present, which version of each one is running, when it was installed and whether a licence is held.

This gives a full picture instead of just a count of copies. The report highlights where computers differ, so staff know which ones need attention.

Acting on the audit

The audit leads to remedial action: updating software to the latest version, purchasing a licence, or uninstalling software. For example, a theatre company's audit finds six box-office PCs still running version 2.3 of its ticketing program while the rest run 2.5, so those six are updated. It also finds a video editor on a backstage laptop with no licence record, so the company buys a licence or removes it.

An organisation normally buys permission to install and use a program on an agreed number of installations. Exceeding that number breaks the agreement, so the organisation must buy more licences or uninstall copies. A licence audit helps identify software installed without a licence, so the organisation can act and avoid legal action or fines.

An acceptable use policy (AUP) is a document that sets out how staff are expected to behave when they use an organisation's digital systems — its computers, network, email and internet connection. Everyone signs the same rules, so it is clear what counts as sensible use. It is not the same as an acceptable software policy, which deals with installing software.

Rules that protect access

Staff must keep their login details to themselves. Sharing a password, even with a trusted colleague, means the system can no longer tell who did what, so someone could see or change files they are not allowed to. Passwords must be changed regularly so an old leaked password stops working. A strong password — long, with a mix of letters, digits and symbols — is much harder to guess or crack than a short one.

Screens should lock automatically after a short period of inactivity, and staff should sign out at the end of a session. An unlocked login lets the next person read confidential information, such as client notes or bank details.

Rules that protect the network

A wallpaper file from a fan site can hide malicious code, so staff should not download files from the internet without IT approval. A memory stick from home can carry malware, so connect only organisation-issued removable media. Work equipment should not be used for streaming films, shopping online or personal email, because these tasks add more chances for malicious adverts or links to appear.

Rules that protect people

Opening a website with offensive jokes or rude images can make nearby colleagues uncomfortable, so sites like these are banned. Cyberbullying — for example, repeatedly excluding a colleague from a team chat or adding mocking emojis — is banned because it can make someone feel isolated and anxious. If equipment is damaged or stolen, report it to the service desk straight away so it can be repaired or replaced and, if stolen, its account disabled and files wiped remotely.