Defining Security Parameters
Acceptable software policy
An acceptable software policy explains what an organisation does to help prevent the installation and use of unapproved software. Any program on a computer could contain a weakness an attacker can use, so the policy controls what software is allowed and how it gets onto the devices. It is not the same as an acceptable use policy, which covers how staff behave online rather than what software sits on the devices.
Why unapproved software is risky
- Malware can be hidden inside a program from an untrusted source and then spread across the network, so the whole organisation is affected, not just the one computer.
- Conflicts happen when a program does not work with the organisation's hardware, its operating system version or another program already installed, which can cause crashes and lost work.
How software gets approved
Users are usually forbidden from installing software or even updates themselves, because a helpful-looking tool can still be a risk. If someone needs something new, they either choose from an approved list or make a request. On the request they must justify why the job cannot be done without it — for example, a designer at a print firm explaining that a client sends artwork in a format the current program cannot open. An IT manager then considers the request, checking the licence cost and whether the program fits the existing setup before approving or refusing it.
What the policy protects against
| Risk | How the policy helps |
|---|---|
| Unlicensed software on machines | Only approved programs are installed, and approval checks the licence, so the organisation avoids legal action and fines. |
| Security software being changed or switched off | Staff cannot install tools that disable anti-virus or firewall settings, making unauthorised access harder. |
| Software used for the wrong reasons | Approved programs are for work tasks only, which reduces copyright breaches and misuse of the organisation's software. |
| Viruses being brought in | Fewer unapproved installs mean fewer chances to introduce a virus. Training also helps staff recognise phishing emails and malicious links, so they do not download and run a harmful file by mistake. |
Operating system safeguards support the policy: where a user account has no administrative rights, the operating system simply refuses to install new software.
Practise this
Pearson BTEC Digital Information Technology · Defining security parameters