Home Page

Table of ContentsChapter 1: IntroductionChapter 2: General Protocol and Policy StatementsChapter 3: Risk AssessmentChapter 4: Physical Security PoliciesChapter 5: Information Security Policies

Chapter 6: Software Security PoliciesChapter 7: User Access Security PoliciesChapter 8: Network and Internet Security PoliciesChapter 9: Administrative Policies and ProceduresChapter 10: Training ProtocolAppendices Index




6   Software Security Policies
 

 

This site constitutes a dynamically changing security protocol. This is only the beginning of its possibilities. It is designed to assist Indiana School Boards, Administrators, and Teachers to implement safe data and information systems. As schools develop policies and encounter changing technological systems, there will be a need for amendments to this document. If school districts would like to share documents that could be used on this site as examples, we would welcome that. Suggestions, additions, comments, or questions about this protocol should be directed to the webmaster at <securityinfo@purdue.edu>. Thank you.




6.1  Reasons for Software Security Policies -- Software is a valuable resource that allows computers to do what you want them to do. Software can be stolen, copied, and corrupted in many ways. This is an expensive loss. Imported software or viruses can also cause damage to hardware, other software and data. 

 

6.2  Software security and acceptable use policy. It is important to keep software secure and under control. A list of acceptable software for the school's systems should be compiled. This is the software that the IT department will support. If school personnel need specific software for their work, permission should be obtained from the IT department or administration.



6.3  Virus Prevention, Detection, and Removal -- There are thousands of computer viruses, worms, Trojan horses, and other destructive programs. If they are imported onto a computer they can cause great damage. For that reason computer systems must be protected from these viruses with special anti virus programs that detect and remove these unwanted programs. Every computer should be equipped with a strong anti virus program. 

6.3.1  Regular virus list update -- New viruses are being created every day. And anti virus program companies are continually developing new lists of viruses and protection from them. For that reason, regular (i.e., weekly) updating of virus lists is imperative. 

6.3.2  Routine use of anti virus program -- An anti virus program should be running at all times when any school computer is in use. In addition regularly scheduled virus scans should be done or programmed so that the entire system can be screened for viruses. 

6.3.3  Scanning disks used from other systems. Disks from other systems that are used with school computers should be screened for viruses before use. This can be done automatically by adjusting the anti virus program's setting, or it can be done manually. 

6.4 Controlling Interactive Software. Interactive software includes games and other programs that require the computer operator to interact with the program in some way. These programs can be installed on a computer or they can be used over an internal or external network, such as the Internet. Some of these programs can be highly useful and therapeutic in a work setting, and others (i.e., some games) can take up valuable disk space and work time, and can introduce malicious code. Policies related to the use of only authorized software should address this kind of software. 


6.5 Software Licensing

6.5.1  All software used must be licensed to the organization or its representative using the software. Programs may only be used in the way that they are intended. For example, most software is licensed for one computer at a time use. That license should be respected. All licensing information and software documentation should be kept in a secure and readily accessible place.


6.6  Encryption. See the encryption discussion in Chapter 5. 


green horizontal line

Go to the Top of the Page To the Purdue University Home Page Go to the I.A.S.E.P. Project Home Page



Draft 5/29/00  v2
 

Updated 7/27/00.

Copyright © 1999 - 2000  Purdue Research Foundation, Inc.  All Rights Reserved.

Questions? Comments? Suggestions? Additions?  Send them to the webmaster at securityinfo@purdue.edu.