S 2.9 Ban on using non-approved software

Initiation responsibility: Agency/company management, Head of IT Section, IT Security Management

Implementation responsibility: Head of IT Section

Provisions must be laid down on how software may be accepted, approved, installed and used (c.f. S 2.62 Software acceptance and approval procedure and Chapter 9.1 "Standard Software"). Installation or use of non-approved software must be prohibited and as far as possible prevented by technical means. For example, this can be achieved under Windows 95 by restricting the user environment (see S 2.104 System guidelines for restricting usage of Windows 95). This is to prevent introduction of programs with undesirable effects. In addition, uncontrolled use of the system beyond the defined range of functions is to be prevented. Where necessary, this ban on use can be extended also to the use of private hardware and private data (floppy disks, removable hard disk, PC, laptop).

Which versions of executable files have been approved must be documented (including creation date and file size). The approved programs must be checked regularly for changes.

The ban on the use of software that has not been approved should be specified in writing and all staff should be informed about it. Prior approval should be required for any exemptions to be granted.

Additional controls:

• Has a procedure for the authorisation and registration of software been laid down?

• Has the ban on use of non-approved software been laid down in writing?

• Have all staff members been informed of the ban?

• Are users periodically reminded of the ban?

• What possibilities exist for installing or using unauthorised software?

• What possibilities exist for autonomous development of software on individual computers?

• Have procedures been defined regarding the programming and passing on of macros from standard products, e.g. word processors, spreadsheets and databases?

• Have any lists been established which show the approved versions of executable files and, in particular, indicate the creation date and the size of the file?

• Are periodic checks made as to whether approved versions of executable files have been altered?

• Is it possible to prevent software from being installed by technical means?