IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.9 Ban on using non-approved software
Initiation responsibility: Agency/company management; Head of IT
Section; IT Security Management
Implementation responsibility: Head of IT section
Provisions must be laid down on how software may be accepted, approved,
installed and used (c.f. S 2.62 Software acceptance and approval Procedure
and Chapter 9.1 Standard Software). Installation or use of non-approved
software must be prohibited and as much as possible prevented via technical
means. For example, this can be attained under Windows 95 by restricting the
user environment (see S 2.104 System guidelines for restricting usage of
Windows 95). This is to prevent introduction of programs with undesirable
effects. In addition, uncontrolled use of the system beyond the defined range
of functions is to be prevented. Where necessary, this ban on use can be
extended also to the use of private hardware and private data (floppy disks,
removable hard disk, PC, laptop).
Prior approval should be required for any exemptions to be granted.
Additional controls:
- Has a procedure for the authorisation and registration of software been laid
down?
- Has the ban on use of non-approved software been laid down in writing?
- Have all staff members been informed of the ban on use?
- Are reminders periodically given of the ban on use?
- What possibilities exist for installing or using unauthorised software?
- What possibilities exist for autonomous development of software on
individual computers?
- Do regulations exist concerning the programming and passing on of
macros of standard products, e.g. text processing, table calculation and data
bases?
- Have any lists been established which show the approved versions of
executable files and, in particular, indicate the creation date and the size of
the file?
- Are periodic checks being made of whether approved versions of
executable files have been altered?
- Is it possible to technically prevent software from being installed?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000