- Email: [email protected]
Preventing software piracy
S e p t e m b e r 1994
to provide increased p e r f o r m a n c e a n d higher network b a n d w i d t h . They h a v e largely overlooked the a d v a n t a g e s in network security a n d a c c o u n t a b i l i t y p r o v i d e d by a connection-orientated solution. SFPS is new t e c h n o l o g y being i n t r o d u c e d by Cabletron that offers m a n y benefits for information transport. SPFS provides scalable, d e d i c a t e d b a n d w i d t h for end users m u c h like ATM. SFPS also allows networks to maintain their existing Ethernet, Token Ring, a n d FDDI workstation interfaces, bridges a n d routers. Essentially, the SFPS t e c h n o l o g y allows users to e x p e r i e n c e most of the benefits of ATM networking, such as security a n d a c c o u n t a b i l i t y a n d the lower l a t e n c y p r o v i d e d by a c o n n e c t i o n - o r i e n t a t e d solution, The benefits are p r o v i d e d while m a i n t a i n i n g their existing p a c k e t - b a s e d networks, a n d a v o i d i n g the significant investment associated with migrating to a pure ATM environment. SFPS a n d ATM share m a n y a t t r a c t i v e security benefits discussed in earlier sections of this article, all c o m b i n e d into a single solution, SFPS and ATM are: connection-orientated packet a n d cell switching. Bridging a n d Routing are connectionless p a c k e t switching. To use an analogy, if the t e l e p h o n e
N e t w o r k Security
network was based on bridges, when you dialled a number, every p h o n e in the world will ring. A t e l e p h o n e network based on routers, w o u l d m e a n that every p h o n e in an area c o d e w o u l d ring. A t e l e p h o n e network based on SFPS or ATM w o u l d m e a n that only the p h o n e of the number for the person(s) you were calling w o u l d ring. SFPS a n d ATM support ' c o n f e r e n c e calls' through point to multi-point connections. Essentially, with c o n n e c t i o n - o r i e n t a t e d LANs the nature of networking is migrating from 'party line' to 'private line" communications. The c o n n e c t i o n - o r i e n t a t e d a p p r o a c h uses the hub as a p a c k e t / b e l l switch rather than as a repeater, Conversations b e t w e e n an origination node, the hub or switch port, a n d a destination n o d e are not b r o a d c a s t to any other nodes, As a result these connection-orientated technologies a u t o m a t i c a l l y provide a level of link privacy that prevents e a v e s d r o p p i n g from any other d e v i c e c o n n e c t e d to another network port. This contrasts sharply with traditional Ethernet, Token Ring, a n d FDDI networks where transmissions are b r o a d c a s t to all network nodes in addition to the i n t e n d e d destination, By establishing a d e d i c a t e d , switched c o n n e c t i o n b e t w e e n t w o users, the security benefit of
Preventing Software Piracy Robert Schifreen It's up to you, as the person in c h a r g e of network security, to ensure that users are not storing pirated software on the server or workstations. Regular audits c a n help you a c h i e v e this.
The Copyright, Designs a n d Patents A c t 1988 states that, "A person commits an o f f e n c e who, without the licence of the c o p y r i g h t owner, in the course
©1994 Elsevier Science Ltd
of a business, distributes an article which is, a n d which he knows or has reason to believe is, an infringing c o p y of a copyright work," C o m p u t e r
climbing a n d controlling the flow of information on the network is gained. This results in security similar to that p r o v i d e d by bridges a n d routers in a connectionless network, but at o n e tenth of the cost based on p r i c e / p e r f o r m a n c e . By their nature, switched c o n n e c t i o n s are not 'shared access' a n d thus promiscuous listening devices or applications are rendered useless (:no n e e d for e a v e s d r o p prevention). End-to-end secure links c a n be established across multiple segments (much like e n c r y p t i o n methods), Finally, intruder prevention functions are p r o v i d e d through Network M a n a g e m e n t Systems. The NMS maintains authorized user lists, a l o n g with policies that control user b a n d w i d t h a l l o c a t i o n a n d access to network services or d a t a repositories.
A more in-depth discussion of Cabletron's LanViewSecure, Port Locking, SecureFast Packet Switching a n d ATM solutions is a v a i l a b l e in separate papers a n d m a y be o b t a i n e d by c o n t a c t i n g Cabletron Systems. This article accompanies a presentation given by Lesley Hansen at the 11th Computer Security Audit and Control Conference at the Queen Elizabeth II Conference Centre, London, UK.
programs are, of course, c o p y r i g h t works, Software houses g o to various lengths to d e t e c t unauthorized copies. For example, if a software c o m p a n y regularly receives support calls from 20 p e o p l e at c o m p a n y X, but it is known that c o m p a n y X has purchased only three copies, it is not u n c o m m o n for the software c o m p a n y in question to call c o m p a n y X a n d ask for a c h e q u e by return of post. This has h a p p e n e d in the UK on more than one occasion.
]7
N e t w o r k Security
Before the audit Before you start to perform an audit, stop a n d consider w h e t h e r you are fully p r e p a r e d for the results of the audit. If you are not, a n d the a u d i t uncovers large-scale piracy that you h a v e neither the inclination nor the resources to put right, you l e a v e yourself w i d e o p e n to prosecution. If you are not p r e p a r e d to f a c e up to the c o n s e q u e n c e s , it is preferable not to perform the a u d i t at all. You c a n then p l e a d i g n o r a n c e if a n y o n e suggests that your c o m p a n y is using unauthorized copies of software.
Why software gets pirated There are a n u m b e r of reasons w h y unlicensed (i.e. pirated) software finds its w a y into an organization. Knowing the reasons will help you to plan your c a m p a i g n for eliminating it from your c o m p a n y .
Ec on omics The cost factor is a major cause of software piracy. Business software p a c k a g e s such as spreadsheets, word processors a n d databases typically cost a r o u n d £500 in one-off quantities, w h i c h is a considerable a m o u n t for a small c o m p a n y or an individual to bear.
S e p t e m b e r 1994
the standard 30-day d e l a y will be u n a c c e p t a b l e a n d it is a fair bet that a pirated c o p y will be acquired. There will occasionally be instances where c o p y i n g of software is difficult to avoid. If a c o p y of a program is n e e d e d urgently (i.e. within half an hour so that an u n e x p e c t e d visitor c a n d o some work), a n d a program has to be c o p i e d in a w a y that contravenes the l i c e n c e a g r e e m e n t , ensure that the paperwork for ordering an extra c o p y is started immediately. Few software c o m p a n i e s will object to this p r o c e d u r e - - if you suspect that they might, t e l e p h o n e the marketing d e p a r t m e n t a n d ask permission. Explain to all staff involved, that the extra c o p y has been m a d e with the permission of the software v e n d o r and that an extra c o p y has been ordered.
Evaluation The n u m b e r of software p a c k a g e s on the market increases daily, a n d d e c i d i n g w h i c h one is right for a particular project is no easy task. Ensure that those whose jobs include software e v a l u a t i o n are given a d e q u a t e budgets to buy or rent e v a l u a t i o n copies. You must a v o i d situations where: •
Con venience The easiest w a y to get hold of a software p a c k a g e is to take a c o p y from a friend or c o l l e a g u e . Where if is important that a p a c k a g e be o b t a i n e d quickly (perhaps b e c a u s e it is n e e d e d in order to c o m p l e t e some urgent work), this is especially important to remember. You c a n help to r e d u c e piracy by ensuring that internal software purchasing arrangements d o not cause unnecessary d e l a y - - if a m a n a g e r has an urgent forecast to c o m p l e t e a n d has ordered a c o p y of Lotus 1-2-3,
18
Some software is not i n c l u d e d in an evaluation b e c a u s e no b u d g e t is available. A pirated c o p y of a software p a c k a g e is a c q u i r e d in order to include if in an evaluation.
Ignorance I g n o r a n c e c a n often lead to piracy. For example, staff m a y not realise that c o p y i n g software constitutes theft. Also, staff may not be a w a r e of the extent of a licensing agreement, and will p r o d u c e 50 copies when in fact permission has only been g r a n t e d for 40 copies to be
made.
Network managers must c h e c k that all software installed on a network is correctly licensed. A p r o d u c t for w h i c h you h a v e 50 licences should not be installed on a LAN w h i c h w o u l d allow 70 simultaneous users. Where a software a u d i t shows that a user has, on a s t a n d - a l o n e PC, a c o p y of a software p a c k a g e that is also installed on the c o m p a n y network, you should remove the single copy. In most cases, you c a n use this single c o p y to increase the n u m b e r of simultaneous users permitted to use the p a c k a g e on the network, a n d this represents a far more efficient w a y of working.
Documentation Business software p a c k a g e s are complex, a n d d o c u m e n t a t i o n is essential. Printed manuals typically c o m e to b e t w e e n 500 a n d 1000 pages. To keep costs d o w n a n d to make their software easier to use, m a n y software c o m p a n i e s now include copies of the d o c u m e n t a t i o n on disk. This is usually accessible via a 'Help' key. Having the m a n u a l a v a i l a b l e on screen provides a n u m b e r of a d v a n t a g e s to the user, not least of which is the f a c t that the c o m p u t e r c a n rapidly search the m a n u a l for a specific p i e c e of information. Of course, the presence of online d o c u m e n t a t i o n removes one of the earliest forms of c o p y p r o t e c t i o n from software. There is no longer any need for the user to possess any printed d o c u m e n t a t i o n at all. In the few cases where no on-screen help is available, a local bookshop will usually provide a solution.
Master disks When software p a c k a g e s are purchased for use within the c o m p a n y , ensure that the master floppy disks are kept safely under lock a n d key. This helps to prevent piracy, a n d also ensures that you are able
@1994 Elsevier Science Ltd
September 1994
to re-install the software in case of d e l e t i o n or corruption of the installed version. You will also often n e e d access to the master disks w h e n installing, or a p p l y i n g for, u p g r a d e s from the vendor. Note that m u c h of t o d a y ' s software is supplied in what's known as 'dual m e d i a ' form, This me a n s that the p r o g r a m is supplied on both 5 inch a n d 3 inch disks. This is to m a k e it easy to install, a n d does not m e a n that you o w n t wo separate licences. Ensure that only o n e set of disks is installed, a n d keep the other for e m e r g e n c y use.
Detecting pirated software If your organization uses some form of a u t o m a t i c problem-tracking software for its internal support a n d help-desk departments, the logs from the software should be m o n i t o r e d on a regular basis. Watch out for users requesting support for software which they are not supposed to have, O c c a s i o n a l inspections of machines are useful, especially w he re specific staff members or entire d e p a r t m e n f s h a v e a history of acquiring unauthorized software. When performing an inspection, ask for proof of ownership of all a p p l i c a t i o n s installed on the machines under scrutiny. Master f l o p p y disks, or original receipts, are a c c e p t a b l e forms of proof. Manuals, e v e n original ones that are clearly not p h o t o c o p i e d , are n o t - it's easy for a n y o n e to order extra copies of manuals.
Network Security
configuration of a particular m a c h i n e if its user is reporting a problem. M a n a g e m e n t c a n use the d a t a b a s e to c h e c k whether the number of copies of a p r o g r a m installed on the c o m p a n y ' s PCs e x c e e d s the number of licences or copies that h a v e b e e n purchased. Some software c o m p a n i e s offer discounts for multiple purchases of programs. It is often up to the purchaser to i n d i c a t e h o w m a n y copies h a v e b e e n purchased to date, in order to qualify for cumulative discount rates or site licence agreements, Your audit d a t a b a s e will provide this proof, a n d also alert you to the fact that you should a p p r o a c h software c o m p a n i e s a n d ask for discounts,
Retrieving software that is no longer used, or that was assigned to ex-employees, b e c o m e s easy, Such a p r a c t i c e c a n save large amounts of money, Some c o m p a n i e s even offer financial incentives to staff w h o return u n w a n t e d software that has b e e n issued to them, Pirated software c an be d e t e c t e d , by c o m p a r i n g the number of copies of progrc~:'qs l o c a t e d by the audit wit:. 'he number of licences that the c o m p a n y is known to h a v e purchased,
Benefits of audits
The c o n c e p t of a software audit is relatively new, The e n d result of the process is a d a t a b a s e c o n t a i n i n g details of every PC in the c o m p a n y , a n d the software that is installed on it. Further information c a n also be recorded, too, Having such a d a t a b a s e is invaluable, for m a n y reasons, These include: •
A t e c h n i c a l support person c a n instantly look up the
@1994 Elsevier Science Ltd
The audit log can be used to d e t e c t viruses, by ensuring that e x e c u t a b l e files do not c h a n g e b e t w e e n two successive audits, The audit p r o g r a m can be configured to c h e c k that specified staff or d e p a r t m e n t s do not possess copies of specified flies or programs,
If a private c o p y of a p o p u l a r a p p l i c a t i o n is discovered in a user's personal directory, the p r o g r a m c a n be m o v e d into a c o m m o n a r e a to m a k e it a v a i l a b l e to more use rs. Software f ound in directories b e l o n g i n g to staff w h o h a v e left the c o m p a n y c a n be re-assigned, to save having to buy new copies for i n c o m i n g staff. Staff who keep multiple copies of files for no g o o d reason c a n be e n c o u r a g e d to free up some disk s pac e for the benefit of all LAN users, Software which is discovered to be rarely used c a n b e assigned to more n e e d y users, Users who are working with o u t d a t e d versions of software c a n b e d e t e c t e d and upgraded, Unnecessary files, such as entire directories filled with irrelevant screen a n d printer drivers, c a n be d e l e t e d to free up space, If a PC has more than o n e c o p y of an a p p l i c a t i o n installed (perhaps an u p g r a d e was installed, a n d the old c o p y not removed), the other c o p y c a n be re-assigned if the licence permits this. A number of a u t o m a t i c software audit programs are a v a i l a b l e , which will record details of the software that is found on a m a c h i n e a n d m e r g e this into a central d a t a b a s e , Alternatively, the process c a n b e d o n e by hand. A m o n g the most thorough of the a u t o m a t i c PC and LAN audit products are Print, from the e p o n y m o u s l y n a m e d c o m p a n y (tel: +44 71 937 0260) a n d Dr Solomon's Audit, from S&S International ("el: +44 296 318800),
19
to provide increased p e r f o r m a n c e a n d higher network b a n d w i d t h . They h a v e largely overlooked the a d v a n t a g e s in network security a n d a c c o u n t a b i l i t y p r o v i d e d by a connection-orientated solution. SFPS is new t e c h n o l o g y being i n t r o d u c e d by Cabletron that offers m a n y benefits for information transport. SPFS provides scalable, d e d i c a t e d b a n d w i d t h for end users m u c h like ATM. SFPS also allows networks to maintain their existing Ethernet, Token Ring, a n d FDDI workstation interfaces, bridges a n d routers. Essentially, the SFPS t e c h n o l o g y allows users to e x p e r i e n c e most of the benefits of ATM networking, such as security a n d a c c o u n t a b i l i t y a n d the lower l a t e n c y p r o v i d e d by a c o n n e c t i o n - o r i e n t a t e d solution, The benefits are p r o v i d e d while m a i n t a i n i n g their existing p a c k e t - b a s e d networks, a n d a v o i d i n g the significant investment associated with migrating to a pure ATM environment. SFPS a n d ATM share m a n y a t t r a c t i v e security benefits discussed in earlier sections of this article, all c o m b i n e d into a single solution, SFPS and ATM are: connection-orientated packet a n d cell switching. Bridging a n d Routing are connectionless p a c k e t switching. To use an analogy, if the t e l e p h o n e
N e t w o r k Security
network was based on bridges, when you dialled a number, every p h o n e in the world will ring. A t e l e p h o n e network based on routers, w o u l d m e a n that every p h o n e in an area c o d e w o u l d ring. A t e l e p h o n e network based on SFPS or ATM w o u l d m e a n that only the p h o n e of the number for the person(s) you were calling w o u l d ring. SFPS a n d ATM support ' c o n f e r e n c e calls' through point to multi-point connections. Essentially, with c o n n e c t i o n - o r i e n t a t e d LANs the nature of networking is migrating from 'party line' to 'private line" communications. The c o n n e c t i o n - o r i e n t a t e d a p p r o a c h uses the hub as a p a c k e t / b e l l switch rather than as a repeater, Conversations b e t w e e n an origination node, the hub or switch port, a n d a destination n o d e are not b r o a d c a s t to any other nodes, As a result these connection-orientated technologies a u t o m a t i c a l l y provide a level of link privacy that prevents e a v e s d r o p p i n g from any other d e v i c e c o n n e c t e d to another network port. This contrasts sharply with traditional Ethernet, Token Ring, a n d FDDI networks where transmissions are b r o a d c a s t to all network nodes in addition to the i n t e n d e d destination, By establishing a d e d i c a t e d , switched c o n n e c t i o n b e t w e e n t w o users, the security benefit of
Preventing Software Piracy Robert Schifreen It's up to you, as the person in c h a r g e of network security, to ensure that users are not storing pirated software on the server or workstations. Regular audits c a n help you a c h i e v e this.
The Copyright, Designs a n d Patents A c t 1988 states that, "A person commits an o f f e n c e who, without the licence of the c o p y r i g h t owner, in the course
©1994 Elsevier Science Ltd
of a business, distributes an article which is, a n d which he knows or has reason to believe is, an infringing c o p y of a copyright work," C o m p u t e r
climbing a n d controlling the flow of information on the network is gained. This results in security similar to that p r o v i d e d by bridges a n d routers in a connectionless network, but at o n e tenth of the cost based on p r i c e / p e r f o r m a n c e . By their nature, switched c o n n e c t i o n s are not 'shared access' a n d thus promiscuous listening devices or applications are rendered useless (:no n e e d for e a v e s d r o p prevention). End-to-end secure links c a n be established across multiple segments (much like e n c r y p t i o n methods), Finally, intruder prevention functions are p r o v i d e d through Network M a n a g e m e n t Systems. The NMS maintains authorized user lists, a l o n g with policies that control user b a n d w i d t h a l l o c a t i o n a n d access to network services or d a t a repositories.
A more in-depth discussion of Cabletron's LanViewSecure, Port Locking, SecureFast Packet Switching a n d ATM solutions is a v a i l a b l e in separate papers a n d m a y be o b t a i n e d by c o n t a c t i n g Cabletron Systems. This article accompanies a presentation given by Lesley Hansen at the 11th Computer Security Audit and Control Conference at the Queen Elizabeth II Conference Centre, London, UK.
programs are, of course, c o p y r i g h t works, Software houses g o to various lengths to d e t e c t unauthorized copies. For example, if a software c o m p a n y regularly receives support calls from 20 p e o p l e at c o m p a n y X, but it is known that c o m p a n y X has purchased only three copies, it is not u n c o m m o n for the software c o m p a n y in question to call c o m p a n y X a n d ask for a c h e q u e by return of post. This has h a p p e n e d in the UK on more than one occasion.
]7
N e t w o r k Security
Before the audit Before you start to perform an audit, stop a n d consider w h e t h e r you are fully p r e p a r e d for the results of the audit. If you are not, a n d the a u d i t uncovers large-scale piracy that you h a v e neither the inclination nor the resources to put right, you l e a v e yourself w i d e o p e n to prosecution. If you are not p r e p a r e d to f a c e up to the c o n s e q u e n c e s , it is preferable not to perform the a u d i t at all. You c a n then p l e a d i g n o r a n c e if a n y o n e suggests that your c o m p a n y is using unauthorized copies of software.
Why software gets pirated There are a n u m b e r of reasons w h y unlicensed (i.e. pirated) software finds its w a y into an organization. Knowing the reasons will help you to plan your c a m p a i g n for eliminating it from your c o m p a n y .
Ec on omics The cost factor is a major cause of software piracy. Business software p a c k a g e s such as spreadsheets, word processors a n d databases typically cost a r o u n d £500 in one-off quantities, w h i c h is a considerable a m o u n t for a small c o m p a n y or an individual to bear.
S e p t e m b e r 1994
the standard 30-day d e l a y will be u n a c c e p t a b l e a n d it is a fair bet that a pirated c o p y will be acquired. There will occasionally be instances where c o p y i n g of software is difficult to avoid. If a c o p y of a program is n e e d e d urgently (i.e. within half an hour so that an u n e x p e c t e d visitor c a n d o some work), a n d a program has to be c o p i e d in a w a y that contravenes the l i c e n c e a g r e e m e n t , ensure that the paperwork for ordering an extra c o p y is started immediately. Few software c o m p a n i e s will object to this p r o c e d u r e - - if you suspect that they might, t e l e p h o n e the marketing d e p a r t m e n t a n d ask permission. Explain to all staff involved, that the extra c o p y has been m a d e with the permission of the software v e n d o r and that an extra c o p y has been ordered.
Evaluation The n u m b e r of software p a c k a g e s on the market increases daily, a n d d e c i d i n g w h i c h one is right for a particular project is no easy task. Ensure that those whose jobs include software e v a l u a t i o n are given a d e q u a t e budgets to buy or rent e v a l u a t i o n copies. You must a v o i d situations where: •
Con venience The easiest w a y to get hold of a software p a c k a g e is to take a c o p y from a friend or c o l l e a g u e . Where if is important that a p a c k a g e be o b t a i n e d quickly (perhaps b e c a u s e it is n e e d e d in order to c o m p l e t e some urgent work), this is especially important to remember. You c a n help to r e d u c e piracy by ensuring that internal software purchasing arrangements d o not cause unnecessary d e l a y - - if a m a n a g e r has an urgent forecast to c o m p l e t e a n d has ordered a c o p y of Lotus 1-2-3,
18
Some software is not i n c l u d e d in an evaluation b e c a u s e no b u d g e t is available. A pirated c o p y of a software p a c k a g e is a c q u i r e d in order to include if in an evaluation.
Ignorance I g n o r a n c e c a n often lead to piracy. For example, staff m a y not realise that c o p y i n g software constitutes theft. Also, staff may not be a w a r e of the extent of a licensing agreement, and will p r o d u c e 50 copies when in fact permission has only been g r a n t e d for 40 copies to be
made.
Network managers must c h e c k that all software installed on a network is correctly licensed. A p r o d u c t for w h i c h you h a v e 50 licences should not be installed on a LAN w h i c h w o u l d allow 70 simultaneous users. Where a software a u d i t shows that a user has, on a s t a n d - a l o n e PC, a c o p y of a software p a c k a g e that is also installed on the c o m p a n y network, you should remove the single copy. In most cases, you c a n use this single c o p y to increase the n u m b e r of simultaneous users permitted to use the p a c k a g e on the network, a n d this represents a far more efficient w a y of working.
Documentation Business software p a c k a g e s are complex, a n d d o c u m e n t a t i o n is essential. Printed manuals typically c o m e to b e t w e e n 500 a n d 1000 pages. To keep costs d o w n a n d to make their software easier to use, m a n y software c o m p a n i e s now include copies of the d o c u m e n t a t i o n on disk. This is usually accessible via a 'Help' key. Having the m a n u a l a v a i l a b l e on screen provides a n u m b e r of a d v a n t a g e s to the user, not least of which is the f a c t that the c o m p u t e r c a n rapidly search the m a n u a l for a specific p i e c e of information. Of course, the presence of online d o c u m e n t a t i o n removes one of the earliest forms of c o p y p r o t e c t i o n from software. There is no longer any need for the user to possess any printed d o c u m e n t a t i o n at all. In the few cases where no on-screen help is available, a local bookshop will usually provide a solution.
Master disks When software p a c k a g e s are purchased for use within the c o m p a n y , ensure that the master floppy disks are kept safely under lock a n d key. This helps to prevent piracy, a n d also ensures that you are able
@1994 Elsevier Science Ltd
September 1994
to re-install the software in case of d e l e t i o n or corruption of the installed version. You will also often n e e d access to the master disks w h e n installing, or a p p l y i n g for, u p g r a d e s from the vendor. Note that m u c h of t o d a y ' s software is supplied in what's known as 'dual m e d i a ' form, This me a n s that the p r o g r a m is supplied on both 5 inch a n d 3 inch disks. This is to m a k e it easy to install, a n d does not m e a n that you o w n t wo separate licences. Ensure that only o n e set of disks is installed, a n d keep the other for e m e r g e n c y use.
Detecting pirated software If your organization uses some form of a u t o m a t i c problem-tracking software for its internal support a n d help-desk departments, the logs from the software should be m o n i t o r e d on a regular basis. Watch out for users requesting support for software which they are not supposed to have, O c c a s i o n a l inspections of machines are useful, especially w he re specific staff members or entire d e p a r t m e n f s h a v e a history of acquiring unauthorized software. When performing an inspection, ask for proof of ownership of all a p p l i c a t i o n s installed on the machines under scrutiny. Master f l o p p y disks, or original receipts, are a c c e p t a b l e forms of proof. Manuals, e v e n original ones that are clearly not p h o t o c o p i e d , are n o t - it's easy for a n y o n e to order extra copies of manuals.
Network Security
configuration of a particular m a c h i n e if its user is reporting a problem. M a n a g e m e n t c a n use the d a t a b a s e to c h e c k whether the number of copies of a p r o g r a m installed on the c o m p a n y ' s PCs e x c e e d s the number of licences or copies that h a v e b e e n purchased. Some software c o m p a n i e s offer discounts for multiple purchases of programs. It is often up to the purchaser to i n d i c a t e h o w m a n y copies h a v e b e e n purchased to date, in order to qualify for cumulative discount rates or site licence agreements, Your audit d a t a b a s e will provide this proof, a n d also alert you to the fact that you should a p p r o a c h software c o m p a n i e s a n d ask for discounts,
Retrieving software that is no longer used, or that was assigned to ex-employees, b e c o m e s easy, Such a p r a c t i c e c a n save large amounts of money, Some c o m p a n i e s even offer financial incentives to staff w h o return u n w a n t e d software that has b e e n issued to them, Pirated software c an be d e t e c t e d , by c o m p a r i n g the number of copies of progrc~:'qs l o c a t e d by the audit wit:. 'he number of licences that the c o m p a n y is known to h a v e purchased,
Benefits of audits
The c o n c e p t of a software audit is relatively new, The e n d result of the process is a d a t a b a s e c o n t a i n i n g details of every PC in the c o m p a n y , a n d the software that is installed on it. Further information c a n also be recorded, too, Having such a d a t a b a s e is invaluable, for m a n y reasons, These include: •
A t e c h n i c a l support person c a n instantly look up the
@1994 Elsevier Science Ltd
The audit log can be used to d e t e c t viruses, by ensuring that e x e c u t a b l e files do not c h a n g e b e t w e e n two successive audits, The audit p r o g r a m can be configured to c h e c k that specified staff or d e p a r t m e n t s do not possess copies of specified flies or programs,
If a private c o p y of a p o p u l a r a p p l i c a t i o n is discovered in a user's personal directory, the p r o g r a m c a n be m o v e d into a c o m m o n a r e a to m a k e it a v a i l a b l e to more use rs. Software f ound in directories b e l o n g i n g to staff w h o h a v e left the c o m p a n y c a n be re-assigned, to save having to buy new copies for i n c o m i n g staff. Staff who keep multiple copies of files for no g o o d reason c a n be e n c o u r a g e d to free up some disk s pac e for the benefit of all LAN users, Software which is discovered to be rarely used c a n b e assigned to more n e e d y users, Users who are working with o u t d a t e d versions of software c a n b e d e t e c t e d and upgraded, Unnecessary files, such as entire directories filled with irrelevant screen a n d printer drivers, c a n be d e l e t e d to free up space, If a PC has more than o n e c o p y of an a p p l i c a t i o n installed (perhaps an u p g r a d e was installed, a n d the old c o p y not removed), the other c o p y c a n be re-assigned if the licence permits this. A number of a u t o m a t i c software audit programs are a v a i l a b l e , which will record details of the software that is found on a m a c h i n e a n d m e r g e this into a central d a t a b a s e , Alternatively, the process c a n b e d o n e by hand. A m o n g the most thorough of the a u t o m a t i c PC and LAN audit products are Print, from the e p o n y m o u s l y n a m e d c o m p a n y (tel: +44 71 937 0260) a n d Dr Solomon's Audit, from S&S International ("el: +44 296 318800),
19