Overview
This summary outlines key concepts of software licensing, data protection standards, personal information handling, and acceptable use policies relevant to organizations, individuals, and regulatory compliance.
Software Licensing Types
- Software licenses define usage, copy limits, and backup permissions during installation.
- Per seat licenses assign one license to each individual user; concurrent licenses limit simultaneous users.
- Duration-based licenses operate on subscriptions with set expiration dates.
- Personal licenses typically allow home use, sometimes on multiple devices, and may be perpetual.
- Site licenses permit company-wide installation, often requiring annual renewals.
- Free and open-source software (FOSS) allows code access and modification, unlike closed source software.
Legal Agreements and Contracts
- End-User Licensing Agreements (EULA) outline legally binding software use terms.
- Non-Disclosure Agreements (NDA) ensure confidentiality for pre-release demonstrations or sensitive business exchanges.
- Unilateral NDAs protect information from one party; bilateral NDAs bind both parties.
Payment Card Industry Data Security Standard (PCI DSS)
- PCI DSS sets six main security control objectives: secure networks/systems, protect cardholder data, maintain vulnerability management, access control, network monitoring, and an information security policy.
Government and Personal Data Protection
- Governments store sensitive citizen data (e.g., social security, licenses, health records) subject to strict legal restrictions.
- Breaches, like the OPM incident, highlight risks of mishandling personally identifiable information (PII).
- Organizations should document PII handling in security policies and recognize its value and risk.
- PII is a target for attackers due to its use in identity theft and security verification.
Protected Health Information (PHI) and Regulation
- PHI covers healthcare data and is regulated by laws such as HIPAA in the U.S.
- Secure transfer protocols are required for sharing PHI among providers.
Data Retention and Recovery
- Organizations may need to retain multiple document versions and recover past data in case of incidents.
- Legal, governmental, and public companies may have specific, lengthy data retention requirements.
Acceptable Use Policies and System Notices
- Acceptable Use Policies (AUP) govern the allowed uses of organizational technology and help limit legal liability.
- Splash screens may present user expectations, legal notices, or accessibility information during system login.