FOR EMPLOYEES

• Make your passwords complex. Use a combination of numbers, symbols, and letters (uppercase and lowercase).
• Change your passwords regularly (every 45 to 90 days).
• Do NOT give any of your user names, passwords, or other computer/website access codes to anyone.
• Do NOT open e-mails or attachments from strangers.
• Do NOT install or connect any personal software or hardware to your organization’s network or hardware without permission from your IT department.
• Make electronic and physical back-ups or copies of all your most important work.
• Report all suspicious or unusual problems with your computer to your IT department.

FOR MANAGEMENT & IT DEPARTMENT

• Implement Defense-in-Depth: a layered defense strategy that includes technical, organizational, and operational controls.
• Establish clear policies and procedures for employee use of your organization’s information technologies.
• Implement Technical Defenses: firewalls, intrusion detection systems, and Internet content filtering.
• Update your anti-virus software daily.
• Regularly download vendor security “patches” for all of your software.
• Change the manufacturer’s default passwords on all of your software.
• Monitor, log, and analyze successful and attempted intrusions to your systems and networks.

While EULAs rarely attract the kind of attention lavished on viruses or phishing schemes, they are an important consideration when managing the security of your computer and private information. The following sections present recommendations for protecting yourself from the security and privacy problems associated with EULAs.

Read the EULA
This is the most important step you can take: Before installing any software, take the time to read its EULA. While you might incur a half hour of boring reading, doing so can spare you security and privacy headaches.

If the EULA is lengthy or you find it difficult to read in the installation interface, copy it into a word processing document, quit the installation, and carefully read the agreement before proceeding. Make sure you understand the agreement’s terms and conditions, and that you agree with them. Contact the software publisher with any questions you might have or if you need clarification about any specific points.

Packaged software purchased off the shelf can present something of a catch-22: How can you agree to the terms and conditions of the EULA when the package states that breaking the shrink wrap constitutes agreement? To get around this problem, consult the software publisher’s web site. Software publishers often make their EULAs available online. Note the version ID or number and other pertinent information from the packaging to help ensure you read the EULA for the specific version of the software. Contact the publisher directly if you cannot locate the EULA for the software you’re interested in.

Consider the Software Publisher
While there is no guarantee you will agree to the terms of any given EULA, established software publishers that have built strong business reputations are less likely to engage in questionable business practices. This includes unusual, misleading, or camouflaged terms and conditions in the EULAs governing the use of their software. You should not, however, use a company’s strong business reputation as an excuse for not reading its EULA. A company’s good corporate reputation does not mean you will necessarily agree with the terms and conditions of its software.

When dealing with software published by a company or organization with which you’re not familiar, you may want to review its software EULAs with added scrutiny. Particular vigilance is recommended when the software is bundled with other software from third-party publishers. Be prepared to read the EULAs for third-party components when necessary.

Beware of Firewall Prompts When Installing Software
During installation, if your personal firewall generates a prompt asking whether you want to allow certain inbound or outbound connections, proceed with caution. You should verify that the software requires changes to your firewall settings for normal operation, and that you are comfortable with this operation. For instance, the EULA may require you to allow monitoring of your activity, access to specified directories (as in file-sharing programs), or use of your computer’s resources. These provisions may require the opening of holes in your personal firewall.

Note, however, that in the case of bundled software, EULAs requiring you to allow monitoring, directory access, etc. may not be in the primary software’s EULA. These EULA requirements may be in the third-party software EULAs.

Firewall prompts may also be a sign that rogue software has been bundled into the software package you’re installing. This was the case in the file-sharing Trojan horse discussed earlier. If you’re in doubt about whether to change your firewall settings based on prompts received during software installation, consult the software’s user or installation guide. If no guide is available, or if you are still unsure about allowing the traffic through your firewall after consulting it, contact the software publisher before making any changes.

Note that some personal firewalls include options to allow one-time or case-by-case connections. This option may be useful if you are reasonably certain about the legitimacy of a request. For instance, some software attempts to connect to a server during the registration process. If you are comfortable with this request, you can approve the connection for the purposes of registration, but deny all future connections.

Beware of “Free” Software
The old saying tells us “there is no free lunch.” This applies to software. Many “free” software programs, such as the file-sharing programs discussed earlier, often exact a non-monetary charge for their use. This non-monetary charge is detailed in the EULA and specifies what you must allow or provide in exchange for use of the software. This may include mandatory installation of components that compromise your security and/or privacy.

A EULA is a legal contract between you and the software publisher. It spells out the terms and conditions for using the software. For instance, it might say you can only install the software on one computer for your personal use, a fairly common stipulation. However, it might also say that by using the software you agree to third-party monitoring or to allowing other users to access parts of your computer.

You can agree to the EULA’s terms in several ways, depending on the publisher and how it distributes its  software. Some of the ways you can “agree” may surprise you, however, because they don’t look or feel anything like signing a contract. You might agree by

• Clicking an “I accept” button during the installation process
• Opening the shrink wrap software packaging
• Breaking the seal on the software CD
• Mailing a registration card to the software publisher
• Installing the application
• Using the application

You can refuse to accept the terms and conditions of the EULA, but then you can’t legally use the software.

Why EULAs are Important
EULAs can include a number of items you should seriously consider before installing the software. In general, you should note the following facts about EULAs:

• EULAs are legally binding. Some consumer advocates have challenged the legality of EULAs, especially long agreements clouded in complicated “legalese.” The advocates argue these EULAs are a strategy for discouraging careful review and hiding controversial terms and conditions. However, a number of influential court decisions have upheld the legality of EULAs, so you need to assume you’re entering into legal agreements when you accept their terms.
• EULAs restrict how you can use the software. EULAs often include clauses that limit the number of computers you can load the software on. They sometimes also prohibit reverse engineering for the purpose of creating compatible software. In some cases they prohibit software testing and even publishing the results of this testing.
• EULAs may force you to agree to certain conditions when using the software. Many software bundles force you to use all bundled components, including software produced by third-party publishers. They may also require you to agree to monitoring of your internet activity and/or sharing your computer’s resources.
• EULAs can limit your ability to sue for damages. Most EULAs include a clause that says you cannot sue the publisher for any damages caused by using the software.