S 4.219 Licence key management for z/OS software

Initiation responsibility: Head of IT, IT Security Officer

Implementation responsibility: Persons responsible for individual applications, Administrator

Some software vendors use so-called activation keys (licence keys) to control the use of their programs. These licence keys often expire after a certain period of time and then have to be renewed by the system operator. The following points should be noted in this regard:

Renewal of licence keys

A procedure needs to be set up to ensure that licence keys are renewed at the appropriate time. Otherwise there is a risk that software functions could suddenly cease to be available due to expiry of the relevant licence key.

The contract periods of the licence keys must be documented. The documentation must be made available to all the administrators concerned.

Consideration should be given to a system whereby the validity of the licence keys is regularly monitored.

Warning prior to expiry of licence

If any software is in use which suddenly ceases to work without warning once the licence key has expired, this issue should be raised with the vendor with a view to improving the situation. The software should, for example, give due warning prior to expiry of the licence key or permit the use of emergency keys.

Review questions:

© Federal Office for Information Security. All rights reserved.