2 cissp ® Official Study Guide Eighth Edition

Licensing
Security professionals should also be familiar with the legal issues surrounding software 
licensing agreements. Four common types of license agreements are in use today.
■
Contractual license agreements use a written contract between the software vendor 
and the customer, outlining the responsibilities of each. These agreements are com-
monly found for high-priced and/or highly specialized software packages.
■
Shrink-wrap license agreements are written on the outside of the software packaging. 
They commonly include a clause stating that you acknowledge agreement to the terms 
of the contract simply by breaking the shrink-wrap seal on the package.
■
Click-through license agreements are becoming more commonplace than shrink-
wrap agreements. In this type of agreement, the contract terms are either written on 
the software box or included in the software documentation. During the installation 
process, you are required to click a button indicating that you have read the terms 
of the agreement and agree to abide by them. This adds an active consent to the 
process, ensuring that the individual is aware of the agreement’s existence prior to 
installation.
■
Cloud services license agreements take click-through agreements to the extreme. Most 
cloud services do not require any form of written agreement and simply flash legal 
terms on the screen for review. In some cases, they may simply provide a link to legal 
terms and a check box for users to confirm that they read and agree to the terms. Most 
users, in their excitement to access a new service, simply click their way through the 
agreement without reading it and may unwittingly bind their entire organization to 
onerous terms and conditions. 

---

140
Chapter 4 
■
Laws, Regulations, and Compliance
Industry groups provide guidance and enforcement activities regarding 
software licensing. You can get more information from their websites. One 
major group is the Software Alliance at
www.bsa.org
 .