Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

On an upcoming visit to a user's place of work, I would like to have them install Morae Recorder beforehand. This is likely to be a problem for the user's IT Security people. In the past, especially with banks and other financial institutions, this permission has been refused.

Techsmith, Morae's developers, know of no such thing, but is there something like a certificate of trustability which can be attached to software to indicate independently that it is safe?

share|improve this question

1 Answer 1

There is no widely accepted standard for certifying software as "secure". Additionally it is practically impossible to be sure that software that is being installed hasn't been tampered with in some way.

Whether an IT department trust particular software will vary from department to department, and often has nothing to do with security. It is to do with uncertainty and accountability. If they allow it, and something goes wrong, it is their neck on the line. Even if nothing goes wrong, they will then have to support this new software - which they will try to avoid.

Unless there is a push from higher management where their neck is on the line if they don't allow it, they have no incentive to approve it.

The best bet is to install it on your own laptop and try get IT to give you access to their systems. That way, at least they don't have to support the software as it's not on any systems that they have to maintain.

share|improve this answer
1  
Hey! How about giving a reason when downvoting? –  rk. Apr 24 '13 at 14:15
    
@3nafish There isn't any standard, so it's not possible to tell someone how to comply with a standard which doesn't exist. Hence, my advice is about how to deal with the spirit of the question. Otherwise it would just be "There is no standard". I hope my additional paragraph has made that clear for you. –  JohnGB Apr 24 '13 at 14:48
    
I had a brainwave and contacted Thawte, whose icons I've seen around. Basically a piece of software can get a ‘Microsoft Authentic Code Signing Certificate’ from Thawte. I don’t understand the technicalities, but essentially it shrink-wraps the code and guarantees that it has not been altered or corrupted since it was signed by use of a cryptographic hash. Maybe that might reassure some IT depts? –  Phil Parry Apr 24 '13 at 15:45
    
@PhilParry There have been similar things for ages, but none of them is widely accepted. To even do any sort of security check properly would mean that Techsmith would have to give their source code to a third party who would have to check all of it. Any other certification just says that you haven't modified the code from Techsmith, but not that it is safe security wise. –  JohnGB Apr 24 '13 at 16:11
1  
I think Jonh is right. Apple and Microsoft have ways of signing software that probably includes some kind of audit, but they don't really say anything about security. And there are of course labels, like Symantec Code Signing. That may give the software the aura of security you're looking for. –  Koen Lageveen Apr 24 '13 at 17:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.