632598256894

of data privacy. Organizations need to explain compliance policies to end users so they understand
why they need to do what must be done and will follow the necessary protocols. Wireless networks
increase the need for encryption—data has to be protected in rest (stored) or in motion (transmitted).
Laptop data has to be encrypted so if the laptop is lost or stolen, the data on the laptop is safe. Data
loss prevention (sometimes referred to as data leak prevention) systems are designed to detect and
prevent the unauthorized use and transmission of information. Breaches (unauthorized use) are costly
and create a great deal of negative publicity.
It is an organization‟s duty to secure its data. Just because data is encrypted, that doesn‟t necessary
mean it is secure. A breach of data at the TJX Companies, Inc. in 2007 compromised an estimated 90
million encrypted credit card records. Over 40 states have implemented breach notification laws that
require organizations to report breaches to authorities and the persons affected by the breach. The state
of Tennessee took privacy a step further with its Credit Security Act of 2007, which makes the use of
a person‟s Social Security number in direct mailings or over the Internet a class B misdemeanor.
An organization is responsible for compliance by its outsourcing partners as well. These partners
are responsible for the organization‟s data, and therefore the organization itself is responsible for the
security of the data even if it resides on a computer owned by another company. When evaluating
relationships with third parties, an organization must look at the security measures that are in place
and audit their compliance.
Justifying the Cost of Information Technology
Should companies take that giant leap of faith and invest millions of dollars in new machines and
software? Can the return on a company‟s investment in technology be measured using conventional
metrics as are discussed in Chapter 4, Discounted Cash Flow.
These are questions that have concerned technology managers for years. Today, information
technology consumes an increasing share of companies‟ budgets, but we cannot live without the
technology. Thus, when a new version of the personal computer chip or Windows hits the market,
companies must decide whether it is a worthwhile investment. Everyone wants the latest and greatest
technology, believing that with it they will be more productive.
Although IT is the medium for change, its costs and soft benefits are difficult to measure. As
technology gets disbursed throughout a company, it becomes increasingly difficult to track costs and
determine benefits. As workers become their own administrative assistants, each company must
determine whether its workers are more or less productive when they type their own documents and
prepare their own presentations. These are many of the issues that companies are facing now and in
the future as they struggle with new IT investments.
Conclusion