ses will recognize the need for virus protection, but may not see a need for protection behind that level. In organizations lacking a coordinated MIS effort, or which have been insulated from security problems in the past, the challenge may well be even persuading the enterprise that a problem exists.
Once an organization decides that it needs to take more than the simplest steps to protect its data, a second challenge arises. This comes from the conflict of providing security without hampering the ability of people within the organization to complete their tasks. Limiting access to computer files may be a direct way to protect security, but raises the question of who makes the determination of which individuals have what access to which files, and what happens when the needs of the organization change. Extensive security precautions can place impediments within the organization, decrease employee morale (particularly if individuals develop the belief that the organization does not trust them), and increase operating costs. These concerns must be weighed against the cost (both in financial and nonfinancial resources) of a security breach.
Even when internal and external needs of an organization are balanced with regard to security, there remains the problem of enforcing data security. Some employees may work at home and transfer files from their home computer to their office computer. Whether this transfer is accomplished by floppy diskette or other means (such as over the Internet), the risk of contamination exists each time such transfers occur. Yet employees may not take the time to observe all security precautions because they are certain that they could not be passing on a contaminated file.
The other major challenge with which organizations must be concerned is ongoing vigilance against threats to security. Software protection programs are obsolete nearly as quickly as they are introduced and regular updates must...