Leikessa Jones owns her own consulting business, and has several people working

for her. Leikessa is currently designing a database management system for the personnel

office of ToyTimeInc., a mid-sized company that makes toys. Leikessa has involved

ToyTimeInc management in the design process from the start of the project. It is now

time to decide about the kind and degree of security to build into the system.

Leikessa has described several options to the client. The client has decided to opt

for the least secure system because the system is going to cost more than was initially

planned, and the least secure option is the cheapest security option. Leikessa knows that

the database includes sensitive information, such as performance evaluations, medical

records, and salaries. With weak security, she fears that enterprising ToyTimeInc

employees will be able to easily access this sensitive data. Furthermore, she fears that the

system will be an easy target for external hackers. Leikessa feels strongly that the system

should be more secure than it would be if the least secure option is selected.

Ms. Jones has tried to explain the risks to ToyTimeInc, but the CEO, the CIO, and

the Director of Personnel are all convinced that the cheapest security is what they want.

Should Jones refuse to build the system with the least secure option?

What would be your tradeoff analysis here?