An investigation into the role of information systems security in SMEs in the southeast of Ireland

Research indicates that the protection of information has been a major challenge since the beginning of the computer age. There is however, a paucity of academic research, which examines the protection of information in SMEs in Ireland. The purpose of this study was to gain an understanding of what role information systems security plays in SMEs within the South East of Ireland. This paper examines the role of SMEs in Ireland and the impact of SMEs not having adequate security controls in place. It then investigates the implementation of information systems security and the problems that SMEs face in carrying out this implementation. A quantitative approach has been used to gather the relevant empirical data for the analysis. A forty-three-item questionnaire was mailed to a sample of 100 SMEs extracted from the total population of SMEs in the South East of Ireland with a response rate of 57%. The findings revealed that nearly all SMEs questioned said that they were highly dependent on their computer systems. Yet the vast majority of respondents said that they did not feel that their company was prepared for a security attack. The top three most common security attacks faced by SMEs were viruses, spyware and insider abuse of Internet access, yet, nearly all respondents said that they had anti-virus software and a firewall installed. In general the respondents said that they did not find it hard to find staff with the appropriate security expertise, yet this research shows that over seventy percent of the people responsible for IT security with these companies do not have a formal IT qualification. Budget constraints, technical challenges, complexity of products and lack of end user awareness were described as the main obstacles that the SMEs felt they faced in terms of securing their organisation.