¶ … total of 60 surveys were sent to IT professionals, with 22 respondents returning questionnaires. The questions contained in the survey were qualitative in nature. The responses varied substantially, which is not surprising given that some of the questions were open-ended in nature. Overall, the questionnaire was a mixture of open-ended and closed questions, which provided basic data on the respondents and their practices, combined with more detailed information that required deeper qualitative analysis. Qualitative analysis is a credible tool whereby a deeper understanding of an issue can be had, giving researchers a more thorough awareness of the complexity of interacting variables within a system, as they work together to produce an outcome: in other words, qualitative analysis helps "to illustrate this issue" (Cresswell, 2012, p. 74).
Data Collection Procedure
Sixty surveys were sent to the IT professionals at the two selected companies via email. There were only 22 responses, and those came in via email as well. The responses were printed out, and then tabulated in Excel. This allowed for the production of graphs and for the opportunity for statistical analysis of the results. The surveys were not sent to individuals at random -- they were chosen for their expressed willingness to participate in the study. In the end, the 22 who completed the surveys self-selected to be the individuals that participated in the survey. There was no intent to randomize the sample -- the population of this study is basically the 22 participants in question.
Description of the Sample
The sample of the 22 participants was drawn from the larger population of 60- participants there were initially selected to participate in this study. As noted in the methodology section, the initial sample was 12 participants, and these twelve were asked to identify other participants that might also be willing to participate. That is how the original set of 60 participants was generated. The participants then self-selected from there whether they would participate. The sample was therefore not randomized, but built from a list and the snowball sample technique, so it neither does represent all industries nor represent particular geography. The 22 participants come from a cross-section of different departments, and they are of varying sizes. Further information cannot be divulged as to do might compromise the confidentiality of the companies involved.
The personnel who filled out the survey were all information technology managers and administrators at their respective companies, so the views presented in the study were all those of IT professionals who would reasonably be expected to possess knowledge of the material that the questions were requesting.
Method of Analysis
The method of analysis utilized for this procedure was based on the eidetic reduction concept used by phenomenologists, which helps researchers to see the basic components of a process by filtering out "the noise" and seeing "between the lines" of communications (Lin, 2013, p. 471). This process encourages a better awareness of the total picture and encourages the analyst to track trends and focus on the act of imaginative variation, as this allows the researcher to "employ polarities" that can serve as a structural source of perceiving the overall tenor of the responses (Lin, 2013, p. 471).
By locating themes within the responses and categorizing them accordingly, the study is able to highlight specific qualitative areas that can be explored for more information and insight into the IT world and what the needs and limitations of the field consist of. Drawing out these themes based on the responses of the sample is dependent upon being able to reduce the phenomena of experience to a basic, clear unit of response that can be distilled and from which meaning can be lifted via an intuitive process of discernment based on the researcher's own understanding of the basics of human character response, experience and reason for engagement. It is through the intimate and close interaction with the responses, and through a thorough saturation of the researcher into the ideas and concepts related, that a more precise and vigorous qualitative analysis can take place (Baxter, Jack, 2008).
1. Analysis of Responses: Preliminary Information and Open-Ended Questions
Major Themes
Dissatisfaction and Lack of Preparedness
Overall, the major themes to emerge from the assessment of the survey were that there is a significant lack of security protocol among the participants. Their attitude towards IT security systems was essentially that of moderate concern. It appeared among the collective responses that so long as the company for which participants worked...
However, when asked about specific questions such as awareness of threat levels, risks and/or dangers to the IT security system, a significant percentage of participants showed no real understanding of threat perceptions. The resulting satisfaction levels depicted in the answers indicated that anywhere between a quarter to a half of all respondents had little faith in the risk mitigating abilities of authorities in the industry or in the systems themselves utilized. Likewise, there was little flow of information between security vendors and the companies for which the participants worked. Outsourcing security was not a priority for most of the respondents' companies and the overall impression they gave of conducting secure operations was that they themselves within their IT departments were meant to oversee risk areas, identify threats, and guarded against attacks. However, there was no indication that these respondents were qualified to be in this position, especially as some of them expressed no significant understanding of basic elements of computing, such as use of the cloud, how the cloud systems work, or how to mitigate risks using cloud technology. Too many respondents replied with a sense of uncertainty regarding how protected their systems were.
In the portion of the questionnaire where respondents could answer open ended questions about their perception of their company's concerns about security, participants made the following statements: "My company does not put security at the very top of its priorities," and "We are very concerned about security, but lack the funds to implement effective strategies." One respondent answered that he was "not sure" about how his company viewed security threats, indicating that his company was (apparently) either not concerned about them or that he was simply not part of a department tasked with security measures. Nonetheless, he was unable to identify or name any department or team that to his knowledge was tasked with such concerns. Thus, respondents indicated in their open ended responses that their companies were essentially limited in terms of ability, financing, and technical know-how when it came to effectively providing adequate IT security measures for their firms.
Lack of Leadership
One of the most startling responses made by a participant in the questionnaire/survey study was that while his company was motivated to establish secure systems via the IT department, the IT department itself had a poor leader at the head and that the department therefore did not "take seriously" any of the security measures with which it was meant to be occupied. The "reason" for this, the participant suggested, was tri-fold: first, the leader was negative and mostly unhelpful in terms of leading the team, encouraging them and helping them to identify risks, threats and gain new understanding; second, while upper management had concerns about issues in passing, there was never any follow-up to ensure that the IT department was actually checking on these issues or applying upgrades so therefore the team never took these directives seriously much less performed them; third, the team was severely limited in its ability to apply fixes or upgrades to the system because in the past whenever the team leader had suggested fixes and a budget to upper management he had always been denied. This was the actual reason the team leader was not positive about the department defining and meeting objectives -- he felt that there was no point as upper management only said and acted like it cared about security when in actuality or in practice it did not at all, as it never agreed to fund any changes or advancement in security practices. This response indicated that without proper leadership in a company, there is no way that security will actually be "taken seriously" as the respondent put it.
Ambivalence and a False Sense of Security
With these open ended responses used to assess the attitudes and outlooks of IT workers within companies using IT security systems, it became evident that another major theme among workers was one of ambivalence: IT workers were only as concerned about security as their team leaders, managers or co-workers within their workplace environment. If co-workers, leaders or managers did not place security knowledge, risk management and threat identification at the top of their priorities list, then workers who were pre-disposed to be concerned about security began to feel depressed about their position within the company and expressed dissatisfaction about where their company was going, what it was capable of doing and how protected and secure it was. "Dissatisfied" with security in the IT was a term that was used by a significant number…
