Small firms ignore security protection