Misconceptions about Cybersecurity and How to Invest in it

Running head: WHY IS IT SO COMPANIES HAVE A MISCONCEPTION ABOUT
CYBERSECURITY AND HOW BEST CAN THEY INVEST IN CYBERSECURITY TO
BETTER UNDERSTAND THE concept? 1
Why is it so companies have a misconception about cybersecurity and how best can they invest
in cybersecurity to better understand the concept?
Name: Sithembiso Mpofu
Schiller International University

LITERATURE REVIEW 2
LITERATURE REVIEW
Cyber security has always been an important area under the cyber world since early
2000s. The process of cyber security involves various techniques to protect a computer system,
internet, information system from unauthorized attack or access. In the current world of
information age, organizations including their information assets, architecture and computer
infrastructure and the individuals needs to be protected from criminal attack. Cyber criminals are
always a step ahead from the security measures that are taken against any cyber security.
Companies usually invest only a retroactive action for the cyber security threat and are known to
have invested very rarely against protecting their system. Cyber security is a misconceived topic
that is followed by companies.
In various studies that are related to cyber security (Collar, 2015), it is argued that people
who are under the responsibility of cyber-security, are not given that much credit as there is some
misconception about cyber-security. This misconception can result into a negative impact in
organizations affecting the job satisfactions to the people who are responsible for securing the
cyber networks. The author also mentions about the different factors that results in the decrease
of the roles related to cyber security as they are not appreciated by their coworkers even after
providing efforts in protecting the company’s data and well-being from cyber threats. Their roles
are not given credit in the company.
Protection of Cyber security is not always successful. As for instances, the cyber security
threats are not always aware of the type of malware that is responsible for the attack and thus
companies are not always aware of the mitigation techniques that are needed in order to defend
the systems against the cyber-attacks. The cyber attackers in this case are not visible and so this

LITERATURE REVIEW 3
makes a difficult task for the security officials in order to conceive successful defensive
techniques and hence are not given the credit of cyber experts. (Collar, 2015). Most of the
members of the company who rely on the protecting techniques of the cyber security assets
including bio-metric systems, firewalls, encryption, forensics and many more for protecting the
minimal knowledge of the varied types of controls and solving techniques are skillfully placed.
Hence there is a kind of misconception about the fact of protecting the mechanisms and hence
there is no appreciation for the protecting efforts. (Collar, 2015).
In another research it is reflected that major of the companies lack the conception of
cyber-security with in their business (Suter, 2008). According to the author, there are certain
myths including denial of reality that are often faced by companies as a result of failure of
knowledge about the threats and consequences that are taking place in real world and failing to
protect their systems with the help of the existing severe policies of security.
Most of the organisations have a misconception that nobody wants to attack them as
hence believes that the existing system that are present within the company are well protected
and hence are capable of determining the attacks. These companies have no guarantee regarding
the intrinsic security that these systems offer.
According to some company officials, the cyber security incidents that are likely to take
place will not impact the operation of the company. Also, there is a misconception about the fact
that is there are some cyber incidents occurring in the database system, then there will be no
adverse effect in the details of the customers and no effect will be caused. But this is not actually

LITERATURE REVIEW 4
the case. If this kind of threat takes place within the organization’s database, then major of the
customers will refrain their trust from the business and hence will result in the loss and good will
of the company’s reputation.
It is under the misconception of several companies that mere firewall protection can protect
the cybercriminal’s from breaking through the firewalls. This kind of incorrect concepts about
technologies to various companies believe about the fact the existing protocols are much safe and
secure enough. But they remain unaware of the fact that these systems can be can be also used
for reverse engineering purpose. Another view that companies have about cyber security
awareness is that, only by introducing new technologies within the business process can reduce
the threat of cyber security. But actually, these companies lack to implement properly skilled and
expert cyber security experts, s as to operate these technologies that are used. (Suter, 2008).
In another way, the researchers have caught hold of certain security investments in order to
curb the lack of conception of the cyber security. According to them there are several other
securities as well as non-security measures that are related to technology based on the investment
of understanding the value of investment of cyber-security in organizations. As identified by one
of the researchers, security investments bring some kind of returns to the organizations. A
holistic approach (Luo, 2014) in this context is related to the technical as well as organizational
elements such as security governance, regulatory policies and compliances in order to provide a
much deeper understanding of the security investments. Secondly (Luo, 2014) a hybrid
approach, as proposed by some authors, includes utilization of strengths in order to overcome the