3

Proper terminology is important for anyone who wants to learn something. The best way to develop professionalism is to rely on a set of well defined technical terms. So it should be in any professionals interest to avoid vague terms which tend to produce misleading associations. The two most common you will probably encounter are cyber and hacking. I still struggle to see any correlation with information security and would like to know how these terms even became that prevalent.

  • Cyber refers to cybernetics, which - surprisingly - has nothing to do with information security at all. The term itself stems from kubernetes which means steersman in Greek. Even the computer science related associations of this term rather refer to the control of devices and the analysis of information like cellular automaton, decision support system, design patterns, robotics or simulation. There has been a new definition which is almost as vague, namely "something that has to do with the Internet". Apart from computer crime not necessarily having something to do with the Internet, this definition applies to almost anything nowadays! So I don't see any reason to use terms like cyber security, cyber warfare or cyber attacks.

  • Hacking is another overused buzzword. Problem here is the very vague definition which most of you know. As far as I know the term has - at least in the US - a much stronger connection to programming than to information security. In Europe, the term is mostly negatively associated with computer criminals. Among the IT affine people it is also mostly connected to the maker culture. In any case the loose distinction makes hacking an inadequate term to refer to information security and pentesting in particular.

This may be just my view on the things so I'd like to know why and when these terms showed up and why they are still used.

closed as primarily opinion-based by Steffen Ullrich, techraf, S.L. Barth, SilverlightFox, Anders Aug 2 '16 at 17:03

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 5
    I dislike these words too, and try to not use them, ever. I suspect the answer to both questions is 'The Media'. – Ian Aug 2 '16 at 9:52
  • They're both useful words and the meaning is clear. Sure we could say "warfare by attacking computers" but "cyber warfare" is punchier. Wiktionary includes the new meaning for cyber. – paj28 Aug 2 '16 at 9:56
  • «how these terms even became that prevalent» I guess it has to do with the fact that a lot of people who buy infosec products/services are kind of clueless about the inner workings. If you want to sell something, you need to make it "appealing" and "cool". – Andrea Lazzarotto Aug 2 '16 at 10:03
  • @paj28 Even the new definition is vague as "something having to do with the Internet". That could be possibly anything. Also computer crime is not Internet only. – AdHominem Aug 2 '16 at 10:13
  • @Ian - What words do you use instead? I guess Cyber can be easily avoided. But what if you're explaining to someone that they need to fix this SQL injection to avoid hacking? – paj28 Aug 2 '16 at 12:03
3

Proper terminology is important for anyone who wants to learn something. The best way to develop professionalism is to rely on a set of well defined technical terms. So it should be in any professionals interest to avoid vague terms which tend to produce misleading associations.

The best way to market things is to use terms which people already know (so you don't have to define them) which have the right associations. Bluntly, nobody outside the profession wants to learn the details.

"Cyber", in this marketing context, means "things to do with computers when you're talking to someone who didn't grow up with them". "Hacking" covers any kind of offensive, intrusive, fraudulent or "dodgy" use of computers.

Bear in mind that even smart or senior people outside infosec know almost nothing about how it works. So you need accessible means of communicating with people, which necessarily involves using their existing misconceptions.

Apparently Ronald Reagan found the film War Games quite insightful on issues of nuclear infosec. That should be pause for thought.

Not the answer you're looking for? Browse other questions tagged or ask your own question.