2

I'm reading about Cybersecurity and Information Security and I have questions:

  • Is Information Security part of Cybersecurity?
  • Is Cybersecurity part of Information Security?
  • Both have just common concepts?

What's the right affirmation? Cyber security versus information security article leaves me in doubt. Also, I think Information Security is too broad and envolves not just the IT context.

  • 4
    While it is technically different as the Venn diagrams show this is one of those situations where I ask myself does it matter if I or anyone else knows the difference. And it comes back as no. Typically when I see this discussed it is in a brochure from a vendor in the infosec industry. It's basically marking material. – Bacon Brad Aug 4 '16 at 20:18
0

This is not much serious answer but it's not stupid either. The article on CCIS is not really good as it tried to operate on partial concepts in not-well defined context.

From the below diagram you can see that:

  • I can break software, e.g. put a backdoor in it. Software is essentially abstract formulas. Which means, I can perform other algorithmic havoc, e.g. brute force into database and bypass software security.
  • I can break into database, which is basically data, so I can simply break into building and take over the console.
  • I can use social engineering, so I can perform MITM attack for example, I can do passive observations from the movements of the legs etc.

So in essence, there are various theories but in the end theory is only one, and what we can see here is just one arguing over another while in fact they are part of the very same thing.

Information security and Cybersecurity are meant to be one and the very same thing. It's just incomplete view of each side at the same problem while none of them succeeds on providing real-life picture of the problem and while trying to do so it argues in very silly ways like "physical", "virtual", "data" and so on. The below picture tries to address these in single, picture which I think it's good example that these two problems can be brought as one.

Bringing it as one can significantly reduce problem to much simpler one (and the picture below makes it easier to think about it), reduce big overheads and also make it a lot more versatile.

What is currently written on Computer Security and InfoSec is just a whole lot of redundant stuff, very often overlapping or trying to address the same issue from different side while still it doesn't touch the most important things as it would not belong to any of them, with the best example being the Development Process of the software.

Assuming that InfoSec and Computer Security has only to do with "Defending" is plain and silly mistake of the industry. It has big time something to do with making software and hardware as well. That was also one of the biggest mistakes done by Microsoft in the past which has been addressed at some point. And Software Developers are far from knowing it all. They normally need help from the Security Teams on these things to be up to date with things. That's just one of the examples.

So it's known that Security today is very poor, and keeps blaming on many factors while fails to address even most basic needs and keeps ignoring major issues, think about it like passive-aggressive like behavior.

This means, that current approaches are mostly bad and what the community can achieve so far is to confuse themselves even more.

Bad "security situations" usually come from wrong use of technology, so one of the best options is to get back to the drawing board instead of trying to overthink situation with no exit.

Computer Security in Nut-Shell

1

Where I work, our team just went through the exercise of how to define ourselves and what we do. I read through your article and while I agree to the point it's getting at, it doesn't want to define an overarching paradigm, because they have vested interest not too.

But I'll give you our context...

While our CISO doesn't agree, we like to refer to ourselves as Cybersecurity Experts.

From the Wiki:

Cyber- is derived from "cybernetic," which comes from the Greek word κυβερνητικός meaning skilled in steering or governing.

Since our primary role is in governing all things related to Security in the organization, this makes sense. Other descriptions (InfoSec, DataSec, etc) are all extensions of this governance.

As an example, the Cyber Security team has developed a policy around who can see NPI (Information Security), who can access NPI (data security), and how to transfer it (Communication Security). The Cyber Security team enforces this by ensuring the Provisioning Team (Information Security) has provided adequate controls per a persons role, the data is stored encrypted, audited, etc byt the DBA's and Server Teams(Data Security) and TLS is setup from the Network Team(Communication Security).

Most of my posts talk about this, but what Security Teams primarily do, is Risk Governance. I think this is where the article goes bad. It's sexy to know about vulnerabilities and exploits, but that's not Security. Any techie can do that with a little googling. It's in how you manage you environment and how it connects where the real definition of security comes in.

0

As far as I'm concerned, being in the Information Security industry for the last 17 years, they can be absolutely the same thing, only right now, Cyber is the buzzword of choice, for which I blame Mr Gibson!

The industry still deals with Physical Security, Resilience, Access Control, Availability, Information Assurance, Integrity and Confidentiality, and a whole host of other domains, and changing the name has added nothing, other than media attention, FUD and a whole lot of amusement for those of us above a certain age who remember Cyber meaning something completely different.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.