This is not much serious answer but it's not stupid either. The article on CCIS is not really good as it tried to operate on partial concepts in not-well defined context.
From the below diagram you can see that:
- I can break software, e.g. put a backdoor in it. Software is essentially abstract formulas. Which means, I can perform other algorithmic havoc, e.g. brute force into database and bypass software security.
- I can break into database, which is basically data, so I can simply break into building and take over the console.
- I can use social engineering, so I can perform MITM attack for example, I can do passive observations from the movements of the legs etc.
So in essence, there are various theories but in the end theory is only one, and what we can see here is just one arguing over another while in fact they are part of the very same thing.
Information security and Cybersecurity are meant to be one and the very same thing. It's just incomplete view of each side at the same problem while none of them succeeds on providing real-life picture of the problem and while trying to do so it argues in very silly ways like "physical", "virtual", "data" and so on. The below picture tries to address these in single, picture which I think it's good example that these two problems can be brought as one.
Bringing it as one can significantly reduce problem to much simpler one (and the picture below makes it easier to think about it), reduce big overheads and also make it a lot more versatile.
What is currently written on Computer Security and InfoSec is just a whole lot of redundant stuff, very often overlapping or trying to address the same issue from different side while still it doesn't touch the most important things as it would not belong to any of them, with the best example being the Development Process of the software.
Assuming that InfoSec and Computer Security has only to do with "Defending" is plain and silly mistake of the industry. It has big time something to do with making software and hardware as well. That was also one of the biggest mistakes done by Microsoft in the past which has been addressed at some point. And Software Developers are far from knowing it all. They normally need help from the Security Teams on these things to be up to date with things. That's just one of the examples.
So it's known that Security today is very poor, and keeps blaming on many factors while fails to address even most basic needs and keeps ignoring major issues, think about it like passive-aggressive like behavior.
This means, that current approaches are mostly bad and what the community can achieve so far is to confuse themselves even more.
Bad "security situations" usually come from wrong use of technology, so one of the best options is to get back to the drawing board instead of trying to overthink situation with no exit.