Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm reading about Cybersecurity and Information Security and I have questions:
What's the right affirmation? Cyber security versus information security article leaves me in doubt. Also, I think Information Security is too broad and envolves not just the IT context.
This is not much serious answer but it's not stupid either. The article on CCIS is not really good as it tried to operate on partial concepts in not-well defined context.
From the below diagram you can see that:
So in essence, there are various theories but in the end theory is only one, and what we can see here is just one arguing over another while in fact they are part of the very same thing.
Information security and Cybersecurity are meant to be one and the very same thing. It's just incomplete view of each side at the same problem while none of them succeeds on providing real-life picture of the problem and while trying to do so it argues in very silly ways like "physical", "virtual", "data" and so on. The below picture tries to address these in single, picture which I think it's good example that these two problems can be brought as one.
Bringing it as one can significantly reduce problem to much simpler one (and the picture below makes it easier to think about it), reduce big overheads and also make it a lot more versatile.
What is currently written on Computer Security and InfoSec is just a whole lot of redundant stuff, very often overlapping or trying to address the same issue from different side while still it doesn't touch the most important things as it would not belong to any of them, with the best example being the Development Process of the software.
Assuming that InfoSec and Computer Security has only to do with "Defending" is plain and silly mistake of the industry. It has big time something to do with making software and hardware as well. That was also one of the biggest mistakes done by Microsoft in the past which has been addressed at some point. And Software Developers are far from knowing it all. They normally need help from the Security Teams on these things to be up to date with things. That's just one of the examples.
So it's known that Security today is very poor, and keeps blaming on many factors while fails to address even most basic needs and keeps ignoring major issues, think about it like passive-aggressive like behavior.
This means, that current approaches are mostly bad and what the community can achieve so far is to confuse themselves even more.
Bad "security situations" usually come from wrong use of technology, so one of the best options is to get back to the drawing board instead of trying to overthink situation with no exit.
Where I work, our team just went through the exercise of how to define ourselves and what we do. I read through your article and while I agree to the point it's getting at, it doesn't want to define an overarching paradigm, because they have vested interest not too.
But I'll give you our context...
While our CISO doesn't agree, we like to refer to ourselves as Cybersecurity Experts.
From the Wiki:
Cyber- is derived from "cybernetic," which comes from the Greek word κυβερνητικός meaning skilled in steering or governing.
Since our primary role is in governing all things related to Security in the organization, this makes sense. Other descriptions (InfoSec, DataSec, etc) are all extensions of this governance.
As an example, the Cyber Security team has developed a policy around who can see NPI (Information Security), who can access NPI (data security), and how to transfer it (Communication Security). The Cyber Security team enforces this by ensuring the Provisioning Team (Information Security) has provided adequate controls per a persons role, the data is stored encrypted, audited, etc byt the DBA's and Server Teams(Data Security) and TLS is setup from the Network Team(Communication Security).
Most of my posts talk about this, but what Security Teams primarily do, is Risk Governance. I think this is where the article goes bad. It's sexy to know about vulnerabilities and exploits, but that's not Security. Any techie can do that with a little googling. It's in how you manage you environment and how it connects where the real definition of security comes in.
As far as I'm concerned, being in the Information Security industry for the last 17 years, they can be absolutely the same thing, only right now, Cyber is the buzzword of choice, for which I blame Mr Gibson!
The industry still deals with Physical Security, Resilience, Access Control, Availability, Information Assurance, Integrity and Confidentiality, and a whole host of other domains, and changing the name has added nothing, other than media attention, FUD and a whole lot of amusement for those of us above a certain age who remember Cyber meaning something completely different.
Cybersecurity can be described as the protection of computers, servers , mobile devices, electronic systems , networks and data from malicious attacks ranging from corporate to personal devices. In addition to business continuity, threats are categorised into various categories, such as network protection, application security , information security, organisational security, and disaster recovery. Network protection and application security focuses respectively on protecting computer networks, as well as applications and device free from threats and vulnerabilities. Disaster recovery is related to an organisation's response in the event of a data loss and attempts to rebuild its organisational capability to maintain the organisation's functioning.
Information Security can be defined in a simpler way as preventing unauthorised access or modification during the time the data is stored or transferred from one computer to another. Biometrics, social media accounts, cell phone data, etc. may be the data, which is why information security analysis includes different sectors such as blockchain and online forensics. Information protection is developed to cover three confidentiality, honesty, and availability goals, or as widely known as the CIA. Data, including personal information or high-value information, must be kept private, and any unauthorised access should be blocked.
The stored data must be maintained in the proper order to pass on to honesty, and thus, any unorderly alteration by an unauthorised individual must be cancelled immediately. Lastly, it is imperative that authorised personnel can access the data stored at any time. A denial of service assault is likely to place the behaviour in jeopardy.
