Lately (and not so lately), you can hear a lot about cyber security. It is really hard to find an official description about this matter so, let's take the ISO 27032 description:

"Cybersecurity” or “Cyberspace security”, defined as the “preservation of confidentiality, integrity and availability of information in the Cyberspace”. In turn “the Cyberspace” (complete with definite article) is defined as “the complex environment resulting from the interaction of people, software and services on the Internet by means of technology devices and networks connected to it, which does not exist in any physical form”.

Further reading into ISO 27032 will discover some similarities with the ISO27001 and it is really hard to differentiate Information Security Controls from Cybersecurity Controls.

So my question is:

Is cyber security the "internet specific part" from IT Security?, are they just the same but now we call it this new way?

Or is Cybersecurity the new "IT Security" and now the old "IT Security" is part of this Cybersecurity?

Apart from the "technologies" or the "nature of the threats" is Cybersecurity bringing a brand new scenario to TIC Security? isn't it the same scenario but now we have more awareness of the same threats (or more people trying to explode the systems)?

  • Not clear what you're asking. Are you asking if the ISO definition is widely accepted, or are you asking if the ISO standards define IT Security differently?
    – schroeder
    May 14, 2014 at 21:46
  • Cyber Security prevents attack by the Cyber Men... Seriously, it's just one of those phrases that sounds good, invented by a think tank to help sell an idea. Till Cybernetics is fully implemented and we're all wearing implants, it's kind of meaningless. Sep 1, 2014 at 2:07
  • I'm really frustrated that this was closed. It is important to have clarity around the terms we use. There are lots of glossaries, dictionaries, and official definitions out there, making this a fine question to be answered to varying degrees of clarity or definitiveness, and getting not just those details, but also the sense of this expert community is a significant role for us. The fact that some answers will just be opinions just means we shouldn't vote for them. See e.g. the Quora question at quora.com/…
    – nealmcb
    Aug 3, 2016 at 15:17
  • @nealmcb if only there was any kind of standard for what 'cyber' meant. The lack of standard is why any answer will be opinion.
    – schroeder
    Aug 3, 2016 at 20:59
  • 1
    cyber.uk/cyber - has some interesting points relating to this which, I think, deserve some consideration. Also worth noting that several governments now use terms like "Cybersecurity" and "Cyber Defence" a lot so answers relating to possible canonical definitions (or lack thereof) would seem useful. nato.int/cps/en/natohq/topics_78170.htm as an example Aug 8, 2016 at 8:27

2 Answers 2


NoVa Infosec has a good post on this exact topic.

Venn Diagram

I tend to agree with the author's view that Information Security is a super-set of Cyber Security.

In my humble opinion "Cyber Security" was most probably a term coined in a late 90's boardroom somewhere by a sales person during his marketing spiel because "Website/Data/System/Internet Security" didn't sound cool enough.

Either way, I don't think you'll ever get the users of these interchangeable terms to agree on a common use.

  • I agree with you, I also think that both terms refer to the same, but I just want to know what the community thinks about this.
    – kiBytes
    May 16, 2014 at 16:46

"Cybersecurity" as it is used today, has no consistent formal definition today. There have been a number of attempts to formalize the definition, however, the results conflict, and the attempts have been ignored completely by the marketing departments of security vendors who like to use the term in any way that makes their respective products seem most advanced.

What the formal definitions propose is cybersecurity is anything from a synonym of IT Security, to a specific subset of IT Security dealing with threats to cyberspace or the digital realm alone, but not to the physical elements of IT Security, to even tighter definitions that limit it to specific types of attacks and defense.

Ultimately, it isn't well defined at this point in time, so attempting to constrain it to a definition more granular than IT Security would be something of a Sisyphean task. It's probably most helpful to think of it as a synonym when others use it, and not use it yourself at all, if you can help it.

  • I agree here except for the "not use it unless you have to part" evidence suggests that its a commonly understood phrase for non specialists and therefore makes sense to use... Aug 8, 2016 at 14:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .