Nowadays, what is the difference between Cyber Security and IT Security?

Question

Lately (and not so lately), you can hear a lot about cyber security. It is really hard to find an official description about this matter so, let's take the ISO 27032 description:

"Cybersecurity” or “Cyberspace security”, defined as the “preservation of confidentiality, integrity and availability of information in the Cyberspace”. In turn “the Cyberspace” (complete with definite article) is defined as “the complex environment resulting from the interaction of people, software and services on the Internet by means of technology devices and networks connected to it, which does not exist in any physical form”.

Further reading into ISO 27032 will discover some similarities with the ISO27001 and it is really hard to differentiate Information Security Controls from Cybersecurity Controls.

So my question is:

Is cyber security the "internet specific part" from IT Security?, are they just the same but now we call it this new way?

Or is Cybersecurity the new "IT Security" and now the old "IT Security" is part of this Cybersecurity?

Apart from the "technologies" or the "nature of the threats" is Cybersecurity bringing a brand new scenario to TIC Security? isn't it the same scenario but now we have more awareness of the same threats (or more people trying to explode the systems)?

Answer 1

NoVa Infosec has a good post on this exact topic.

I tend to agree with the author's view that Information Security is a super-set of Cyber Security.

In my humble opinion "Cyber Security" was most probably a term coined in a late 90's boardroom somewhere by a sales person during his marketing spiel because "Website/Data/System/Internet Security" didn't sound cool enough.

Either way, I don't think you'll ever get the users of these interchangeable terms to agree on a common use.

Answer 2

"Cybersecurity" as it is used today, has no consistent formal definition today. There have been a number of attempts to formalize the definition, however, the results conflict, and the attempts have been ignored completely by the marketing departments of security vendors who like to use the term in any way that makes their respective products seem most advanced.

What the formal definitions propose is cybersecurity is anything from a synonym of IT Security, to a specific subset of IT Security dealing with threats to cyberspace or the digital realm alone, but not to the physical elements of IT Security, to even tighter definitions that limit it to specific types of attacks and defense.

Ultimately, it isn't well defined at this point in time, so attempting to constrain it to a definition more granular than IT Security would be something of a Sisyphean task. It's probably most helpful to think of it as a synonym when others use it, and not use it yourself at all, if you can help it.