When reading about computer security, there are a lot of different areas mentioned: Application Security, Information Security, Network Security, IT Security, etc. What are the distinct fields within the realm of computer security, and what are the differences between them?
Two points to consider: these are all relatively loose terms, and practitioners often have to be able to function in the roles of regular admins or programmers to be functional. That does not mean they have to be as efficient -- AppSec folks probably aren't as used to writing sorting algorithms, for example.
Umbrella covering everything to do with information security. InfoSec specialists cover a wide range of topics and are skilled generalists. In a big company setup, they are your CISOs and managers. In a smaller company, they are your practitioners.
Related more to software design and programming. AppSec specialists are familiar with programming and tend to focus on secure application design.
Firewalls, IDS, VPNs; practitioners understand lots of application-specific protocols. Anything that flows through a router is in their world.
Host-based security, domain controllers / auth servers, mandatory access controls systems. ITSec is focused inside of the system.
The terms come from a basic concept of grouping domains of related systems and people into individual fields where best practices can be established. A good breakdown of the terms and practices can be found here http://www.us-cert.gov/ITSecurityEBK/EBK2008.pdf (URL updated from uscert.gov). Each domain presents unique aspects and vulnerabilities. If they are addressed individually the whole IT infrastructure can be strengthened in ways that is not possible with broader generalization.
Largely, these terms have no meaningful distinctions, with the exception of "web app security", and people use them interchangeably. Which term a person uses often reflects their background, such as government, or military, or financial. Or, what their first job was, maintaining servers, network equipment, etc.
The reason is that these things heavily overlap. Take the Conficker worm, for example. Is it a host security issue like a virus? Or a network security issue, because it's a worm?
I use the term "cyber" security, precisely because "cyber" doesn't mean anything specific, other than it's distinct from things like "physical" security.
The most useful distinction is "web app security", dealing with the OWASP Top 10 issues like SQL injection or XSS. Sure, you might put a "web app firewall" in front of your application, a "network security" issue, but ultimately, you have to address the underlying web app vulnerabilities.