When reading about computer security, there are a lot of different areas mentioned: Application Security, Information Security, Network Security, IT Security, etc. What are the distinct fields within the realm of computer security, and what are the differences between them?

  • several divisions have emerged in security as it happens in expert-ising any domain... but in broader view I feel it all revolves down to Application Level Security & User Level Security. _ As AppSec, NetSec & others are all an attempt to prevent exploiting the Running Piece of Code for it. _ And even if the application is most robust, it can't do anything if user is following bad practices or is already compromised. – AbhishekKr Sep 29 '11 at 7:31

Two points to consider: these are all relatively loose terms, and practitioners often have to be able to function in the roles of regular admins or programmers to be functional. That does not mean they have to be as efficient -- AppSec folks probably aren't as used to writing sorting algorithms, for example.

Information Security

Umbrella covering everything to do with information security. InfoSec specialists cover a wide range of topics and are skilled generalists. In a big company setup, they are your CISOs and managers. In a smaller company, they are your practitioners.

Application Security

Related more to software design and programming. AppSec specialists are familiar with programming and tend to focus on secure application design.

Network Security

Firewalls, IDS, VPNs; practitioners understand lots of application-specific protocols. Anything that flows through a router is in their world.

IT Security

Host-based security, domain controllers / auth servers, mandatory access controls systems. ITSec is focused inside of the system.

  • It may be worth noting that "Information Security" is, technically, not just "Computer Security". – Iszi Sep 28 '11 at 18:45
  • @Iszi: What's the difference? – jrdioko Sep 28 '11 at 18:49
  • 2
    @jrdioko - IT Security is closer to computer security. Computer security refers to computers, Information security encompasses everything here, plus personnel security, procedural security, contract & legal security, sometimes physical security etc - in fact any aspect of security focused on securing data/information – Rory Alsop Sep 28 '11 at 18:53
  • 2
    @jrdioko - Strictly speaking, while it is usually used these days to refer to some form of "Computer Security", "Information Security" involves the security of data in all forms - electronic, paper, or otherwise. Obviously, anything outside of electronic data security (and even some realms within) will not be within the realm of "Computer Security". – Iszi Sep 28 '11 at 18:55

The terms come from a basic concept of grouping domains of related systems and people into individual fields where best practices can be established. A good breakdown of the terms and practices can be found here http://www.us-cert.gov/ITSecurityEBK/EBK2008.pdf (URL updated from uscert.gov). Each domain presents unique aspects and vulnerabilities. If they are addressed individually the whole IT infrastructure can be strengthened in ways that is not possible with broader generalization.

  • 2
    Good information, long damn read. Could you summarize? – Jeff Ferland Sep 28 '11 at 19:26
  • Suggest you pick your item of interest and keyword search to that point and it reads much better. Take application security for example. A quick search for that phrase gets you to "3.7 System and Application Security" section with a nice one page summary sheet. Pick small bits and it will fall together quickly. – zedman9991 Sep 28 '11 at 19:56

Largely, these terms have no meaningful distinctions, with the exception of "web app security", and people use them interchangeably. Which term a person uses often reflects their background, such as government, or military, or financial. Or, what their first job was, maintaining servers, network equipment, etc.

The reason is that these things heavily overlap. Take the Conficker worm, for example. Is it a host security issue like a virus? Or a network security issue, because it's a worm?

I use the term "cyber" security, precisely because "cyber" doesn't mean anything specific, other than it's distinct from things like "physical" security.

The most useful distinction is "web app security", dealing with the OWASP Top 10 issues like SQL injection or XSS. Sure, you might put a "web app firewall" in front of your application, a "network security" issue, but ultimately, you have to address the underlying web app vulnerabilities.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.