Information Security and Cybersecurity have become common terms in the discussions of governments and boards worldwide. It is not surprising, given the amount of data breaches and nation-state attacks that are increasing every day and show no sign of stopping anytime soon. This threat has reached the point that the World Economic Forum listed “Widespread cybercrime and cyber insecurity” as one of the top global risks for the next decade in their latest report!
Yet a common mistake when discussing Information Security and Cybersecurity is to use these terms interchangeably. Information Security and Cybersecurity are deeply linked but have different focus points. It is essential to understand these differences, especially when setting out the security roadmap for your company. Not understanding these subtle differences can result in key controls being missed and not implemented.
The difference between Information Security and Cybersecurity
Despite sharing many similarities, information security and cybersecurity differ in how they approach controls and where these controls are focused:
“Information Security,” as the name implies, pertains to controls that protect the confidentiality, integrity, and availability of information in all its forms. These controls can range from technical (like passwords, encryption, tokens, etc.) to administrative controls (like policies, procedures, standards, etc.). The critical point to note is that information is the focal point of protection from creation to destruction.
“Cybersecurity” is similar, but this discipline focuses on protecting information and systems from cyberattacks. Cybersecurity falls under information security and covers the controls put in place to protect systems, users, networks, and devices from cyberattacks such as malware, denial of service, phishing, etc. Cybersecurity ensures that any unauthorized attempt to access information will be detected and stopped.
As we can see here, information security is a much broader term encompassing a vast number of controls, including cybersecurity and other disciplines. For example, privacy controls and data classification might be covered under information security, yet they have no relation to cybersecurity. Information security also takes a more proactive approach by identifying and mitigating risks to information before they can cause damage.
The focus of cybersecurity, on the other hand, is monitoring and protecting an entity’s digital assets (such as networks, servers, endpoints, etc.) from cyberattacks. While information security is concerned about the complete lifecycle of an asset from creation to destruction, cybersecurity is very much concerned with the here and now. Controls like security monitoring, incident response, and anti-malware are all required to respond in real-time to ensure that the cybersecurity of an asset is not compromised at any point. Cybersecurity is more reactive and real-time than information security and requires constant vigilance to ensure that no threat can slip past and cause a compromise.
Information Security and Cybersecurity from the context of a company
To better appreciate these two disciplines, let us take the example of a payment company we will call Company A and how information security and cybersecurity would work together to protect it. Payment companies are defined by the critical data they store; this data is typically governed by Payment Card Industry (PCI) and GDPR requirements. There is also a strong need to identify and detect any security violations before they can cause damage to the company, given the highly sensitive nature of the processing the company carries out.
Information Security for Company A would involve the following:
- Creating policies and procedures that govern the security activities for Company A and setting down the overall tone of security for the company.
- Implementing governance frameworks that ensure adherence to compliance standards like PCI Data Security Standard and GDPR.
- Identifying and classifying the information present in the company, such as payment and personally identifiable information (PII).
- Implementing controls, such as risk assessments, data classification, data encryption, etc., to protect this information from its creation to maintenance to destruction.
- These controls can also be physical, such as facilities, access control, physical locks, disaster recovery, backup media, etc.
Cybersecurity for Company A would focus on the following:
- Implementing controls that protect Company A information, system, networks, and users from being compromised.
- These controls would be present at multiple layers, such as network firewalls, intrusion detection and prevention systems, email filters, anti-malware controls, security alerts, etc.
- Ensuring that these controls are monitored effectively, and any violations are responded to with minimum delay.
As we can see, information security and cybersecurity have different approaches in how they go about securing an environment. Information Security controls set down the tone and overall governance, such as policies and procedures, complemented by technical controls like encryption. Cybersecurity is geared towards being reactive and protecting against any data breaches and security compromises. The goal of cybersecurity is to identify an attack that is taking place, contain the impact of the attack, and respond in as short a time window as possible.
Is one better than the other?
One may wonder which is better: information security or cybersecurity; however, this is not a question that accurately reflects how the security discipline works, and is wrong for several reasons:
- The scope of information security is much larger, covering controls like policies, governance framework, data governance, etc. Cybersecurity compliments it by ensuring these controls are not compromised by an attacker.
- Cybersecurity falls under information security and is a critical component of an overall security framework.
- Although it is possible to implement cybersecurity without broader information security controls, it will result in an environment that is not fully secured and more vulnerable to security weaknesses.
Cybersecurity implemented in isolation will not have visibility into the sensitivity and criticality of information, and thus cannot prioritize security incidents properly. There is a direct correlation between the sensitivity of an asset and its threat level; therefore, cybersecurity needs information security controls like risk assessments and data classification to provide information about what areas to prioritize.
At the same time, information security in isolation will be unable to translate its policy vision into technical controls without cybersecurity controls. No number of policies can help if controls like firewalls, network monitoring, and anti-malware are not implemented and monitored. Once an asset has been classified, the appropriate levels of controls should be implemented, of which cybersecurity is crucial.
As we can see, information security and cybersecurity do not exist in a vacuum, but rather complement each other for a practical security framework. Therefore, we recommend implementing both information security and cybersecurity measures to provide comprehensive protection for sensitive information and systems.
One example of a control encompassing both these fields could be access control, which prevents unauthorized access to a file, network, user, or system. Access control over a document in Information Security would revolve around data classification and encryption to prevent any attempts to violate the confidentiality, availability, or integrity of this document.
Cybersecurity in access control would revolve around monitoring and responding to data leakage controls that prevent anyone from copying the document out of the environment or attempts to access the file from unauthorized parties.
As we can see, both information security and cybersecurity work together to enforce effective access control over this document.
Looking ahead
Despite working towards the same goal, information security and cybersecurity have some key differences and are not interchangeable. They have different areas of focus and different approaches in how controls are implemented. At the same time, both are needed for a practical security framework to protect a company from internal and external threat actors. Information security has a much broader reach when protecting information, whereas cybersecurity focuses on protecting a company’s assets from cyber threats.
Both provided a layered approach essential for effective security governance of an environment. Companies must understand the subtle differences between the two and implement both information and cybersecurity controls to fully mitigate cyber threats.
Thank you for trusting us to help with your cybersecurity needs. Contact us any time – we’re always happy to help.
Adam
