Online commerce made it easier to reach customers. It also made it easier for criminals to target the data, money, and reputation behind that work. Three terms get used interchangeably in that conversation: information security, cybersecurity, and network security. They overlap, but they are not the same job.
Related: Healthcare cyber security trends.
Information security
Information security (“infosec”) is about protecting business data wherever it lives: laptops, servers, cloud drives, paper, or backups. The goal is to stop unauthorized access, use, disclosure, change, or destruction. A governance framework should say who owns which data, who may use it, and how permissions are reviewed.
The CIA triad
- Confidentiality — only authorized people can read it, often with encryption
- Integrity — unauthorized people cannot change it
- Availability — authorized people can get it when they need it
Practical measures sit in four layers: technical (hardware and software), human (training and procedures), physical (locks and restricted rooms), and organizational (who monitors indicators of compromise).
Cybersecurity
Cybersecurity is broader. It protects the whole digital operation from attack, not only stored files. That includes social engineering: phishing, pretexting, baiting with infected USB drives, quid pro quo scams, and tailgating into restricted areas. Staff who are not in IT are often the first target. Lock screens, verify visitors, and do not open mail from unknown senders. Related: security risk analysis.
Network security
Network security is the slice that protects the internal network itself from viruses, worms, Trojans, spyware, adware, zero-days, and direct attacks. Common components include firewalls, antivirus, intrusion detection and prevention, and VPNs for people working off-site.
If you need help aligning all three — information, cyber, and network — contact Cyber Security Resource.