Cyber Security—also called Information Security, or InfoSec—is arguably the most interesting profession on the planet. It requires some combination of the attacker mentality, a defensive mindset, and the ability to constantly adapt to change. This is why it commands some of the highest salaries in the world.
“Cyber” vs. Information Security
People who’ve been in Information Security for a long time tend to really dislike the word “cyber” being used in a non-ironic way to describe what we do. But we’re getting over it.
One of the most common questions in the computer security industry is the difference between Cybersecurity and Information Security. The short answer is, “not much”. But the long answer is, well…longer.
Essentially, “Cyber” is a word from pop culture that actually fit our digital future fairly well, with the merging of humans and technology and society. In the beginning, “CyberSecurity” was used as a way to glamorize or sensationalize computer security, but over time people started using it in more and more serious conversations. And now we’re stuck with it.
If I had to give any distinction today (2019) it would be that Cybersecurity is a bit larger in scale than Information Security.
Information Security has always had a tie to protecting data as a core part of its identity. CyberSecurity, on the other hand, includes more connotations around protecting anything and everything we depend on—including things like critical infrastructure.
my CyberSecurity blog posts
CyberSecurity is such a big field, however, that it’s useful to break it up into sections. I’ve done this over the 20 years that I’ve been writing about security, and here are some of the areas in security that you might find interesting.
Sales and marketing teams often conflate these definitions, leading to confusion in the industry.
- Offensive Testing: When to Use Different Types of Security Assessments, The Difference Between Pentesting and Red Teaming, The Difference Between Threats, Threat Actors, Vulnerabilities, and Risks, The Difference Between Events, Alerts, and Incidents, Security Assessment Types
- Security Tools: Shodan, Masscan, Nmap, Tcpdump, Lsof, iptables
My cybersecurity career guide takes you step by step through the process of building a security career.
- Building a Security Career: Building a Career in Cybersecurity, Information Security Interview Questions, Cybersecurity Lacks Entry-level Positions
- Security Philosophy: Secrecy is a Valid Security Layer
- Security Concepts: Encryption vs. Encoding vs. Hashing, Information Security Definitions
Attack
- Security Assessment Types
- The Difference Between a Vulnerability Assessment and a Penetration Test
- The Difference Between Red, Blue, and Purple Teams
- A Masscan Tutorial
- A Bettercap Tutorial
- How to Use Shodan
- When to Use Vulnerability Assessments, Pentesting, Red Team Assessments, and Bug Bounties
- Purple Team Pentests Mean You’re Failing at Red and Blue
- An
nmapPrimer
Defense
- Obscurity is a Valid Security Layer
- An
iptablesPrimer - The Difference Between Events, Alerts, and Incidents
- Information Security Metrics
- Same Origin Policy Explained
- Serialization Bugs Explained
- A Security-focused HTTP Primer
- Vulnerability Database Resources
Assorted
- My Information Security Blog Posts
- Information Security Definitions
- The Difference Between Threats, Vulnerabilities, and Risks
- How to Build a Successful Information Security Career
- The Birthday Attack
- Information Security Interview Questions
- Encoding vs. Encryption vs. Hashing
- Diffie-Hellman Explained
- The Difference Between the Internet, the Deep Web, and the Dark Web
—
Become a direct supporter of my content for less than a latte a month ($ 50/year) and get the Unsupervised Learning podcast and newsletter every week instead of just twice a month, plus access to the member portal that includes all member content.
