# data[].attributes.body
1. The text resources are the embed photos on each table

2. Thank you for allowing to turn in this project late

# data[].attributes.headline
General Question: Information Security vs Cyber Security

# data[].attributes.subject
General Question: Information Security vs Cyber Security

# data[].attributes.body
The major difference between information security and cyber security is the coverage of security that both provides. Cyber security only covers information digitally, while information security is more general and covers both physical and digital info and access.

Some trends and threats with info. security right now is social engineering, use of ai for password cracking, and different types of hacking.

Organizations can balance the need for info. security and need for employee access by limiting certain functions and access to only certain employees. For example, new employees shouldn't have permissions to access vast amounts of data, but instead should be limited to what they only need.

Video Resource: https://www.youtube.com/watch?v=RDiD0wq2VWo

# data[].attributes.attachment_link.readable_text
Contributor, Deputy Editor

It's easy to confuse information security (infosec) and cybersecurity, as the two areas overlap in many ways. In fact, cybersecurity is a subset of information security. However, the fields are not quite the same, with each featuring distinct specialties and requiring different skill sets.

Even within the infosec and cybersecurity communities, the distinction between these terms is hotly debated and can be blurry. Many people use "information security" and "cybersecurity" interchangeably. However, understanding the textbook definitions of these terms can help you gain a deeper understanding of how the disciplines compare and interact.

Read on to learn more about the similarities and differences between information security and cybersecurity.

Information Security vs. Cybersecurity

The National Institute of Standards and Technology (NIST) recognizes information security and cybersecurity as separate career areas. That said, there is certainly an overlap between the two. Below are the key definitions and distinctions of each.

What Is Information Security?

According to NIST, infosec's core function is to safeguard information and information systems against unauthorized access and use. Unauthorized use as NIST defines it can include destroying, modifying or disclosing data, as well as disrupting the functioning of an information system.

The field aims to provide confidentiality, integrity and availability-three guiding principles that form a model commonly referred to as the CIA triad among industry professionals.

One way to understand infosec as compared to cybersecurity is to view the field as an umbrella term that includes all data, not just data stored within cyberspace. Infosec extends its protective umbrella not only over digitally-stored data, but also other forms of data, such as paper-based information. This demonstrates how cybersecurity is a type of information security, but the two fields are not identical.

Information security teams create and implement policies and systems to protect information. For large organizations, strict security systems and standard operating procedures are required to protect customers.

What Is Cybersecurity?

Living in the 21st century means much of an organization's data is stored in computer systems and networks. This is the case for nearly every industry, and the information must be protected to a high degree. Information security professionals with a cybersecurity focus are responsible for securing this digital data.

NIST defines cybersecurity as protecting, preventing damage to and restoring electronic communications services and systems. This includes the information stored in these systems, which cybersecurity professionals work to protect.

Cybersecurity covers everything that has to do with electronic systems and communications. Within the field of cybersecurity are subcategories that entail further specialization. These include areas such as cloud, network, endpoint, and critical infrastructure security.

The Biggest Differences

Confusion between information security and cybersecurity can occur since much of the information we want to store, protect and transmit exists in cyberspace. While cybersecurity is a part of information security, certain aspects of information security are not included within the realm of cybersecurity.

Information security is an overarching term for creating and maintaining systems and policies to protect any information-digital, physical or intellectual, not just data in cyberspace.

An information security expert may develop the means of data access by authorized individuals or establish security measures to keep information safe. Cybersecurity, on the other hand, focuses on protecting information from cyberattacks and threats such as ransomware and spyware.

How Information Security and Cybersecurity Overlap

Cybersecurity leader and SimSpace CISO Jordan Wigley points out, "While there are technically differences between infosec and cybersecurity, many industry professionals have begun using the terms interchangeably. It is important to pay attention to the context in which the terms are used in order to understand the true meaning by an individual or publication."

It's understandable that information security and cybersecurity are often treated as synonymous, since these fields overlap in many ways. In addition to having similar security practices, these disciplines also require similar education and skills.

"While there are technically differences between infosec and cybersecurity, many industry professionals have begun using the terms interchangeably. It is important to pay attention to the context in which the terms are used in order to understand the true meaning by an individual or publication." -Jordan Wigley, SimSpace CISO

Shared Security Practices

The most significant overlap between infosec and cybersecurity is that they use the CIA (confidentiality, integrity and availability of information) triad model to develop security policies.

The first of the triad is confidentiality, ensuring that information is only accessed and modifiable by authorized users. From a consumer perspective, for example, we expect online retailers to store and protect our data such as credit card information, home addresses and other personal information.

Second, the integrity of information ensures that it has not been tampered with and is entirely reliable. Continuing with the online retailer example, the data transmitted between the retailer and your bank must be secure. Otherwise, there may be a discrepancy between the actual cost of your goods and the amount you paid.

Finally, availability of information means that the data is available when you need it. For example, if you need to know how much money you have in your bank account, you must be able to access that information.

Related Education and Skills

At a minimum, many careers in infosec and cybersecurity require a bachelor's degree in cybersecurity, computer science, information technology or a related field. These degrees prepare you with foundational knowledge and skills to help you land a job as an analyst, engineer, specialist or tester.

These careers also call for familiarity with technologies such as database user interface and query software, network monitoring software, virus protection and web platform development.

Common Careers

Many information security and cybersecurity careers use similar or interchangeable language in their job descriptions. This is because employers often want infosec professionals with a broad array of security skills, including those in cybersecurity.

Information Security Roles

We reference salary data from Payscale and the U.S. Bureau of Labor Statistics (BLS) in this section.
Information Security Analyst

Career Overview: With so much of our valuable information stored on computers, information security analysts often perform similar tasks to cybersecurity analysts. These professionals are responsible for planning, implementing, upgrading and monitoring security measures to protect computer networks and information. They may also create and share reports about security metrics and data breaches.

Average Annual Salary: About $112,000

Information Security Specialist

Career Overview: An information security specialist's role is similar to that of an information security analyst. While day-to-day duties may vary depending on the specific position, these professionals are part of teams that develop and implement information risk management frameworks, standards and policies. They also participate in risk assessments and assist users in accessing databases.

Average Annual Salary: Around $82,000

IT Security Consultant

Career Overview: As an IT security consultant, you use your infosec experience to assess and recommend improvements to an organization's information security. Your responsibilities may include supporting, implementing and following up on data privacy improvements, identity access management systems, cybersecurity management and operations.

Average Annual Salary: Over $88,000

Cybersecurity Roles
Cybersecurity Analyst

Career Overview: Cybersecurity analysts focus on protecting data from cyberattacks. These professionals perform threat and incident detection and respond to data breaches. Depending on the employer, cybersecurity analysts may develop cybersecurity awareness training and forensic analysis of information systems.

Average Annual Salary: Around $81,000

Cybersecurity Engineer

Career Overview: A cybersecurity engineer's role is expansive, overseeing the development of cybersecurity procedures and policies. This job includes building and maintaining firewalls to ensure secure transmission of information, developing security controls to protect digital files and monitoring and responding to security breaches. If you're wondering how to become a cybersecurity engineer, start with a bachelor's degree or cybersecurity bootcamp.

Average Annual Salary: Around $102,000

Penetration Tester

Career Overview: Penetration testers hackers with good intentions whose efforts improve information protection practices. Through simulated internal and external cyberattacks, these professionals breach and exploit systems and gain access to sensitive information to identify vulnerabilities. They then design and suggest security solutions to address said vulnerabilities. Pen testers also find system weaknesses and suggest improvements to bolster defenses against malicious attacks.

Average Annual Salary: Around $94,000

Frequently Asked Questions (FAQs) About Information Security vs. Cybersecurity

# data[].attributes.attachment_link.title
Information Security Vs. Cybersecurity: What's The Difference?

# data[].attributes.attachment_link.description
It's easy to confuse information security (infosec) and cybersecurity, as the two areas overlap in many ways. In fact, cybersecurity is a subset of information security. However, the fields are not quite the same, with each featuring distinct specialties and requiring different skill sets. Even w

# data[].attributes.body
Social engineering is the ability to gain unauthorized access and information through human activity rather brute forcing a system. Some common examples include phishing, scareware, and tailgating. Organizations can protect themselves by informing employees about these attacks and upholding policy to prevent certain actions (i.e. holding the door for someone you don't know).

Some emerging trends with social engineering is doing more physical acts, such as tailgating and dumpster diving, and using ai to fake interactions with employees (i.e. using ai voices and video in a zoom call). Organizations must educate to employees about these particular attacks and having a protocol if they feel like they're being attacked.

Video Resource: https://www.youtube.com/watch?v=v7VTJhkJUUY

# data[].attributes.attachment_link.readable_text
What is social engineering

Social engineering is the term used for a broad range of malicious activities accomplished through human interactions. It uses psychological manipulation to trick users into making security mistakes or giving away sensitive information.

Social engineering attacks happen in one or more steps. A perpetrator first investigates the intended victim to gather necessary background information, such as potential points of entry and weak security protocols, needed to proceed with the attack. Then, the attacker moves to gain the victim's trust and provide stimuli for subsequent actions that break security practices, such as revealing sensitive information or granting access to critical resources.

What makes social engineering especially dangerous is that it relies on human error, rather than vulnerabilities in software and operating systems. Mistakes made by legitimate users are much less predictable, making them harder to identify and thwart than a malware-based intrusion.

Social engineering attack techniques

Social engineering attacks come in many different forms and can be performed anywhere where human interaction is involved. The following are the five most common forms of digital social engineering assaults.

Baiting

As its name implies, baiting attacks use a false promise to pique a victim's greed or curiosity. They lure users into a trap that steals their personal information or inflicts their systems with malware.

The most reviled form of baiting uses physical media to disperse malware. For example, attackers leave the bait-typically malware-infected flash drives-in conspicuous areas where potential victims are certain to see them (e.g., bathrooms, elevators, the parking lot of a targeted company). The bait has an authentic look to it, such as a label presenting it as the company's payroll list.

Victims pick up the bait out of curiosity and insert it into a work or home computer, resulting in automatic malware installation on the system.

Baiting scams don't necessarily have to be carried out in the physical world. Online forms of baiting consist of enticing ads that lead to malicious sites or that encourage users to download a malware-infected application.

Scareware

Scareware involves victims being bombarded with false alarms and fictitious threats. Users are deceived to think their system is infected with malware, prompting them to install software that has no real benefit (other than for the perpetrator) or is malware itself. Scareware is also referred to as deception software, rogue scanner software and fraudware.

A common scareware example is the legitimate-looking popup banners appearing in your browser while surfing the web, displaying such text such as, "Your computer may be infected with harmful spyware programs." It either offers to install the tool (often malware-infected) for you, or will direct you to a malicious site where your computer becomes infected.

Scareware is also distributed via spam email that doles out bogus warnings, or makes offers for users to buy worthless/harmful services.

Pretexting

Here an attacker obtains information through a series of cleverly crafted lies. The scam is often initiated by a perpetrator pretending to need sensitive information from a victim so as to perform a critical task.

The attacker usually starts by establishing trust with their victim by impersonating co-workers, police, bank and tax officials, or other persons who have right-to-know authority. The pretexter asks questions that are ostensibly required to confirm the victim's identity, through which they gather important personal data.

All sorts of pertinent information and records is gathered using this scam, such as social security numbers, personal addresses and phone numbers, phone records, staff vacation dates, bank records and even security information related to a physical plant.

Phishing

As one of the most popular social engineering attack types, phishing scams are email and text message campaigns aimed at creating a sense of urgency, curiosity or fear in victims. It then prods them into revealing sensitive information, clicking on links to malicious websites, or opening attachments that contain malware.

An example is an email sent to users of an online service that alerts them of a policy violation requiring immediate action on their part, such as a required password change. It includes a link to an illegitimate website-nearly identical in appearance to its legitimate version-prompting the unsuspecting user to enter their current credentials and new password. Upon form submittal the information is sent to the attacker.

Given that identical, or near-identical, messages are sent to all users in phishing campaigns, detecting and blocking them are much easier for mail servers having access to threat sharing platforms.

Spear phishing

This is a more targeted version of the phishing scam whereby an attacker chooses specific individuals or enterprises. They then tailor their messages based on characteristics, job positions, and contacts belonging to their victims to make their attack less conspicuous. Spear phishing requires much more effort on behalf of the perpetrator and may take weeks and months to pull off. They're much harder to detect and have better success rates if done skillfully.

A spear phishing scenario might involve an attacker who, in impersonating an organization's IT consultant, sends an email to one or more employees. It's worded and signed exactly as the consultant normally does, thereby deceiving recipients into thinking it's an authentic message. The message prompts recipients to change their password and provides them with a link that redirects them to a malicious page where the attacker now captures their credentials.

Social engineering prevention

Social engineers manipulate human feelings, such as curiosity or fear, to carry out schemes and draw victims into their traps. Therefore, be wary whenever you feel alarmed by an email, attracted to an offer displayed on a website, or when you come across stray digital media lying about. Being alert can help you protect yourself against most social engineering attacks taking place in the digital realm.

Moreover, the following tips can help improve your vigilance in relation to social engineering hacks.

Don't open emails and attachments from suspicious sources - If you don't know the sender in question, you don't need to answer an email. Even if you do know them and are suspicious about their message, cross-check and confirm the news from other sources, such as via telephone or directly from a service provider's site. Remember that email addresses are spoofed all of the time; even an email purportedly coming from a trusted source may have actually been initiated by an attacker.

Use multifactor authentication - One of the most valuable pieces of information attackers seek are user credentials. Using multifactor authentication helps ensure your account's protection in the event of system compromise. Imperva Login Protect is an easy-to-deploy 2FA solution that can increase account security for your applications.

Be wary of tempting offers - If an offer sounds too enticing, think twice before accepting it as fact. Googling the topic can help you quickly determine whether you're dealing with a legitimate offer or a trap.

Keep your antivirus/antimalware software updated - Make sure automatic updates are engaged, or make it a habit to download the latest signatures first thing each day. Periodically check to make sure that the updates have been applied, and scan your system for possible infections.

# data[].attributes.attachment_link.title
What is Social Engineering | Attack Techniques & Prevention Methods | Imperva

# data[].attributes.attachment_link.description
Social engineering uses psychological manipulation to trick users into making security mistakes or giving away sensitive information

# data[].attributes.body
Organizations can use multi-factor authentication (MFA) to help prevent certain attacks from occurring. Organizations must make sure every employee has it or else a gap in the security system can be exposed. Organizations also must choose the right system for their MFA and make sure it integrates easily with their current system.

Some people may not be comfortable using biometrics for authentication. Biometrics also aren't always consistent (i.e. having water on your finger while using a fingerprint scanner) and can also be duplicated, which can be a huge security flaw. Organizations must chose a MFA system that is both transparent and secure to ease in employees into using biometrics.

Video Resource: https://www.youtube.com/watch?v=07mRDyydCNY

# data[].attributes.attachment_link.readable_text
In part 1 of our MFA 101 series, we talked about what multi factor authentication is and many of the common terms and factor types. Now that we've covered the basics of multi factor authentication, it's important to consider the WHY. As in, what motivates an organization to implement multi factor authentication?

While the obvious reason for multi factor authentication is that it adds additional layers of security, what does this really mean? Each organization is different, and therefore, will have unique needs. While the right MFA solution should strike a balance between added security and user convenience, there's no magic, one-size-fits-all solution that works for every organization.

Thus, it's crucial that you thoroughly understand your organization's motivations and needs for multi factor authentication, as well as MFA's challenges and benefits to ensure you select a solution that's right for your organization.

Purpose, Needs, and Motivations for Multi factor Authentication

There are typically three primary motivations for why people and organizations use MFA: security, compliance, and usability.

Security

The strength of authentication systems are largely determined by the number of factors or layers incorporated into the system. While each authentication method has strengths and weaknesses, systems that use two or more different factors are typically considered stronger than those that use only one factor.

Compliance

Almost every organization has some level of local, state, and/or federal compliance to which they must adhere. Many of these regulations specify that organizations must utilize MFA under certain circumstances, like when accessing particular types of data or connecting from certain locations. There is pressure for organizations to maintain compliance in order to mitigate audit findings and avoid potential fines and other penalties.

Usability

The key need regarding usability revolves around the concept that "passwords are dead." This phrase commonly heard has two core meanings. First, people have too many passwords for their devices and applications, whether personal and/or professional. Furthermore, if you follow password best practices and make each one different and complex, most technical folks even struggle with the task. While password managers and IAM systems with single sign-on provide significantly reduce password-related headaches, with MFA, there are some opportunities to eliminate the use of passwords altogether by securely authenticating users via other methods-a significant motivator on the usability front.

Multi factor Authentication Benefits

The benefits for MFA align very closely to the motivations for having multi factor authentication.

Improve Security

The primary benefit of multi factor authentication is that it provides additional security by adding protection in layers. The more layers/factors in place, the more the risk of an intruder gaining access to critical systems and data is reduced.

Achieve Compliance

A second benefit of multi factor authentication is being able to achieve the necessary compliance requirements specific to my organization which in turn mitigate audit findings and avoiding potential fines.

Increase Flexibility and Productivity

And finally, being able to remove the burden of passwords by replacing them with alternatives has the potential to increase productivity and bring a better usability experience due to the increased flexibility of factor types. In the right environment and situation, there could even be an opportunity for a potential reduction in operational costs.

Multi factor Authentication Challenges

While there are well-known benefits for MFA, as with any technology, there will be potential challenges as well. Below we have listed common sticking points for MFA.

Usability

In most MFA implementations, passwords are still present. So, now in addition to having to manage the password, users have to manage an additional layer of security. But perhaps the biggest usability challenge is that your applications and systems often require different types of MFA. You may find yourself asking the question: How is this any better than having a different password for every application?

Cost

The is probably the number one challenge for multi factor authentication, but it is not a unique challenge. Most new technology deployments incur a cost increase, at least initially. MFA brings potential cost increases for things like additional support, training, maintenance, SMS Gateway or services, mobile app development, hardware and software tokens, and stipends for mobile phone expenses.

Technical Gaps

How do you blend MFA for local devices and cloud-based applications? Does your local device have MFA? What about your local email client or local devices?

Complexity

Some physical authenticators require additional drivers. adding another dimension of complexity for deployment, support, and maintenance. This also requires constant compatability checking as environments change.

Backup Options

Do you have a backup plan in place for your multi factor solution? For example, what if a user loses his or her phone or token? Is there a way for users to gain emergency access?

Lack of Bandwidth

Technology roll-outs are time- and resource-draining. It can be difficult to balance an MFA implementation with existing priorities. MFA takes a significant amount of planning and training because it's critical that you research and understand any related compliance requirements and then figure out which solutions best align not only to those requirements, but also with your industry and user needs.

Varying Risks

Keep in mind, some methods stronger than others ( see AAL1-3 ) and each method has its own security risks. It important to understand these risks and which will provide the right level of security for your organization.

Finding the Right MFA Solution

By understanding what's motivating your organization to implement multi factor authentication, you will be better positioned to weigh the benefits and challenges of potential MFA options and to select a solution that best fits for your organization's needs and requirements.

Remember, the right solution should help your organization improve security, meet compliance requirements, and even improve the productivity of your users, while minimizing challenges, such as technical gaps, usability issues, and complexity.

The next installment of our MFA 101 series covers six guiding principles to help your organization select a multi factor authentication solution that fits this bill. Read it now.

# data[].attributes.attachment_link.title
The Challenges and Benefits of Multi factor Authentication - MFA 101, Part 2

# data[].attributes.attachment_link.description
Gain a better understanding of your organization's motivations and needs for multi factor authentication, as well as MFA's challenges and benefits.