Introduction
The digital transformation is changing almost all areas of life and work and creating new dependencies on information systems and data. Today, information is considered one of the most valuable resources of organizations, but at the same time it is exposed to a multitude of dangers. Cyberattacks, industrial espionage, data misuse and technical failures pose risks that can affect both economic performance and the trust of customers, partners and society.
In scientific and practical discourse, the terms information security and cybersecurity are often equated. However, this equation is a widespread misconception, as the two concepts encompass different protection goals, methods and levels of consideration. While information security considers the comprehensive protection of all information in all forms, cybersecurity primarily focuses on the defense against digital threats that specifically affect IT infrastructures and networks.
The aim of this article is to systematically present the two concepts, clearly highlight their differences and critically examine their interaction in the context of modern threat situations. In this way, a deeper understanding of why a precise distinction between information security and cybersecurity is necessary in order to develop effective and holistic security strategies should emerge.
1. from the technical self-image of cybersecurity to strategic information security
1.1. Historical starting point: cybersecurity as a pure IT task
In the early years of digital networking, security was understood almost exclusively under the term cybersecurity. Responsibility lay largely with the IT departments, which decided independently on technical protection measures. Measures were often based on current threats or technological trends, but less on actual business requirements.
This led to a reactive understanding of security that was primarily driven by technology. For example, new firewalls, anti-virus software or encryption systems were introduced without first checking which information or business processes actually required the highest level of protection.
1.2. The need for a strategic level
With increasing digitalization, it became clear that this technology-centric view was not enough. Companies realized that security is not just a question of individual measures, but must be closely linked to business objectives, processes and values.
There was a need for a level that mediates between business and IT and systematically controls security. This level should not implement technical measures itself, but rather specify what needs to be protected, why it is important and which requirements are to be derived from it.
1.3. The emergence of information security
Information security developed from this need. Today, it defines the framework for all security-relevant measures in organizations and is therefore clearly different from operational cybersecurity.
Information security ensures that protective measures are not implemented arbitrarily or for purely technical reasons, but that they:
- prioritized through risk analyses,
- are based on asset considerations,
- and translated into guidelines and minimum requirements that are implemented by the specialist departments in coordination with IS.
1.4. The change in practice
In practice, this change has meant that security measures are no longer decided by IT departments alone. Instead, there is coordination between management, specialist departments and IT under the direction of information security.
An example: In the past, the IT department could decide to introduce a complex encryption system without considering its impact on business processes. Today, information security defines which information is to be treated confidentially in which processes and specifies minimum requirements. IT then implements the appropriate technical measures to meet these requirements without unnecessarily impacting business activities.
1.5. Findings
The emergence of information security marks the step from a reactive, technology-driven security culture to a strategic, process-oriented management approach. While cybersecurity continues to play a central role in the operational defense against digital threats, information security forms the overarching framework that ensures that measures are targeted, risk-oriented and aligned with business needs.
2. information security as the foundation of holistic protection concepts
2.1. Concept and objectives
Information security refers to the protection of all of an organization’s information, regardless of whether it exists in digital form, on paper, in conversations or in the knowledge of employees. The aim is to protect this information from loss, manipulation, unauthorized access or unintentional disclosure, thereby safeguarding an organization’s ability to act, reliability and reputation.
The classic protection goals are:
- Confidentiality, for example through the secure storage of contract documents in a lockable archive.
- integrity, for example by protecting test logs against subsequent changes.
- availability, for example by storing redundant copies of files or setting up emergency plans.
In addition, extended goals such as authenticity, commitment and resilience are becoming increasingly important in order to counter complex threat situations.
2.2. Sub-areas of information security
Information security is made up of several core areas that together form a comprehensive protection system. These areas go far beyond pure IT and make it clear that cybersecurity is only one aspect.
- Human Resources Security
People are a key factor in information security. Measures range from reliability checks for new hires and confidentiality agreements to training and awareness-raising to equip employees to deal with confidential information and dangers such as social engineering. - Supplier management
External service providers and suppliers pose potential risks to information security. Careful selection procedures, contractual security agreements, regular audits and clearly defined interfaces are therefore part of this sub-area. - Physical security
Physical measures protect information from theft, destruction or unauthorized access. Examples include access controls to archives, the storage of sensitive documents in fireproof safes or the protection of production facilities and prototypes through security zones. - Data protection
The protection of personal data is a central element of information security. Legal bases such as the GDPR define binding requirements for the collection, processing and storage of sensitive data. Information security and data protection are closely interlinked, but not identical. - Cybersecurity
Cybersecurity focuses on protecting digital systems, networks and applications against attacks, manipulation or failures. It is an essential component of information security, but only a sub-area. While cybersecurity provides technical defensive measures, information security creates the overarching framework and also incorporates non-digital information assets. - Compliance & governance
Information security must be in line with legal, regulatory and normative requirements. These include international standards such as ISO/IEC 27001, industry-specific requirements such as TISAX, national regulations such as the BSI Act or the European NIS2 Directive. Compliance serves not only to ensure legal certainty, but also to build trust with customers, partners and stakeholders.
These sub-areas make it clear that information security is an interdisciplinary overall concept that takes technical, organizational, legal, physical and personnel aspects into account in equal measure.
2.3. Process character – PDCA cycle
Information security is not a static goal, but a continuous improvement process. A central methodological approach is the PDCA cycle (Plan – Do – Check – Act), as anchored in ISO/IEC 27001:
- Plan (planning): Analysis of sensitive information, assessment of risks, definition of security objectives, creation of guidelines and concepts.
- Do (implement): Implement organizational, physical and technical measures, introduce training, establish emergency plans.
- Check: Regular effectiveness checks, internal audits, monitoring and comparison with the specified targets.
- Act (improve): Derivation of optimization measures, adaptation to new threats, integration of lessons learned after incidents.
The PDCA cycle ensures that information security remains a dynamic system that continuously adapts to technological developments, new threat situations and organizational changes.
2.4. Assets in information security – primary and secondary levels of consideration
A key element of information security is the systematic consideration of assets, i.e. the values that are to be protected. Unlike cybersecurity, which often works at the level of individual systems or components, information security considers assets at two levels of abstraction: Primary Assets and Secondary Assets.
Primary assets – the business processes
Primary assets are the business processes of an organization in which information is generated, processed or used. These processes represent the actual value, as they form the basis for business activities and are directly linked to the protection goals of confidentiality, integrity and availability.
Examples of business processes:
- “Contract management” in an insurance company is considered a primary asset. It processes confidential customer data, which is why confidentiality is of central importance.
- “Product development” in the industry is a primary asset where the integrity of the design data is crucial.
- “Patient care” in a hospital is a primary asset where the availability of patient records is crucial.
Secondary assets – carriers and resources
Secondary assets are the resources, media and environments used by the business processes to store, process or transport information. This does not refer to each individual device or person, but to generic categories that are evaluated according to the CIA criteria.
- Employees: As knowledge carriers and stakeholders, they themselves are a secondary asset. Training, awareness-raising and reliability checks safeguard their role in the processes.
- Business premises and buildings: Offices, archives, production halls or hospital wards are secondary assets, as they create the physical environment for information processing. Access controls, physical barriers and fire protection are key measures here.
- Technical aids: Categories such as printers, server rooms or telephones are secondary assets whose protection requirements depend on the information processed in them.
- Media: Paper documents or digital data carriers are secondary assets that store or transport information.
- Software: Applications that support processes or process information also count as secondary assets.
Secondary assets answer the question: Which resources and infrastructures enable the execution of the business processes and which requirements result from the CIA criteria?
2.5. Summary
Information security is an overarching concept that goes far beyond the protection of digital systems. It relates to all of an organization’s information, regardless of form and medium, and always considers it in the context of the associated business processes. The differentiation between primary assets (business processes) and secondary assets (resources, media and environments) makes it clear that information security operates at a strategic and abstract level. Individual devices or persons are not considered in isolation, but categories are formed that are evaluated on the basis of the protection objectives.
The various sub-areas such as human resources, supplier management, physical security, data protection, compliance and cybersecurity demonstrate the interdisciplinary nature of information security. It combines organizational, legal, physical, human and technical aspects in a holistic approach.
The PDCA cycle also makes it clear that information security is not a static state. Rather, it is a continuous improvement process that ensures that measures are regularly reviewed and adapted to new threats, technological developments and organizational changes.
Information security therefore forms the strategic foundation of any modern security architecture. It is not reduced to technical issues, but addresses information as the central resource of an organization. The following chapters show how cybersecurity is positioned as a sub-area within this framework and why its differentiation from information security is of crucial importance.
3. cybersecurity as a defense of the digital world
3.1. Concept and objectives
Cybersecurity refers to the protection of information systems, networks, applications and data against digital attacks, misuse or manipulation. It is a sub-area of information security, but differs in its clear focus on the digital sphere. The aim of cybersecurity is to ensure digital confidentiality, integrity and availability and to ward off targeted threats such as malware, ransomware, phishing or attacks by organized groups.
Cybersecurity is more technical and operational than information security. While the latter thinks at business process level, cybersecurity works at system and component level.
3.2. Sub-areas of cybersecurity
Cybersecurity encompasses various domains that mainly deal with technical measures and digital threats.
- Network security
Protection of communication channels against interception, manipulation or unauthorized access through firewalls, intrusion detection and encryption. - End device security
Securing laptops, smartphones, servers or IoT devices against malware, misuse or unauthorized access. - Application security
Protection of software applications against attacks such as SQL injection, cross-site scripting or insecure interfaces. - Data security
Protection of digitally stored data through encryption, backups, access controls and redundancy concepts. - Identity and access security
Ensuring that only authorized persons can access systems, for example through strong authentication, single sign-on or zero trust models. - Incident Detection and Response
Ability to detect and analyze security incidents in real time and initiate appropriate countermeasures using SIEM or SOC structures. - Critical infrastructures and OT security
Protection of industrial control systems, energy and water supply or medical devices, which are increasingly digitally networked.
3.3. The process character of cybersecurity
Like information security, cybersecurity is a continuous process that must constantly adapt to new threats. However, instead of the PDCA cycle, cybersecurity is often based on specific frameworks and standards, such as
- NIST Cybersecurity Framework (CSF) with the phases Identify, Protect, Detect, Respond, Recover
- MITRE ATT&CK as a knowledge base for attack vectors and tactics
- ISO/IEC 27035 for incident management
These frameworks make it clear that cybersecurity is highly dynamic and must react immediately to threats. While information security defines long-term structures, the focus of cybersecurity is on operational defense and rapid response.
3.4. Assets in cybersecurity
In contrast to information security, which works with abstract categories such as primary and secondary assets, cybersecurity deals with specific technical assets. These include all components that digitally process, store or transport information.
- Servers and data centers: protection through firewalls, intrusion detection, patch management and redundancy.
- End devices: laptops, smartphones, IoT devices that need to be actively protected against malware or theft.
- Networks and communication infrastructure: routers, switches, VPN systems or cloud connections that are secured against manipulation or eavesdropping.
- Applications and databases: Systems that are specifically protected against vulnerabilities in code or interfaces.
- User accounts and identities: Management through identity access management and multi-factor authentication.
Cybersecurity answers the question: Which specific systems, components and digital resources need to be monitored and secured and how in order to prevent attacks or minimize their impact?
3.5. Summary
Cybersecurity is a specialized sub-area of information security. It focuses exclusively on the digital dimension and works at the level of specific systems and components. Its strength lies in its technical depth, its operational response to attacks and its ability to make digital infrastructures resistant to highly dynamic threats.
This makes it fundamentally different from information security, which is process-oriented and more abstract. However, the two concepts are inextricably linked. Information security provides the strategic framework, while cybersecurity implements this framework operationally in the digital world. It is only through their interaction that comprehensive protection for organizations is created.
4. interaction between information security and cybersecurity
4.1. Complementary perspectives
Information security and cybersecurity are often seen as competing terms. However, they are actually two complementary perspectives. Information security views information as a strategic resource for an organization and derives specifications, priorities and minimum requirements from this. Cybersecurity implements these requirements technically in the digital dimension and protects the systems in which the information is processed.
4.2. From strategy to implementation
Information security defines which information in which processes has which protection requirements. This results in guidelines, standards and catalogs of measures that are binding for the organization. Cybersecurity forms the operational implementation level. It uses firewalls, encryption, monitoring and access controls to ensure that the requirements are actually met.
Example:
Information security defines that the confidentiality of customer data has the highest priority in the “contract management” business process.
Cybersecurity then implements technical measures such as database encryption, access restrictions and logging.
4.3. Different roles in management
Information security is usually anchored in management. It speaks the language of management, compliance and specialist departments. Cybersecurity, on the other hand, is more strongly anchored in the operational IT and security teams and requires in-depth technical expertise to ward off current threats.
This applies:
- Information security provides the strategic framework.
- Cybersecurity ensures operational implementation.
4.4. Managing risk holistically
An organization can only manage its risks effectively if both levels are interlinked. Information security prevents technical measures from being introduced in isolation and without reference to business objectives. Cybersecurity ensures that abstract requirements do not remain theoretical, but are effectively implemented in practice.
This interaction is particularly important in view of the dynamic threat situation, as new methods of attack are constantly emerging while regulatory requirements are becoming stricter at the same time. An effective security concept must therefore be strategically coordinated and operationally flexible.
4.5. Findings
Information security and cybersecurity are not opposites, but two sides of the same coin. Information security defines what needs to be protected and why. Cybersecurity ensures that this actually happens in the digital space. Only in combination does a security approach emerge that takes appropriate account of both the business value of information and the real threat situation.
5. concluding remarks
The development from purely technical cybersecurity to strategic information security clearly shows that security in organizations today is much more than just defending against digital attacks. Information security has established itself as an overarching discipline that focuses on business processes and their protection requirements. It combines organizational, legal, physical, human and technical aspects into a holistic concept that is continuously developed through the PDCA cycle.
Cybersecurity remains indispensable in this context, as it is responsible for the operational defense of digital infrastructures. It is the area of information security that deals with threats in real time, secures systems and implements specific technical measures.
The interaction of both levels is crucial, as information security defines which assets are to be protected and to what degree of priority. Cybersecurity ensures that these requirements are effectively implemented in the digital sphere. It is only through this combination that a security concept is created that both takes into account the business significance of information and can withstand the dynamic threats of the digital age.
This makes it clear that information security and cybersecurity are not synonymous terms, but complementary concepts. Their clear differentiation and coordinated interaction form the basis for modern security strategies that meet both the requirements of company management and the challenges of IT.
