What is Information Security?

A Simple definition of Information Security

"the practice of being protected against the unauthorized access, use, inspection, modification, disruption, disclosure of information. Especially electronic data, or the measures taken to achieve this."

The term is shortened and is commonly known as InfoSec. Confidentiality, Integrity and Availability (CIA) are the core factors in information security. These factors should be kept intact when any kind of critical issue arrive within or externally to a secured system. Information Technology (IT) security specialists associate with holding these constrains in a given information system. Though paper based business operations still prevail in the field, emergence of IT into these operations are imminent and is creating a big impact with security towards Confidentiality, Integrity and Availability of information. The role of an IT security professional is a stable job in the current working environment. As of 2013 more than 80 percent of security professionals had no change in employer or employment over a period of a year, and the number of professionals is projected to continuously grow more than 11 percent annually from 2014 to 2019.

Some might think Information Security is the same as Cyber security, but this is not the case. Information security is a form of Cyber security which refers exclusively to the processes designed for data security. Cyber Security is a general form of information security. Information security can be widely described in detail through the various aspects of security. Let us get familiar with the types of InfoSec.

Application Security	Application security is a broad topic that covers software vulnerabilities in web and mobile applications and application programming interfaces (APIs). These vulnerabilities may be found in authentication or authorization of users, integrity of code and configurations, and mature policies and procedures. Application security is an important part of perimeter defense for Information Security.
Cloud Security	Cloud security focuses on building and hosting secure applications in cloud environments and securely consuming third-party cloud applications. “Cloud” simply means that the application is running in a shared environment. Businesses must make sure that there is adequate isolation between different processes in these shared environments.
Cryptography	Encrypting data in transit, data at rest helps ensure data confidentiality and integrity. Digital signatures are commonly used in cryptography technology to validate the authenticity of data. Cryptography and encryption has become increasingly important in current information environments. A good example of the use of cryptography is the Advanced Encryption Standard (AES). The AES is a symmetric key algorithm used to protect classified government information.
Infrastructure Security	Infrastructure security deals with the protection of internal and extranet networks, labs, data centers, servers, desktops, and mobile devices.
Incident Response	Incident response is the function that monitors and investigates potentially malicious behavior in informational environments. In preparation for breaches, IT professionals should have an incident response plan for containing any threat and restoring the network.
Vulnerability Management	Vulnerability management is the process of scanning an environment for weak points and prioritizing remediation based on the risk involved. In many networks, businesses are constantly adding applications, users, infrastructure, and so on. For this reason, it is important to constantly scan the network for potential vulnerabilities. Finding a vulnerability in advance can save your businesses the catastrophic costs of a breach.

Above mentioned types of Information Security helps in maintaining the CIA triad in information systems. Under these types we can specify several measures applied on the systems. These measures can include mantraps, encryption key management, network intrusion detection systems, password policies and regulatory compliance. A security audit may be conducted to evaluate an organization's ability to maintain secure systems against a set of established criteria.