What Is Computer Security?

Computer security is the practice of protecting computing systems, networks, and the data they store or transmit from unauthorized access, disclosure, modification, disruption, or destruction. The field addresses both the technical mechanisms that enforce protection, such as cryptographic protocols and access control policies, and the organizational practices that govern how systems are administered and monitored. It draws on mathematics, operating systems theory, network engineering, and human factors, because many security failures involve people and procedures as much as they involve software or hardware.

The three foundational properties of computer security are confidentiality, integrity, and availability, collectively known as the CIA triad. Confidentiality ensures that information is accessible only to those with authorization. Integrity ensures that data and system state are not modified in unauthorized ways. Availability ensures that systems and data are accessible to authorized users when needed. These properties underlie the design of every security control, from authentication systems to backup strategies, and appear in formal frameworks such as the NIST Cybersecurity Framework, which provides guidance for organizations assessing and improving their security posture.

Access Control and Authentication

Access control is the set of mechanisms that determine which users or processes may access which resources and under what conditions. Policies are typically expressed as identity-based rules, role-based access control (RBAC), or attribute-based access control (ABAC), each offering different tradeoffs between administrative flexibility and granularity. Authentication establishes the identity of a requesting entity, commonly through passwords, cryptographic certificates, or biometric measurements. Multi-factor authentication combines two or more of these categories, reducing the risk that a single compromised credential grants access. Trust management frameworks formalize the way systems reason about the trustworthiness of remote entities, an important consideration in distributed environments where components may be operated by different parties.

Cryptography and Data Protection

Cryptography provides the mathematical foundation for confidentiality and integrity guarantees in computer security. Symmetric encryption algorithms such as AES, standardized by NIST in FIPS Publication 197, protect data at rest and in transit with a shared key. Asymmetric algorithms such as RSA and elliptic curve schemes enable secure key exchange and digital signatures without a pre-shared secret. Transport Layer Security (TLS) applies these primitives to authenticate servers and encrypt network sessions, protecting against eavesdropping and man-in-the-middle attacks. Privacy-invasive software, including spyware and keyloggers, targets the endpoints where plaintext data exists before encryption, which is why endpoint protection is considered alongside cryptographic controls rather than as a substitute.

System Security and Digital Forensics

Operating system security encompasses the mechanisms that enforce isolation between processes, manage privilege levels, and audit system activity. Access control lists enforced by the OS kernel, mandatory access control policies as implemented in SELinux, and sandboxing environments for untrusted code are all expressions of the principle of least privilege: each process or user should have only the minimum access required for its function. Computer network management security addresses the protection of routers, switches, and network management protocols against unauthorized configuration changes. Digital forensics is the discipline of recovering, preserving, and analyzing evidence from computing systems after a security incident, following procedures that maintain the admissibility of evidence. The IEEE Security and Privacy journal is a primary publication venue for research across system security, forensics, and applied cryptography.

Applications

Computer security has applications in a wide range of fields, including:

• Financial services, protecting banking transactions, payment systems, and customer data
• Critical infrastructure protection, securing power grids, water systems, and industrial control networks
• Healthcare, ensuring confidentiality of patient records and the integrity of medical device software
• Blockchain and distributed ledger systems, applying cryptographic primitives to consensus and transaction integrity
• Product security in consumer devices and embedded systems, addressing vulnerabilities across the hardware/software stack
• Cyberethics and policy, governing the responsible use of security tools and defining norms for state and non-state actors