What Is Cyber Security?

Cyber security is the discipline concerned with protecting computer systems, networks, data, and software from unauthorized access, damage, disruption, and theft. It encompasses the technical, procedural, and organizational measures used to ensure the confidentiality, integrity, and availability of digital information and the infrastructure that processes it. The scope extends from individual devices and enterprise networks to critical national infrastructure such as power grids, financial systems, and healthcare facilities.

The field draws on computer science, electrical engineering, mathematics, and policy. Its foundations include cryptography, which provides the mathematical basis for protecting data in transit and at rest; network engineering, which defines how traffic flows and where controls can be placed; and software engineering, which determines how securely applications are designed and maintained. As computing systems have grown more interconnected, the attack surface has expanded proportionally, making cyber security a continuous engineering discipline rather than a one-time configuration problem.

Threats and Attack Categories

Cyber security addresses a wide spectrum of adversarial activity. CISA's threat advisory resources categorize the main threat types as malware (ransomware, trojans, spyware, and worms), social engineering attacks that exploit human trust rather than software vulnerabilities, denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks that overwhelm systems with traffic, and advanced persistent threats (APTs) conducted by nation-state actors or well-resourced criminal organizations pursuing long-term access and data exfiltration.

Vulnerabilities arise from multiple sources: software defects such as buffer overflows and injection flaws, misconfigured systems, weak authentication credentials, and unpatched dependencies. The Common Vulnerabilities and Exposures (CVE) system, maintained by MITRE and used globally, provides a standardized naming scheme for publicly disclosed vulnerabilities, enabling organizations to track which weaknesses affect their software inventory and prioritize remediation.

Defense Frameworks and Controls

Practitioners organize defensive measures around established frameworks that map security controls to recognized threat categories. The NIST Cybersecurity Framework (CSF), released in its 2.0 revision in 2024, organizes controls around six core functions: Govern, Identify, Protect, Detect, Respond, and Recover. The Identify function covers asset inventory and risk assessment; the Protect function addresses access control, data security, and staff awareness training; Detect covers continuous monitoring and anomaly detection; Respond and Recover define the processes for containing incidents and restoring operations.

Technical controls span network segmentation, firewalls, intrusion detection and prevention systems (IDS/IPS), endpoint protection platforms, multi-factor authentication (MFA), and encryption of data at rest and in transit. Defense-in-depth is the guiding architecture principle: no single control is assumed to be impenetrable, so multiple overlapping layers ensure that failure of one does not compromise the whole system.

Incident Response and Recovery

Even well-defended systems face successful intrusions, making incident response a core competency. A structured response plan defines the phases of preparation, detection, containment, eradication, recovery, and post-incident review. Digital forensics techniques are used to reconstruct the timeline of a compromise, identify the entry point and lateral movement paths of an attacker, and collect evidence for legal proceedings where applicable.

Recovery procedures address both technical restoration, rebuilding systems from known-good backups and patching the exploited vulnerabilities, and operational continuity, which may involve activating redundant systems or temporarily suspending affected services. NIST SP 800-61, the Computer Security Incident Handling Guide, provides detailed procedural guidance widely adopted by government and private sector organizations.

Applications

Cyber security practices are applied across virtually all sectors where digital systems operate, including:

• Financial services, protecting transaction systems and customer account data
• Healthcare, securing electronic health records and connected medical devices
• Government and defense, protecting classified networks and national infrastructure
• Critical infrastructure operations in energy, water, and transportation
• Consumer electronics and mobile platforms, safeguarding personal data and privacy