Ask a room of people what comes to mind when they hear “security” and you get locks, passwords, guards, antivirus, hackers. All of these are part of the picture, but none of them is the whole picture. This first section pins down what security means, how information security and cybersecurity differ, and why every organization, not just tech companies, needs someone to manage security deliberately.
What Does Security Cover?
Security is not only a technology problem. It spans three broad areas that work together:
| Area | What it includes |
|---|
| People | Knowledge, awareness, and even emotion (fear, trust, carelessness) |
| Process | Governance frameworks, policy, auditing |
| Technology | Hardware, software, protocols |
A firewall (technology) is useless if staff share passwords (people) and nobody checks the logs (process). This people–process–technology view runs through the whole course.
Defining Security
Security is the state of being free from danger, from fear, or from anxiety (Merriam-Webster).
Notice the definition has two sides: an objective side (actually being free from danger) and a subjective side (feeling free from fear and anxiety). An organization can feel secure while being exposed, or be well protected while staff still feel anxious. Security management cares about both: real protection and justified confidence among customers, staff and regulators.
Safety vs. Security
The two words are often used interchangeably, but they focus on different sources of harm:
| Safety | Security |
|---|
| Source of harm | Accidental / unintentional: failures, hazards, natural events, human error | Deliberate / intentional: someone trying to cause harm |
| Typical question | “What could go wrong by accident?” | “Who might want to cause harm, and how?” |
| Example | A wet hospital floor, a server overheating | A thief stealing a laptop, an attacker encrypting files |
In practice they overlap. A hacked infusion pump is a security event with safety consequences, which is exactly why hospitals like our running example, MediCare Plus, must care about both.
A Variety of “Securities”
“Security” is usually qualified by what is being protected:
- Information security: information in any form
- Cybersecurity: assets reachable through connected networks
- Physical security: buildings, rooms, hardware, people on site
- Computer security: individual computer systems
- Network security: networks and data in transit
- Application security: software and its code
- Cloud security: services and data hosted in the cloud
These overlap heavily; they are lenses, not separate worlds.
Information Security (InfoSec) is the practice of protecting information from unauthorized access, use, disclosure, modification, or destruction. It ensures the confidentiality, integrity, and availability (CIA) of information throughout its lifecycle, whether the information is in physical or digital form.
Two details matter for the exam:
- Physical or digital. A printed patient chart left on a counter is an information security problem, even though no computer is involved.
- Throughout its lifecycle. Information must be protected when it is created, stored, used, shared, archived and finally destroyed.
Cyber and Cybersecurity
Cyber refers to the network connecting devices around the world to link people together and share information, in order to create services and build community.
Cybersecurity is the processes, structures and resources (including tools, people and regulations) that an individual, organization or nation-state uses to protect its cyber-properties from all threats. Cyber-properties include money, personal computers, servers, equipment, data, services, customer loyalty and reputation.
Note that cyber-properties include intangibles like customer loyalty and reputation, not just hardware and data.
| Information Security | Cybersecurity |
|---|
| Protects | Information, in any form (paper, speech, digital) | Anything of value reachable through cyberspace (data, systems, services, money, reputation) |
| Includes paper records? | Yes | No, unless connected to the cyber world |
| Includes non-information assets? | Not directly | Yes (e.g., a network-controlled device, online services, reputation) |
| Core goal | Confidentiality, Integrity, Availability | Protect cyber-properties from all threats |
Common mistake: treating “information security” and “cybersecurity” as identical. A locked filing cabinet of paper records is information security but not cybersecurity; a network-connected medical device that stores no sensitive data is a cybersecurity concern even if it holds little “information.”
Why Every Organization Needs Security Management
Security is ultimately about protecting organizational value:
- Business continuity: keeping operations running
- Trust: of customers, patients, partners
- Compliance: meeting laws and regulations (e.g., Thailand’s PDPA)
- Reputation: brand and public standing
When security fails, the business impact follows the same lines:
- Operational disruption: services stop, staff cannot work
- Financial loss: lost revenue, recovery costs, fines, fraud
- Legal issues: regulatory penalties, lawsuits
- Reputation damage: lost customers and trust, often the longest-lasting impact
In exam answers about “impact,” go beyond the technical (“the server was down”) and name the business consequence: lost revenue, regulatory exposure, damaged trust. That is the managerial view this course is testing.
Worked Examples
Exercise 1
A hospital nurse leaves a printed list of patients’ HIV test results on a public reception counter, where visitors can read it. Is this an information security incident, a cybersecurity incident, both, or neither? Explain.
Show solution ↓Hide solution ↑
Solution
Check each definition in turn.
- Information security protects information “whether the information is in physical or digital form” from unauthorized disclosure. A printed list is physical information, and visitors reading it is unauthorized disclosure. ✓
- Cybersecurity protects cyber-properties reachable through connected networks. A sheet of paper on a counter is not in cyberspace, and no network was involved.
So this is an information security incident (a confidentiality breach), but not a cybersecurity incident.
Exercise 2
Classify each event as primarily a safety concern or a security concern:
(a) A storm floods the server room.
(b) An ex-employee logs in with an old account and deletes files.
(c) A technician accidentally unplugs the database server while cleaning.
(d) A criminal group encrypts a hospital’s files and demands payment.
Show solution ↓Hide solution ↑
Solution
The deciding question is whether the harm is accidental (safety) or deliberate (security).
- (a) A natural event, no intent → safety.
- (b) A person deliberately misusing access → security.
- (c) Human error, no intent → safety.
- (d) A deliberate criminal act → security.
(a) safety, (b) security, (c) safety, (d) security. Note that safety events can still harm availability, so an organization’s continuity planning must cover both.
Exercise 3
A company’s IT director says: “We bought the best firewall and antivirus on the market, so we are secure.” Using the people–process–technology view, explain why this claim is weak.
Show solution ↓Hide solution ↑
Solution
Security covers three areas, and the director has addressed only one.
- Technology: firewall and antivirus. Covered.
- People: are staff aware of phishing? Do they share passwords? A trained attacker can simply trick an employee into handing over credentials, bypassing the firewall entirely.
- Process: is there a policy, are logs audited, is there an incident response plan? Tools that nobody monitors give little protection.
The claim is weak because technology alone cannot stop every attack; without trained people and defined processes (policy, auditing, governance), the tools can be bypassed or go unmonitored.
Exercise 4
According to the course definition, list four examples of cyber-properties an online bank must protect, including at least one intangible.
Show solution ↓Hide solution ↑
Solution
The cybersecurity definition lists cyber-properties as money, personal computers, servers, equipment, data, services, customer loyalty and reputation. For an online bank, four good examples:
- Money: customer balances and funds in transit.
- Data: customer account and transaction records.
- Services: the online banking website and mobile app.
- Reputation / customer loyalty (intangible): customers’ trust that the bank is safe.
Any four from the list are acceptable, as long as at least one is intangible (reputation or customer loyalty).
Exercise 5
A ransomware attack takes a retailer’s online store offline for three days. Name one business impact in each of the four categories: operational, financial, legal, and reputational.
Show solution ↓Hide solution ↑
Solution
Work through each category of business impact.
- Operational disruption: orders cannot be taken or shipped; staff cannot access systems.
- Financial loss: three days of lost sales plus recovery costs (and any ransom considered).
- Legal issues: if customer data was also accessed, the retailer may face regulatory investigation under data protection law and possible lawsuits.
- Reputation damage: customers lose confidence and move to competitors, which may last long after the systems are restored.
Operational: halted orders; Financial: lost sales and recovery cost; Legal: regulatory/legal exposure; Reputational: loss of customer trust.