{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/cyber-and-information-security","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/cyber-and-information-security/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/cyber-and-information-security/"},"term":{"en":"Cyber and information security","da":"Cyber- og informationssikkerhed"},"aka":{"en":["information security","cybersecurity","infosec"],"da":["informationssikkerhed","cybersikkerhed","IT-sikkerhed"]},"domain":["security"],"cluster":"fundamentals","layer":"governance","status":"current","summary":{"en":"Protecting an organisation's data, systems and ways of working against loss, misuse and interruption.","da":"Beskyttelse af en organisations data, systemer og processer mod tab, misbrug og afbrydelser."},"body":{"formal":{"en":"The discipline of keeping information, and the systems that handle it, confidential, correct and available - whether the information is digital or on paper. It covers technology, processes, people and physical surroundings.","da":"Fagområdet, der sørger for, at information og de systemer, der håndterer den, forbliver fortrolige, korrekte og tilgængelige - uanset om informationen er digital eller på papir. Det omfatter teknik, processer, mennesker og fysiske rammer."},"plain":{"en":"Like looking after a house - you lock the doors, check nothing has been tampered with, and make sure the family can still get in when they need to.","da":"Som at passe på et hus - du låser døren, tjekker, at intet er blevet rodet med, og sørger for, at familien stadig kan komme ind, når de skal."},"inPractice":{"en":"A small Danish accounting firm turns on encryption on its laptops, keeps offline copies of client files and teaches staff to spot fake emails that pretend to come from the tax authorities - all parts of one security effort.","da":"Et lille revisionsfirma krypterer sine bærbare, gemmer kopier af kundefiler uden for netværket og lærer medarbejderne at genkende falske mails, der udgiver sig for at komme fra Skattestyrelsen - alt sammen dele af én samlet sikkerhedsindsats."},"whyItMatters":{"en":"Nearly every business now depends on its data and systems; losing them, even for a day, can halt work, break the law and cost customers' trust.","da":"Næsten alle virksomheder er i dag afhængige af deres data og systemer; mister de dem, blot for en dag, kan det stoppe driften, bryde loven og koste kundernes tillid."}},"deepDive":{"en":"The terms overlap but are defined differently. ISO/IEC 27000 defines information security as the preservation of confidentiality, integrity and availability of information in any form, including paper and speech. The EU Cybersecurity Act, Regulation (EU) 2019/881 Art. 2(1), defines cybersecurity as the activities necessary to protect network and information systems, their users and other persons affected by cyber threats, and NIS2 Art. 6(3) adopts that definition, while Art. 6(2) defines the security of network and information systems as resistance to events that compromise availability, authenticity, integrity or confidentiality. ISO/IEC 27032:2023 treats Internet security as a further subset. The Danish pairing \"cyber- og informationssikkerhed\", used in the national strategies, deliberately covers both, whereas \"IT-sikkerhed\" traditionally means the technical subset.\n\nStructurally the discipline is run as a management system. ISO/IEC 27001:2022 specifies an ISMS on the Plan-Do-Check-Act pattern: context and scope (clause 4), leadership (5), risk assessment and treatment (6.1.2 and 6.1.3), operation (8), performance evaluation through internal audit and management review (9.2, 9.3) and continual improvement (10). The NIST Cybersecurity Framework 2.0 organises outcomes in six functions, Govern, Identify, Protect, Detect, Respond and Recover, and is often used alongside ISO as a maturity and communication tool. NIS2 Art. 21(2) sets a minimum list of measures that cover much of the same ground, from risk analysis and incident handling to supply chain security, cryptography and MFA.\n\nThe work spans four domains that must be coordinated: technical controls (identity, endpoint, network, cloud, application security, cryptography), processes (change, vulnerability and incident management, continuity), people (awareness, vetting, roles, culture) and physical security. Typical roles include a CISO or information security coordinator, system and information owners, IT operations, a SOC, a data protection officer under GDPR Art. 37 to 39 where required, and internal audit. Separating those who operate controls from those who oversee them is itself a control.\n\nCommon misconceptions are that security is an IT project with an end date, that a certificate or a compliance report equals protection, and that it is purely about preventing external attackers, whereas faults, human error, suppliers and insiders cause a large share of incidents. The discipline is also distinct from privacy and data protection, which concern the lawful processing of personal data, even though GDPR Art. 32 requires security of processing, and from safety, which concerns harm to people and the environment, although the two converge in operational technology. Security is steered by risk management, which sets priorities, and by governance, which sets direction and accountability.","da":"Begreberne overlapper, men defineres forskelligt. ISO/IEC 27000 definerer informationssikkerhed som bevarelse af fortrolighed, integritet og tilgængelighed af information i enhver form, herunder papir og tale. EU's forordning om cybersikkerhed (Cybersecurity Act), forordning (EU) 2019/881, art. 2, nr. 1, definerer cybersikkerhed som de aktiviteter, der er nødvendige for at beskytte net- og informationssystemer, deres brugere og andre personer, der påvirkes af cybertrusler, og NIS2 art. 6, nr. 3, overtager den definition, mens art. 6, nr. 2, definerer sikkerhed i net- og informationssystemer som modstandsdygtighed over for hændelser, der kompromitterer tilgængelighed, autenticitet, integritet eller fortrolighed. ISO/IEC 27032:2023 behandler internetsikkerhed som en yderligere delmængde. Den danske sammenstilling \"cyber- og informationssikkerhed\", som bruges i de nationale strategier, dækker bevidst begge, mens \"IT-sikkerhed\" traditionelt betegner den tekniske del.\n\nStrukturelt drives fagområdet som et ledelsessystem. ISO/IEC 27001:2022 specificerer et ISMS efter Plan-Do-Check-Act-mønsteret: kontekst og omfang (afsnit 4), ledelse (5), risikovurdering og risikohåndtering (6.1.2 og 6.1.3), drift (8), evaluering af præstationer via intern audit og ledelsens evaluering (9.2, 9.3) samt løbende forbedring (10). NIST Cybersecurity Framework 2.0 organiserer resultaterne i seks funktioner, Govern, Identify, Protect, Detect, Respond og Recover, og bruges ofte sammen med ISO som værktøj til modenhed og kommunikation. NIS2 art. 21, stk. 2, opstiller en minimumsliste af foranstaltninger, der dækker meget af det samme, fra risikoanalyse og hændelseshåndtering til sikkerhed i forsyningskæden, kryptografi og MFA.\n\nArbejdet spænder over fire domæner, der skal koordineres: tekniske kontroller (identitet, endpoints, netværk, cloud, applikationssikkerhed, kryptografi), processer (ændrings-, sårbarheds- og hændelseshåndtering, beredskab), mennesker (awareness, screening, roller, kultur) og fysisk sikkerhed. Typiske roller er en CISO eller informationssikkerhedskoordinator, system- og informationsejere, IT-driften, et SOC, en databeskyttelsesrådgiver (DPO) efter GDPR art. 37-39, hvor det kræves, og intern revision. At adskille dem, der udfører kontrollerne, fra dem, der fører tilsyn med dem, er i sig selv en kontrol.\n\nUdbredte misforståelser er, at sikkerhed er et IT-projekt med en slutdato, at et certifikat eller en compliancerapport er lig med beskyttelse, og at det udelukkende handler om at holde eksterne angribere ude, selv om fejl, menneskelige fejl, leverandører og insidere står bag en stor del af hændelserne. Fagområdet adskiller sig også fra privatliv og databeskyttelse, som handler om lovlig behandling af personoplysninger, selv om GDPR art. 32 kræver sikkerhed ved behandlingen, og fra safety, som handler om skade på mennesker og miljø, selv om de to smelter sammen i operationel teknologi (OT). Sikkerhedsarbejdet styres af risikostyring, der sætter prioriteterne, og af governance, der sætter retning og placerer ansvaret."},"edges":[{"type":"used-with","to":"security/governance","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/risk-management","why":{"en":"Security work is steered by risk management, which decides where limited effort does the most good.","da":"Sikkerhedsarbejdet styres af risikostyring, som afgør, hvor begrænsede ressourcer gør mest gavn."},"confidence":"high","strength":"primary"}],"depth":0,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"ISO/IEC 27000:2018 - Information security management systems - Overview and vocabulary","tier":"standard","publisher":"ISO/IEC"}],"draft":true}