Re: [Smart] When we say 'cyber'...

[Bret Jordan <[e-mail]>]

Olaf, et al.,

I do not discount that there is some vagueness within and across some groups when they use the term Cyber Security or Cyber Defense.  I get it.  But we also know that it is highly used and generally well understood and accepted in the industry. In fact, NIST has produced a very popular and widely deployed framework called the “Cybersecurity Framework” [1].  ENISA also uses this term throughout their policy and strategy documents [2]. The ITU uses it [3] and nearly every Fortune 2000 company uses it.  It seems like not using it here is just swimming up stream. 

What we do know for sure, is that Cyber Security references a concept that is more than just:

1) Data Security 
2) Information Security
3) Physical Security in relation to electronic assets
4) Network Security
5) Server and System Security
6) Host based Security
7) Endpoint Security
8) Protocol Security


Perhaps one of the line items of this research group should be to come up with a great definition of Cyber Security and Cyber Defense that can be accepted by the IETF / IRTF. Or we could just use one of the NIST / ENISA / UK NCSC / ITU etc. definitions.  There is a good blog post (though it could be better) at: http://www.cisoplatform.com/profiles/blogs/understanding-difference-between-cyber-security-information <http://www.cisoplatform.com/profiles/blogs/understanding-difference-between-cyber-security-information> that everyone should read.



[1] https://www.nist.gov/cyberframework <https://www.nist.gov/cyberframework>
[2] https://www.enisa.europa.eu/topics/national-cyber-security-strategies <https://www.enisa.europa.eu/topics/national-cyber-security-strategies>
[3] https://www.itu.int/en/action/cybersecurity/Pages/default.aspx <https://www.itu.int/en/action/cybersecurity/Pages/default.aspx>




Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

> On Oct 19, 2018, at 5:58 AM, Olaf Kolkman <[e-mail]> wrote:
> 
> Hello all,
> 
> I am normally lurking on this list but I would personally stay somewhat at arms length from ‘cyber defence’. There is a delta in understanding between how technologists, policy makers, and diplomates use and understand the term cyber security and in my experience the delta may be bigger for the words cyber defence.
> 
> —Olaf Kolkman
> 
> On 4 Oct 2018, at 17:44, Mark O wrote:
>