Cyber security is the practice of protecting computers, networks, applications, cloud services, devices and digital information from theft, damage, unauthorised access and disruption. It combines technical controls, organisational processes and everyday habits.
The easiest way to understand cyber security and its types is to look at what needs protection. A network connects devices, an application performs a task, a cloud service stores or processes information online, and an endpoint is a device such as a laptop or phone. Information security protects the information itself, wherever it is held.
This guide explains the main types of cyber security, how they work, common cyber security examples and the basic measures individuals and organisations can use to stay safer.
What Is Cyber Security?
Cyber security covers the people, processes and technologies used to protect digital systems. Its purpose is not only to stop criminals from stealing data. It also aims to prevent systems from being changed, damaged, locked or made unavailable.
A cyber attack can target email accounts, banking details, business networks, websites, customer databases, cloud storage, personal files, connected machinery and mobile devices.
it works by reducing weaknesses, controlling access, monitoring activity and preparing for incidents. A strong approach may include secure passwords, multi-factor authentication, software updates, encryption, firewalls, backups, staff training and an incident-response plan.
No single tool provides complete protection. Antivirus software may detect some malicious programs, but it cannot prevent every stolen password, insecure cloud setting or accidental disclosure. Effective security therefore uses several layers.
The three main goals of cyber security
Most cyber security controls support three basic goals: confidentiality, integrity and availability.
Confidentiality means preventing unauthorised people from seeing information. Passwords, access permissions and encryption can help protect confidentiality.
Integrity means keeping information accurate and preventing unauthorised changes. An attacker who changes bank details, customer records or software code can cause serious harm even without stealing anything.
Availability means ensuring that authorised users can access systems and information when they need them. Ransomware, technical failure or a denial-of-service attack may make an important service unavailable.
These three goals are often known as the CIA triad. The name has nothing to do with the intelligence agency; it is simply an abbreviation for confidentiality, integrity and availability.
Why Are There Different Types of Cyber Security?
Modern organisations use many connected technologies. A retailer may have a website, payment system, office network, cloud accounts, staff laptops, mobile phones and customer records. Each part has different weaknesses and needs different controls.
The main cyber security types are therefore organised around the asset being protected or the risk being managed. Network security focuses on connections and traffic. Application security protects software. Cloud security protects online platforms and services. Endpoint security protects individual devices.
These categories overlap. A laptop may connect to a business network, use a cloud application and store confidential information, so several security types may apply at once. The categories remain useful because they clarify responsibilities and reveal gaps.
1. Network Security
Network security protects the systems and connections that allow devices to communicate. These networks may be small, such as a home Wi-Fi network, or large, such as the infrastructure used by a bank, university or international company.
A network carries information between computers, servers, printers, cloud services and other devices. If an attacker gains access, they may observe traffic, steal information, spread malicious software or move from one system to another.
How network security works
Network security uses controls that decide who and what can connect, what traffic is permitted and how suspicious activity is handled.
Common network-security controls include:
- Firewalls
- Secure Wi-Fi configuration
- Network segmentation
- Virtual private networks
- Traffic monitoring
- Access-control rules
- Intrusion detection and prevention
- Secure router settings
- Regular software and firmware updates
A firewall examines network traffic and applies rules about what should be allowed or blocked. It remains useful only when its rules are configured and reviewed properly.
Network segmentation divides a network into smaller sections. This can reduce the damage caused by an attack. For example, guest Wi-Fi should normally be separated from systems that hold employee or customer information. If a visitor’s device is infected, it should not provide a direct route into sensitive business systems.
Network security example
Imagine a small accountancy firm with staff computers, a shared printer and a wireless network. The business also provides guest Wi-Fi for visitors.
If both staff and guests use the same unrestricted network, an infected visitor device could create risk for internal systems. A safer setup would use separate networks, strong router credentials, updated equipment and firewall rules that limit unnecessary connections.
This is a simple example of network security: the business is not only protecting individual computers but also controlling how devices communicate.
Common network-security risks
Common risks include weak wireless passwords, outdated routers, exposed remote-access services, incorrect firewall rules and unapproved devices. Internet-facing equipment should be updated and securely configured, while unsupported devices should be replaced.
Beginner network-security checklist
For a home or small-business network:
- Change default router usernames and passwords
- Use modern Wi-Fi security
- Install router and device updates
- Separate guest access where possible
- Disable services that are not needed
- Review connected devices
- Use secure remote-access methods
- Replace unsupported equipment
Network security is the foundation on which many other security controls depend. If the network is poorly protected, strong application or data security may still be undermined.
2. Cloud Security
Cloud security protects information, applications and services that are stored, managed or delivered through cloud platforms.
Common cloud services include online email, file storage, customer-management software, web hosting, video conferencing and online productivity tools. Many people use cloud services every day without thinking of them as “the cloud”.
Cloud computing can improve flexibility and reduce the need to maintain physical servers. However, using a reputable provider does not remove all responsibility from the customer.
The shared-responsibility principle cyber security and its types
Cloud security usually involves shared responsibility between the provider and the customer.
The provider may protect the physical data centres, underlying infrastructure and core service. The customer must still manage user accounts, permissions, passwords, multi-factor authentication, data sharing and configuration.
The exact division depends on the service. With a simple online application, the provider manages more of the technology. With a cloud platform used to build custom systems, the customer may have much greater responsibility.
This distinction matters because a technically secure cloud platform can still be exposed through a stolen administrator password or a folder shared publicly by mistake.
Main cloud-security controls
Important cloud-security measures include:
- Multi-factor authentication
- Strong administrator-account protection
- Role-based access
- Encryption
- Secure configuration
- Activity logging
- Backup and recovery arrangements
- Regular permission reviews
- Control of connected third-party applications
- Removal of unused accounts
Organisations should know where important information is stored, who can access it and whether it can be shared externally.
Cloud security example
A charity stores volunteer records in an online file-sharing platform. One folder is accidentally set so that anyone with the link can view it.
The cloud provider itself has not been hacked. The problem is an incorrect permission setting. The charity should restrict access to approved accounts, review sharing settings and monitor changes.
This example shows why cloud security is not only about the provider. Secure use and configuration are equally important.
Common cloud-security risks
Cloud risks often include excessive permissions, inactive accounts, weak administrator protection, unapproved applications and poorly controlled sharing.
Another risk is assuming that cloud data is automatically backed up in the required way. Businesses should understand what can be recovered, for how long and what happens if an account is locked or compromised.
3. Application Security
Application security protects software from weaknesses that could be used to steal information, bypass controls, damage systems or interrupt services.
Applications include websites, mobile apps, desktop programs, online portals and internal business systems. Security should be considered throughout an application’s life cycle—from planning and development to testing, release, updating and retirement.
Where application weaknesses come from
Applications may become insecure because of poor authentication, programming errors, outdated components, insecure storage, excessive permissions, unsafe defaults or inadequate testing.
Attackers look for weaknesses that allow them to view information, control accounts or perform unauthorised actions. Application security aims to prevent these problems before release and correct them quickly afterwards.
Secure development
Secure development means including security from the beginning rather than adding it at the end.
Developers should consider what information the application will handle, who should access it, what could go wrong and how abuse can be detected. Testing should cover both normal use and attempts to misuse the system.
Useful practices include code review, security testing, dependency management, access control and safe handling of errors. Development, testing and live systems should also be separated where appropriate.
Application security example
An online learning platform allows students to view course records. A flaw in its access control lets one student change a number in the web address and view another student’s information.
The application may be working exactly as programmed, but the security rules are incomplete. The platform must check that each logged-in user is authorised to view the requested record.
This is an application-security issue because the weakness exists in the software’s logic.
Updating applications
Application security continues after release. Developers and system owners need to monitor vulnerabilities and apply updates.
Many applications use third-party components. Organisations should know which versions are running and replace unsupported software because security fixes may no longer be available.
4. Endpoint Security
Endpoint security protects individual devices that connect to a network or service. Endpoints include desktop computers, laptops, smartphones, tablets and some connected devices.
These devices are common targets because they are used directly by people. An attacker may send a malicious attachment, steal a device, trick a user into revealing a password or exploit outdated software.
What endpoint security includes
Endpoint protection may involve:
- Automatic software updates
- Malware protection
- Device encryption
- Screen locks
- Secure configuration
- Control of administrator privileges
- Application restrictions
- Remote locking or wiping
- Device monitoring
- Regular backups
For organisations, central management tools can apply consistent settings across devices.
Endpoint security example
An employee leaves a work laptop on public transport. The laptop contains customer documents and is still signed in to several online accounts.
If the device has a strong screen lock, full-disk encryption and remote-management controls, the organisation has a better chance of protecting the information. It can also revoke active sessions and remotely erase the device if necessary.
Without those controls, physical loss may become a serious data breach.
Personal and unmanaged devices
Remote and hybrid working have increased the use of personal devices for work. This can create uncertainty about updates, backups, software installation and who else can access the device.
Organisations should decide whether personal devices are allowed and what conditions apply. Sensitive information should not be stored on unmanaged devices for convenience, and data should be securely erased before disposal.
5. Information Security
Information security protects information in every form, not only information stored on computers. It can include digital files, paper documents, spoken conversations, photographs and printed records.
Cyber security and information security overlap, but information security is broader. Cyber security focuses mainly on digital systems and cyber threats. Information security focuses on preserving the confidentiality, integrity and availability of information, wherever it exists.
Why information security matters
An organisation can have strong technical controls and still expose information through poor handling.
Examples include:
- Sending an email to the wrong person
- Leaving confidential papers on a desk
- Discussing private details in a public place
- Keeping records longer than necessary
- Using personal email for business documents
- Disposing of paperwork without secure destruction
- Giving employees more access than they need
Information security therefore includes rules about collection, storage, sharing, retention and disposal.
Information classification
Classification helps organisations decide how information should be handled.
A simple system might label information as public, internal or confidential. More sensitive organisations may use additional levels.
The aim is to ensure people know whether information can be shared, how it should be stored and what protection it needs.
Information security example
A clinic prints a patient appointment list and leaves it in an area visible to visitors. No computer has been attacked, but confidential information has still been exposed.
This is an information-security incident. The solution may include secure printing, clear-desk procedures, staff training and better control of paper records.
6. Data Security
Data security is closely related to information security but focuses more specifically on protecting data from unauthorised access, alteration, loss or destruction.
It covers data while it is stored, transferred and used, including databases, email attachments, backups and information shared with suppliers.
Core data-security measures
Key measures include:
- Encryption
- Access controls
- Secure transfer methods
- Reliable backups
- Data minimisation
- Retention limits
- Secure deletion
- Monitoring and audit logs
Data minimisation means collecting and keeping only what is genuinely needed. Retention rules also matter because old records kept “just in case” increase exposure.
Encryption
Encryption changes readable information into a protected form that can only be accessed with the correct key or credential.
It can protect data stored on devices and moving between systems. However, a compromised authorised account may still view decrypted information, so encryption must be combined with access control and monitoring.
7. Identity and Access Management
Identity and access management, often shortened to IAM, controls who can access systems and what they are allowed to do.
Every user should have an individual account. Shared accounts make it difficult to know who performed an action and can allow access to continue after someone leaves.
Authentication and authorisation
Authentication checks identity. A password, security key or biometric check may be used to confirm that the user is genuine.
Authorisation decides what the authenticated user can do. A staff member may be allowed to view customer records but not export or delete them.
Successfully logging in does not mean a person should have access to everything.
Least privilege
The principle of least privilege means giving users only the access needed for their responsibilities.
Administrative access should be limited and should not normally be used for everyday email or browsing.
Access should also be reviewed when an employee changes role, goes on extended leave or leaves the organisation.
Identity-security example
A former contractor’s cloud account remains active after the contract ends. Months later, the password is exposed in an unrelated breach and used to access company files.
Promptly removing unused accounts would have prevented the incident. This example shows that access management is not only about creating accounts; it also includes reviewing and closing them.
8. Mobile Security
Mobile security protects smartphones, tablets and the information accessed through them.
A modern phone may contain email, saved login sessions, payment applications, photographs, messages and access to workplace systems. Losing it can therefore expose much more than the device itself.
Useful controls include screen locks, encryption, automatic updates, app-permission reviews, remote wiping and backups. Users should install apps only from trusted sources and avoid ignoring security warnings.
Avoid accessing sensitive services through unknown public networks unless suitable protection is in place.
9. Internet of Things Security
The Internet of Things, or IoT, refers to connected devices such as cameras, smart speakers, sensors, door-entry systems, printers and building controls.
These devices can improve convenience but may have weaker security than computers. Some use default passwords, receive updates slowly or provide limited information about their activity.
Organisations should change default credentials, apply updates, disable unnecessary features and keep IoT devices separate from sensitive systems where possible.
Before buying a connected device, check how long the manufacturer will provide security updates.
10. Operational Technology Security
Operational technology controls physical equipment and processes. It may be used in factories, energy systems, transport, healthcare and building management.
The main concern is not only data. A successful attack may interrupt production, stop machinery or affect safety.
Operational technology often has a long working life and may be difficult to update. Security may therefore require network separation, strict access control, monitoring and carefully planned maintenance.
11. Security Awareness and Human-Centred Security
Technology cannot prevent every incident because many attacks target human judgement.
Phishing emails, fake invoices, password-reset scams and impersonation calls try to create urgency, fear or trust. The attacker wants the recipient to act before checking the request.
Security awareness helps people recognise warning signs and report concerns quickly. Training should use realistic examples and explain what employees should do, not merely tell them to “be careful”.
A healthy security culture avoids unfair blame. Early reporting gives the organisation time to reset credentials, block transactions or contain an incident.
Common Cyber Security Examples
The different types of cyber security become clearer when viewed through common incidents.
Phishing
A user receives an email claiming that their account will be closed unless they sign in immediately. The link opens a fake login page and captures the password.
Identity security, email filtering, multi-factor authentication and user awareness all help reduce this risk.
Ransomware
Malicious software encrypts files and prevents an organisation from using them. The attackers demand payment and may also threaten to publish stolen information.
Endpoint protection, network segmentation, secure backups, updates and incident response are all relevant.
Cloud account takeover
An attacker obtains a cloud administrator’s password and changes access settings.
Cloud security, identity management, multi-factor authentication and activity monitoring can limit the risk.
Website vulnerability
A weakness in an online shop allows an attacker to access customer records.
Application security, secure development, testing and data security are central to preventing this type of incident.
Lost device
A phone or laptop containing business information is lost.
Endpoint security, encryption, screen locks, remote wiping and account-session controls help protect the data.
Accidental disclosure
An employee emails a confidential spreadsheet to the wrong person.
Information security, data handling procedures, access restrictions and staff training are relevant, even though no malicious hacking occurred.
How the Different Types Work Together
Cyber security types should not be managed as isolated areas.
Consider an employee using a laptop to access a cloud-based customer system:
- Endpoint security protects the laptop
- Network security protects its connection
- Cloud security protects the online service
- Application security protects the software
- Identity management controls the employee’s access
- Data security protects the customer records
- Information security governs how those records are handled
- Awareness training helps the employee recognise scams
A weakness in any one area may affect the whole system. For example, secure software cannot protect data if an attacker signs in with a stolen administrator password. Strong authentication may not help if a user intentionally shares information with an unauthorised person.
This is why organisations use defence in depth: several controls work together so that one failure does not automatically lead to a major incident.
Basic Cyber Security Measures for Beginners
Beginners can improve their protection by focusing on a manageable group of controls.
Use unique passwords
Every important account should have a different password. Reusing passwords allows one breach to affect several services.
A reputable password manager can create and store long, unique passwords.
Enable multi-factor authentication
Multi-factor authentication adds another check beyond the password. It can prevent access even when a password has been stolen.
It is particularly important for email, banking, cloud storage and administrator accounts.
Install updates
Updates correct security weaknesses as well as improving features. Automatic updates should be enabled where practical.
Unsupported devices and applications should be replaced or removed from sensitive systems.
Back up important information
Backups help recover from ransomware, theft, accidental deletion and equipment failure.
At least one backup should be separated from the main device or network. Recovery should be tested occasionally.
Check messages before acting
Be cautious with requests for passwords, payments, codes or urgent action. Verify unusual requests using a known contact method rather than replying directly to the message.
Limit access
Do not give every user administrator rights. Remove unused accounts and review permissions regularly.
Secure devices
Use screen locks, encryption and remote-management features. Do not leave unlocked devices unattended.
Prepare for incidents
Know whom to contact if an account is compromised, a device is lost or suspicious activity appears. Organisations should have written response and recovery procedures.
Frequently Asked Questions
What are the main types of cyber security?
The main types include network security, cloud security, application security, endpoint security, information security, data security and identity and access management. Mobile, IoT and operational technology security are also important in many environments.
Is information security the same as cyber security?
No, although they overlap. Cyber security mainly protects digital systems and networks. Information security protects information in any form, including paper and verbal information.
What is the easiest type of cyber security to learn first?
Beginners often start with account and endpoint security because these apply directly to everyday devices. Passwords, multi-factor authentication, updates, backups and phishing awareness provide a practical foundation.
Is cloud security the provider’s responsibility?
Only partly. The provider protects certain infrastructure, but customers still need to manage accounts, permissions, configuration, information sharing and connected applications.
Is antivirus enough for endpoint security?
No. Antivirus is only one control. Endpoint security also includes updates, secure configuration, encryption, access control, backups and safe handling of devices.
Why is network segmentation useful?
Segmentation separates systems so that an incident in one area does not automatically spread to another. It can keep guest devices, general office systems and sensitive services apart.
Can small businesses use all these security types?
Yes, although they may apply them in simpler ways. A small business can secure its Wi-Fi, protect cloud accounts, update devices, control access, back up information and train staff without building a large specialist team.
Conclusion
Cyber security and its types are easier to understand when each area is linked to the asset it protects. Network security protects connections. Cloud security protects online services. Application security protects software. Endpoint security protects devices. Information and data security protect the material stored, shared and used across those systems.
Other areas, including identity management, mobile security, IoT security and operational technology security, address risks that arise from particular users, devices or environments.
These categories are connected rather than separate. A secure organisation combines them through layered protection, clear responsibilities and regular review. Beginners should start with unique passwords, multi-factor authentication, updates, device protection, backups and scam awareness.
Cyber security develops through consistent habits and sensible controls. Once the basic types are understood, it becomes much easier to recognise risks and choose suitable protection.