Cybersecurity

Cybersecurity
Protection of information systems, networks, software and connected technologies
Field	Information security, computer security and security engineering
Principal objectives	Confidentiality, integrity and availability
Related objectives	Authenticity, accountability, reliability and resilience
Major areas	Network security, application security, endpoint security, identity and access management, operational technology security
Common controls	Authentication, access control, cryptography, secure configuration, monitoring and incident response
Risk management	NIST Cybersecurity Framework 2.0
Relevant standards	ISO/IEC 27001:2022, ISO/IEC 27002:2022, ISA/IEC 62443
Physical systems	Robotics, Industrial Automation, Operational Technology, Physical AI
Related concepts	Machine Identity, Zero Trust Security, Public Key Infrastructure

Cybersecurity is the protection of digital systems, networks, software, data and connected technologies against threats that may compromise their confidentiality, integrity, availability or other required security properties. It encompasses the technical safeguards, organizational processes and risk-management activities used to prevent, detect, respond to and recover from cybersecurity incidents. Cybersecurity applies to information technology, communication networks and systems that monitor or control physical processes.

Cybersecurity is not limited to preventing unauthorized access. Security failures can also involve alteration of information, disruption of services, compromise of software, misuse of legitimate access or interference with the functioning of connected equipment. The relevant protections depend on the assets involved, the threats they face and the consequences of an incident.

In robotics, industrial automation and physical AI, cybersecurity can be particularly consequential because digital communications and software may influence physical equipment. A compromised control system may affect the availability, integrity or operation of machinery. Security engineering in these environments must therefore consider operational reliability, performance and safety alongside conventional information-security requirements.

Scope and relationship to information security

Information security is concerned with protecting information and information systems from unauthorized access, disclosure, modification, disruption or destruction.

Computer security commonly focuses on protecting computing systems and their resources.

Network security addresses security concerns associated with network infrastructure, communication and connected services.

Cybersecurity is frequently used as a broad term encompassing these subjects and the risks associated with interconnected digital technologies.

The boundaries between these expressions vary across standards, professional practice and organizational contexts. They should not be treated as mutually exclusive disciplines.

Security may address technical failures as well as deliberate attacks. Organizations must consider the protection of their systems in the context of business requirements, legal obligations, physical environments and the possible consequences of interruption.

Fundamental security objectives

Confidentiality

Confidentiality concerns preventing information from being disclosed to unauthorized individuals, systems or processes.

Examples include restricting access to confidential records, protecting credentials and encrypting sensitive communications.

Confidentiality controls may include access restrictions, appropriate encryption and the management of cryptographic keys.

A system can maintain confidentiality in one part of its operation while still being vulnerable to other forms of compromise.

Integrity

Integrity concerns protecting information and systems against unauthorized or improper alteration.

Integrity protection is relevant to stored records, transmitted information, software, system configurations and commands.

Cryptographic hashes, message authentication codes and digital signatures can support particular integrity-related functions, but their use must be appropriate to the application and threat model.

For connected machinery, the integrity of software instructions, operational configurations and control commands may have implications beyond the accuracy of digital records.

Availability

Availability concerns ensuring that authorized users and systems can access required information or services when needed.

Availability can be affected by hardware faults, software errors, network disruption, malicious activity or loss of supporting infrastructure.

Organizations may use redundancy, recovery procedures, monitoring and appropriate system design to reduce availability risks.

The required level of availability depends on the function performed by the system.

Additional security properties

Cybersecurity also considers properties such as:

• Authenticity — confidence that an entity, message or item is what it claims to be.
• Accountability — the ability to associate relevant activities with responsible entities.
• Reliability — the ability of a system to perform required functions under specified conditions.
• Resilience — the ability to withstand, respond to and recover from adverse conditions.

These properties are related but should not be treated as interchangeable. For example, identifying the source of a command does not establish that the command is authorized or safe.

Threats, vulnerabilities and risk

Threats

A cybersecurity threat is a circumstance, event or actor with the potential to cause adverse consequences for information systems or related assets.

Threats may involve deliberate malicious activity, human error, equipment failures or other events relevant to system security.

The likely threats to a system depend on its purpose, exposure, architecture and operating environment.

Vulnerabilities

A vulnerability is a weakness that may be exploited or triggered in a manner that creates adverse consequences.

Vulnerabilities can arise from defects in software, insecure configurations, inadequate controls, design limitations or operational practices.

Not every vulnerability results in a successful attack, and the existence of a vulnerability does not independently establish the likelihood or consequences of exploitation.

Cybersecurity risk

Cybersecurity risk concerns the possibility of adverse consequences arising from threats affecting systems or information.

Risk assessment considers relevant threats, vulnerabilities, the likelihood of adverse events and their potential impact.

NIST SP 800-30 Revision 1 provides guidance on conducting risk assessments within a broader risk-management process.

Risk is not eliminated merely by installing security products. Organizations must select controls, evaluate their effectiveness and address risks that remain after safeguards are implemented.

Threat modeling

Threat modeling involves examining a system to identify assets, trust boundaries, possible threats and relevant security requirements.

A threat model can support the design and evaluation of protective measures.

Threat modeling does not predict every possible future attack. Its usefulness depends on the accuracy of the system description, the threats considered and the maintenance of the model as the system changes.

Common cybersecurity threats

Malware

Malware is software or code designed to perform unauthorized or harmful functions.

Malicious software may be used to steal information, disrupt operations, obtain unauthorized access or interfere with other software.

Its behavior varies by the particular malware and the conditions under which it operates.

Ransomware

Ransomware is commonly associated with malicious activity that restricts access to data or systems and attempts to extort payment.

Some incidents also involve data theft and threats to disclose stolen information.

Ransomware risk management includes prevention, preparation, detection, response and recovery activities. NIST publishes specific guidance on applying cybersecurity risk-management practices to ransomware.

Phishing and social engineering

Phishing involves deceptive communications intended to induce recipients to disclose information, open harmful material or take other actions that benefit an attacker.

Social engineering is a broader term for influencing people to perform actions that undermine security.

Technical safeguards, user awareness and appropriate authentication procedures can contribute to reducing these risks.

Credential compromise

Credentials such as passwords, API tokens and private keys may be stolen, exposed or misused.

A compromised credential can allow an attacker to appear as an authorized user, application or device within the scope of that credential's permissions.

Protecting credentials, limiting their authority and responding to suspected compromise are important security activities.

Denial of service

Denial-of-service attacks attempt to interfere with the availability of a service or resource.

Distributed denial-of-service attacks can involve traffic or requests originating from multiple systems.

The appropriate defenses depend on the service, network architecture and characteristics of the disruption.

Software and configuration weaknesses

Security incidents may involve exploitation of software defects, unsupported components, insecure default settings or improperly configured services.

Reducing these risks requires attention to software development, deployment, maintenance and vulnerability management.

Supply-chain compromise

Software, hardware and services may depend on products and components supplied by external organizations.

Security weaknesses or compromises affecting suppliers, development environments or update mechanisms can introduce risks into systems that use their products.

Supply-chain cybersecurity therefore concerns both the security of supplied technology and the processes used to acquire, maintain and integrate it.

Security architecture and technical controls

Cybersecurity protections are commonly implemented through a combination of organizational policies, technical controls and operational procedures.

Identity and access management

Identity and access management concerns the identification of entities and the control of their access to resources.

Relevant functions include enrollment, authentication, authorization, access review and credential management.

Human users, applications, devices and services may require different identity-management mechanisms.

Authentication

Authentication verifies a claim about an entity's identity through appropriate evidence.

Authentication methods may involve passwords, cryptographic keys, certificates, security tokens or other authenticators.

A successful authentication exchange does not automatically establish that every action requested by the authenticated entity is permitted.

Authorization and least privilege

Authorization determines which operations an entity is permitted to perform.

The principle of least privilege involves limiting access and permissions to those required for assigned functions.

This principle can reduce the consequences of account compromise or misuse, although its effectiveness depends on accurate permissions and enforcement.

Multi-factor authentication

Multi-factor authentication uses authenticators from more than one recognized factor category.

It can provide additional protection against certain credential-compromise scenarios, depending on the methods implemented.

It should not be assumed to prevent every form of account takeover or misuse.

Cryptography

Cryptography provides mathematical techniques used in information security.

Cryptographic mechanisms can support confidentiality, integrity, authentication and other security functions.

Their effectiveness depends on suitable algorithms, correct implementation, secure protocols and appropriate key management.

Public-key infrastructure

Public-key infrastructure (PKI) supports the issuance, management and validation of digital certificates.

X.509 certificates can associate public keys with identities or other attributes under defined trust relationships.

RFC 5280 specifies certificate and certificate revocation list profiles used in Internet X.509 public-key infrastructure.

A valid certificate does not itself confer authorization to perform any particular operation.

Secure communications

Communication security can involve authentication, encryption and integrity protection.

Transport Layer Security (TLS) is an important protocol for securing communications between network endpoints.

RFC 9846, published in July 2026, specifies TLS 1.3 and replaces the earlier RFC 8446 specification. It addresses authenticated secure communication channels and provides confidentiality and integrity protections according to the protocol's security properties.

TLS configuration and certificate validation are important parts of implementation. Encryption alone does not establish that a communicating entity has permission to control a system.

Network segmentation

Network segmentation separates systems or network areas according to operational and security requirements.

Segmentation can help restrict communication paths and reduce unnecessary exposure between systems.

Its effectiveness depends on the resulting architecture, traffic restrictions and enforcement mechanisms.

System hardening

System hardening involves reducing unnecessary functionality and applying secure configuration practices.

Depending on the system, this may include managing accounts, limiting exposed services, configuring operating-system protections and maintaining supported software.

The appropriate measures depend on the system's required functionality and operating conditions.

Monitoring and logging

Security monitoring uses available data to identify events that may indicate misuse, faults or compromise.

Logs can support incident investigation, operational troubleshooting and accountability.

Monitoring arrangements must consider the reliability of collected information, retention requirements and the operational consequences of the monitoring technology.

Cybersecurity risk management

Cybersecurity is an ongoing risk-management activity rather than a condition that can be guaranteed permanently.

Risk management involves identifying relevant assets and exposures, selecting protective measures, assessing their effectiveness and adapting to changes in systems and threats.

NIST Cybersecurity Framework

The National Institute of Standards and Technology published version 2.0 of its Cybersecurity Framework on February 26, 2024.

The framework is designed to help organizations understand, assess, prioritize and communicate cybersecurity risks. It is voluntary and can be used by organizations with different levels of cybersecurity experience.

The Cybersecurity Framework 2.0 organizes its Core around six functions:

Function	General purpose
Govern	Establish, communicate and monitor cybersecurity risk-management strategy, policy and responsibilities
Identify	Understand assets, systems, dependencies and cybersecurity risks
Protect	Use safeguards to manage identified cybersecurity risks
Detect	Identify and analyze possible cybersecurity attacks or compromises
Respond	Take action concerning detected cybersecurity incidents
Recover	Restore affected assets and operations following incidents

These functions represent related areas of cybersecurity risk management, not a mandatory sequence that every organization must perform in the same order.

Risk-based control selection

Not all systems face the same threats or require identical safeguards.

Control selection should account for the value and role of assets, relevant threats, system exposure, operating requirements and the possible consequences of compromise.

NIST SP 800-30 provides guidance on assessing such risks.

Cybersecurity performance goals

The United States Cybersecurity and Infrastructure Security Agency (CISA) publishes voluntary Cross-Sector Cybersecurity Performance Goals.

These goals identify prioritized practices intended to help critical infrastructure organizations reduce common cybersecurity risks.

They provide a baseline for practical security improvements rather than a guarantee that an organization will be free from incidents.

Secure software development

Software security is relevant throughout the development and maintenance lifecycle.

Security activities may include defining requirements, reviewing system designs, managing dependencies, testing components, addressing vulnerabilities and protecting development and release processes.

NIST SP 800-218 specifies Secure Software Development Framework (SSDF) Version 1.1, a set of recommended practices intended to reduce software vulnerabilities and their consequences.

The SSDF can be incorporated into different software development methodologies. It does not prescribe a single development tool or guarantee that a product contains no vulnerabilities.

Security considerations must also extend beyond initial release to maintenance, software updates, vulnerability reporting and response.

Detection and incident response

A cybersecurity incident is an event or set of events that compromises, or has the potential to compromise, information or system security.

Incident response includes activities required to investigate and manage such incidents and their consequences.

NIST SP 800-61 Revision 3, published in April 2025, presents incident response recommendations within the Cybersecurity Framework 2.0 risk-management model. It supersedes the earlier Revision 2 incident-handling guide.

Preparation

Preparation includes defining responsibilities, maintaining relevant information about systems, establishing communication arrangements and ensuring that appropriate response capabilities are available.

Detection and analysis

Potential incidents may be identified through monitoring, alerts, operational reports and investigation of unusual system behavior.

Analysis seeks to establish the nature, scope and significance of an event using available evidence.

Response and containment

Response actions are intended to manage the incident and limit its consequences.

Actions depend on the environment. Measures appropriate for a conventional information system may not be suitable for a continuously operating industrial system without considering potential safety and operational effects.

Recovery

Recovery concerns restoring affected functions and information to an acceptable operational condition.

Recovery planning can include backups, system restoration, validation of recovered equipment and consideration of the underlying cause of an incident.

Continuous improvement

Incident findings can inform improvements to system design, monitoring, response procedures and organizational risk management.

NIST SP 800-61 Revision 3 emphasizes integrating incident response throughout ongoing cybersecurity risk-management activities rather than treating response as an isolated process.

Threat intelligence and security assessment

Threat intelligence concerns information used to understand relevant adversaries, techniques, vulnerabilities and other conditions affecting security.

One recognized resource is the MITRE ATT&CK knowledge base.

ATT&CK organizes observed adversary behavior into tactics, techniques, sub-techniques and procedures. It provides a common terminology for studying threats and supporting security analysis.

Threat intelligence does not replace system-specific risk assessment. A documented attack technique is not necessarily applicable to every technology or deployment.

Security evaluation may also include configuration review, vulnerability assessment, authorized penetration testing, control testing and examination of incident-response arrangements.

The selected assessment methods should match the system's scope and operational requirements.

Zero trust architecture

Zero trust is an approach to security architecture that does not grant implicit trust solely because an entity is located within a particular network or administrative boundary.

NIST SP 800-207 describes zero trust principles and reference architectures focused on protecting resources through appropriate authentication, authorization and access-control decisions.

Zero trust does not mean that an organization can dispense with networking safeguards, monitoring or operational security processes.

In cloud-native environments, NIST SP 800-207A discusses application and service identities as important components of zero trust access control.

Operational technology and cyber-physical security

Operational technology (OT) encompasses programmable systems and devices that interact with physical environments or manage equipment that interacts with them.

Examples include industrial control systems, building automation systems, transportation systems and equipment used for physical monitoring and control.

NIST SP 800-82 Revision 3 addresses the cybersecurity of OT systems while recognizing their performance, reliability and safety requirements.

Information technology and operational technology

Information technology (IT) and operational technology share many security concerns but may have different operational priorities.

Conventional IT systems often emphasize protecting information and supporting business services.

OT systems may also require predictable equipment behavior, timely control, continuous physical operation and coordination with safety procedures.

The differences do not imply that confidentiality is irrelevant to OT or that availability is unimportant in IT. Security priorities depend on the system and its function.

Industrial control systems

Industrial control systems (ICS) include technologies used to monitor and control industrial processes.

Their components can include programmable controllers, operator interfaces, supervisory systems, sensors, actuators and supporting communications infrastructure.

Cybersecurity assessment must consider both individual components and the complete operational environment.

Security and safety

Cybersecurity addresses threats and vulnerabilities affecting digital systems and their functions.

Safety engineering addresses hazards and unacceptable harm that may arise during operation.

The disciplines overlap when cybersecurity incidents can contribute to hazardous physical conditions, but they do not have identical objectives or methods.

A secure communication channel does not prove that a machine's movement is safe. Conversely, a safety mechanism does not necessarily prevent unauthorized access to connected equipment.

Network and operational constraints

Security measures in OT environments must account for constraints such as equipment compatibility, timing requirements, maintenance windows and operational continuity.

For example, changes to network architecture, software or monitoring may require evaluation before deployment in safety-sensitive operational environments.

NIST's OT guidance addresses security safeguards in the context of these operational requirements.

Cybersecurity in robotics

Robotic systems can contain controllers, embedded computers, sensors, actuators, networks and software services.

Depending on the system architecture, cybersecurity weaknesses may affect access to robotic functions, the integrity of software or commands, communication with external systems or the availability of equipment.

NIST IR 8227 documents the application and performance evaluation of cybersecurity technologies in a robotic manufacturing workcell. The report illustrates the importance of evaluating cybersecurity controls within an actual integrated operational system.

Robot controllers

Controllers interpret instructions and produce commands associated with robot operation.

Depending on their connectivity and functionality, controller security may involve access restrictions, authentication, software integrity, configuration management and monitoring.

The appropriate safeguards depend on the controller's role and operating environment.

Connected robot fleets

Robot fleets may use networks and management systems for assigning tasks, receiving status information and maintaining software.

Cybersecurity concerns can include protecting management interfaces, limiting access, controlling updates and identifying the systems participating in communications.

Different fleet architectures require different security arrangements.

Remote access and software maintenance

Remote maintenance can be useful for administering connected equipment but may introduce additional access paths.

Secure maintenance practices can involve access authorization, protected communications, controlled changes and records of relevant actions.

Software updates must be evaluated for both security and operational compatibility.

Machine identity and robot authentication

Machine identity concerns identifiers, credentials and related trust arrangements associated with non-human computing entities.

A robotic system may use cryptographic credentials to authenticate a controller, device or service.

Authentication verifies identity-related claims, while authorization determines what operations are permitted.

An authenticated machine may still contain compromised software, have incorrect configuration or execute an unsafe command. Identity assurance is therefore not equivalent to complete system trustworthiness.

Industrial cybersecurity standards

The ISA/IEC 62443 series addresses cybersecurity for industrial automation and control systems.

Its publications cover concepts, security programs, risk assessment, system requirements, development processes and component requirements.

The series recognizes responsibilities across asset owners, product suppliers, service providers and system integrators.

The standards apply to defined industrial automation and control contexts. Their requirements should not be represented as a single universal cybersecurity certification for every device or AI system.

Cybersecurity and artificial intelligence

Artificial intelligence can be involved in cybersecurity in more than one way.

AI methods may support selected monitoring, analysis or detection tasks. At the same time, AI-enabled applications introduce software, data, model and operational security concerns that require assessment.

The presence of an AI component does not remove conventional requirements for access control, secure development, infrastructure security or incident response.

For AI systems, the NIST Artificial Intelligence Risk Management Framework provides voluntary guidance concerning the governance, assessment and management of AI-related risks.

AI risk management and cybersecurity risk management are related but have different scopes. An evaluation of model accuracy alone is not a cybersecurity assessment, and implementing cybersecurity controls does not establish that an AI model will behave correctly in all circumstances.

Major standards and frameworks

The following publications address different aspects of cybersecurity and should be applied according to their stated scope.

Publication	Subject	Application
NIST Cybersecurity Framework 2.0	Cybersecurity risk management	Organizational governance and management of cybersecurity risks
ISO/IEC 27001:2022	Information security management systems	Requirements for an information security management system
ISO/IEC 27002:2022	Information security controls	Guidance on selecting and applying information security controls
ISA/IEC 62443	Industrial automation and control systems	Security requirements and practices for industrial control environments
NIST SP 800-82 Revision 3	Operational technology security	Securing systems that monitor or control physical processes
NIST SP 800-61 Revision 3	Incident response	Integration of incident response into cybersecurity risk management
NIST SP 800-218	Secure software development	Practices for reducing software vulnerabilities
NIST SP 800-207	Zero trust architecture	Identity-based and policy-based access architecture
RFC 5280	X.509 public-key infrastructure	Certificate profiles and path validation
RFC 9846	Transport Layer Security 1.3	Protection of communications between network endpoints

ISO/IEC 27001 provides management-system requirements, while ISO/IEC 27002 supplies guidance on information security controls. ISO/IEC 27002 is not itself a standard against which an organization receives ISO/IEC 27002 certification.

Compliance with a standard or possession of a certificate does not establish immunity from cyberattacks. Security assurance must be interpreted in relation to the scope, assessment criteria and operating conditions involved.

Research and continuing challenges

Cybersecurity research and practice address changing technology, evolving threats and the difficulty of maintaining appropriate safeguards in complex environments.

Important areas include:

• Software vulnerability management: Finding and addressing weaknesses in software and supporting components.
• Identity security: Managing credentials and access for users, devices, applications and workloads.
• Supply-chain security: Understanding dependencies and risks associated with external products and services.
• Security assessment: Evaluating whether controls provide the required protections.
• Operational resilience: Preparing for interruptions and restoring essential functions after incidents.
• Connected physical systems: Managing digital security where software and networks influence machinery.
• AI-enabled systems: Evaluating additional security risks associated with AI components and their deployment contexts.

Cybersecurity methods must be evaluated against the particular risks they are intended to manage. No single control, framework or technology eliminates every security threat.

Selected academic books

The following publications provide technical foundations in computer security and security engineering.

• Anderson, Ross (2020). Security Engineering: A Guide to Building Dependable Distributed Systems. 3rd edition. Wiley. ISBN 978-1-119-64278-7. Covers security engineering, system design, protocols, operational risks and attacks.
• Stallings, William, and Lawrie Brown (2024). Computer Security: Principles and Practice. 5th edition. Pearson. ISBN 978-0-13-809171-2. Covers computer security principles, access control, cryptography, software and network security.

These books provide broad technical background. Application-specific requirements should also be checked against the relevant standards and authoritative publications.

Further reading

• The NIST Cybersecurity Framework 2.0 — NIST.
• Guide for Conducting Risk Assessments — NIST.
• Incident Response Recommendations and Considerations for Cybersecurity Risk Management — NIST.
• Guide to Operational Technology Security — NIST.
• Secure Software Development Framework — NIST.
• Cross-Sector Cybersecurity Performance Goals — CISA.
• MITRE ATT&CK — MITRE.
• ISA/IEC 62443 Series of Standards — International Society of Automation.

See also

• Information Security
• Network Security
• Cryptography
• Digital Identity
• Machine Identity
• Public Key Infrastructure
• Robot Authentication
• Robot Cybersecurity
• Zero Trust Security
• Operational Technology
• Industrial Automation
• Robotics
• Physical AI
• Autonomous Systems
• AI Security
• AI Safety
• AI Governance