Skip to content
Knowledge Hub/Article
Article

What Is Cybersecurity? Types, Threats and Core Controls

Cybersecurity protects systems, networks and data from attack. We cover NIST's six functions, today's threats, the core controls and cyber resilience.

Oğuzhan Gerçek··9 min read
What Is Cybersecurity? Types, Threats and Core Controls

Short answer: Cybersecurity is the protection of computers, networks and data against attack, the detection of attacks, and the restoration of systems afterwards. NIST's Cybersecurity Framework (CSF 2.0) organizes this work into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Today's main threats are ransomware, phishing, DDoS, supply chain attacks and the exploitation of unpatched vulnerabilities. The core controls are an asset inventory, multifactor authentication (MFA), regular patching, backups attackers cannot reach, and log monitoring. Cyber resilience, for its part, aims to keep critical operations running even when an attack succeeds.

What is cybersecurity?

The definition in the NIST glossary describes cybersecurity as the prevention of damage to, protection of, and restoration of computers, electronic communications systems and the information they contain, to ensure availability, integrity, authentication, confidentiality and nonrepudiation. The definition in Türkiye's Cybersecurity Law No. 7545 likewise lists, alongside protection, the detection of attacks, the activation of response and alarm mechanisms, and the return to the pre-incident state. You will find a short definition in our glossary.

Information security, by contrast, covers information in any form: in IBM's description, it protects paper documents and physical media as well as digital files, whereas cybersecurity focuses on digital systems and the data in them. The requirements for an information security management system are set out in ISO/IEC 27001:2022; we explain the certification process in our ISO 27001 article.

NIST CSF 2.0 and the six functions of cybersecurity

NIST published version 2.0 of its Cybersecurity Framework (CSF) on February 26, 2024. According to the agency, it is the first major update since the framework was created in 2014, and it now aims at all organizations rather than critical infrastructure alone. The CSF groups cybersecurity outcomes under six functions:

  • Govern: The cybersecurity risk management strategy, expectations and policy are established, communicated and monitored. Added in 2.0, this function informs how the other five are implemented.
  • Identify: The organization's current cybersecurity risks are understood.
  • Protect: Safeguards to manage those risks are used.
  • Detect: Possible attacks and compromises are found and analyzed.
  • Respond: Action is taken on a detected incident.
  • Recover: Affected assets and operations are restored.

According to the CSF, the functions should be addressed concurrently, not one after another. The framework describes outcomes; it does not prescribe how to achieve them.

Types of cybersecurity

Cybersecurity divides into domains according to the layer being protected:

  • Network security: According to IBM, it focuses on preventing unauthorized access to networks and systems. We cover layers such as firewalls, segmentation and zero trust in our network security article.
  • Endpoint security: It protects devices such as laptops, phones and servers; the details are in our endpoint security article.
  • Application security: It aims to find and fix vulnerabilities in software. We cover the layer that sits in front of web applications in our WAF article.
  • Cloud security: In AWS's shared responsibility model, the provider protects the cloud itself, while the security of what is built in the cloud falls to the customer, to an extent that depends on the services chosen.
  • Identity security: It protects digital identities and the systems that manage them. We handle this area in our identity management service.
  • Data security: In the CSF 2.0 definition, it protects the confidentiality, integrity and availability of data in line with the organization's risk strategy.

Common cyber threats

Two primary reports give a current picture: Verizon's 2026 Data Breach Investigations Report (DBIR), which examines more than 22,000 confirmed data breaches, and the ENISA Threat Landscape 2026, which analyzes 8,257 incidents recorded in the EU in 2025.

  • Ransomware: In NIST's definition, an attack in which attackers encrypt an organization's data and demand payment to restore access; they may also demand an additional payment for not disclosing stolen data. In the 2026 DBIR, ransomware appeared in 48% of breaches, and 69% of victims did not pay.
  • Phishing: As NIST describes it, a digital form of social engineering that uses authentic-looking but bogus emails to request information. In the 2026 DBIR, 16% of breaches began with phishing; in ENISA's records, phishing accounted for 77.8% of social engineering techniques.
  • DDoS: According to NIST, a denial-of-service technique that uses numerous hosts to carry out the attack. In ENISA's records, 51.3% of all incidents were low-impact DDoS attacks.
  • Supply chain attack: An adversary exploiting vulnerabilities in the product or service supply network of the intended target. In the 2026 DBIR, breaches with third-party involvement rose by 60% in a year, reaching 48% of all breaches.
  • Vulnerability exploitation: According to the 2026 DBIR, now the most common initial access vector. 31% of breaches began with the exploitation of a vulnerability, while credential abuse fell to 13%.

We cover ransomware recovery in our recovery playbook, and the KVKK (Türkiye's personal data protection law) side of a case that started in the supply chain in our KVKK fine article.

Core controls: where to start

A common starting list is the CIS Controls. Version 8.1, which the Center for Internet Security released in June 2024, consists of 18 controls and 153 safeguards. CIS defines the 56 safeguards in the first implementation group (IG1) as essential cyber hygiene. The priorities are:

  • Inventory: The first two CIS controls cover the inventory of enterprise assets and of software. A server nobody knows about is neither patched nor monitored.
  • MFA: In its ransomware guide, CISA recommends phishing-resistant MFA for all services, particularly email, VPNs and accounts that access critical systems.
  • Patching: According to the 2026 DBIR, only 26% of the critical vulnerabilities in CISA's Known Exploited Vulnerabilities (KEV) catalog were fully remediated in 2025, and the median time to full resolution was 43 days. We explain the process in our patch management article.
  • Backups: CISA recommends keeping offline, encrypted backups of critical data and regularly testing them in a disaster recovery scenario. Backup types are covered in our backup article.
  • Logging and monitoring: We explain how logs are collected in our log article, and who looks at the alerts in our SIEM and SOC article.
  • Testing: A vulnerability scan finds weaknesses; a penetration test shows whether they can be exploited.
  • Awareness: The human element was present in 62% of breaches in the 2026 DBIR, and CIS Control 14 is dedicated to security awareness and skills training.

What is cyber resilience?

Cyber resilience assumes that an attack will succeed one day and asks how critical operations will carry on when it does. NIST's SP 800-160 Vol. 2 Rev. 1, published in December 2021, defines cyber resiliency as the ability of systems that use or are enabled by cyber resources to anticipate, withstand, recover from and adapt to adverse conditions, attacks or compromises. According to the publication, the approach rests on the assumption that the adversary will breach defenses and establish a long-term presence in systems. The four goals are:

  1. Anticipate: Stay prepared for a possible incident. CISA recommends creating, maintaining and regularly exercising an incident response plan.
  2. Withstand: Keep essential functions running while an attack is under way. Segmenting the network makes it harder for an incident to spread.
  3. Recover: Restore functions during and after an incident. A backup that the attacker cannot delete, tested in advance, is a precondition.
  4. Adapt: Reshape functions and the capabilities that support them as threats, technology and operating conditions change.

We explain how business processes withstand disruption in our business continuity article, and how systems are brought back in our disaster recovery article.

Cybersecurity law in Türkiye

According to the Grand National Assembly's records, Cybersecurity Law No. 7545 was adopted on March 12, 2025, and entered into force on its publication in the Official Gazette on March 19, 2025. The law covers public institutions and real and legal persons operating in cyberspace (Article 2). It requires those that provide services or process data through information systems to report the vulnerabilities and cyber incidents they detect to the Cybersecurity Presidency without delay (Article 7). We cover the critical infrastructure sectors and the other obligations in our Cybersecurity Law article; for breach notification readiness when personal data is involved, see our 72-hour article. We handle detection and response in our security operations service.

Frequently asked questions

What does cybersecurity mean? It means protecting computers, networks and data against attack, detecting attacks, and restoring systems afterwards.

What is the difference between cybersecurity and information security? Information security protects information in every form, including paper documents. Cybersecurity focuses on digital systems and the data in them.

What are the types of cybersecurity? The main domains are network, endpoint, application, cloud, identity and data security.

What are the most common cyberattacks? Ransomware, phishing, DDoS, supply chain attacks and the exploitation of unpatched vulnerabilities. According to the Verizon DBIR 2026, vulnerability exploitation is the most common initial access vector in data breaches.

What is cyber resilience? The ability of systems to anticipate, withstand, recover from and adapt to attacks. The concept assumes that an attack will succeed one day.

Sources