What Are the 7 Types of Cyber Security? A UK Business Guide

What are the 7 types of cyber security?

A useful seven-part view covers network security, endpoint security, application security, cloud security, information security, identity and access management, and operational security. Together, these areas help explain how a business protects its connections, devices, software, hosted services, information, accounts and everyday working practices.

This is a practical classification for this guide, not an official universal standard. Some lists give mobile, IoT or critical infrastructure their own category. Others group controls by the threats they address. The boundaries vary because a single incident can involve several systems and different kinds of protection.

The NIST Cybersecurity Framework offers a broader way to manage cyber risk. A framework and a seven-type explainer serve different purposes: one supports an organised risk programme, while the other helps a business understand the areas it needs to discuss.

1. What is network security, and what does it protect?

Network security controls how systems communicate and which connections are allowed. It covers office networks, remote access, wireless networks and the connections between locations or environments. The aim is to permit necessary work while reducing unnecessary access and limiting how far an intruder can move.

Useful controls include well-managed firewalls, separation between different kinds of devices and secure administration. A guest Wi-Fi network should not automatically provide a route to finance systems. A connected printer or meeting-room device should not receive more access merely because it is inside the building.

Our IT infrastructure management services are relevant to maintaining that picture. Ask for an up-to-date network map, clear ownership and a record of important rules. A firewall that nobody reviews can accumulate exceptions long after their original business purpose has disappeared.

2. What is endpoint security, and why is antivirus not the whole answer?

Endpoint security protects laptops, desktops, servers and other devices used to access business systems. It includes supported software, timely updates, suitable configuration, encryption, malware protection and a way to investigate suspicious behaviour. The device matters because a legitimate account can still be exposed through an insecure machine.

Antivirus is one control within that wider picture. Detection and response capabilities can help teams investigate activity and contain an affected endpoint, but they require ownership and a response process. Installing a product does not establish who will act on an alert at an inconvenient time.

Managed EDR services address endpoint detection and response. Ask what devices are covered, how alerts are triaged and which actions responders can take. Include remote workers and approved personal-device arrangements in the conversation so that coverage does not end at the office door.

3. What is application security?

Application security protects the software a business builds, buys and configures. It includes secure development, dependency management, access checks, testing and maintenance. A customer portal, an internal line-of-business application and a WordPress site have different risks, but each needs someone responsible for its security over time.

For software you commission, ask how the supplier tests access boundaries and handles updates. Check that sensitive actions are authorised by the application rather than only hidden in the interface. A user should not gain access to somebody else's record by changing a reference in a request.

For purchased software, maintain an inventory and track support status and security notices. A cyber security audit can help identify overlooked systems and weak controls. The output should lead to prioritised actions, not simply a long list of technical findings with no owner.

4. What is cloud security, and who is responsible for it?

Cloud security concerns the configuration, access, monitoring and resilience of services hosted outside the traditional office environment. Examples include Microsoft 365, business SaaS platforms and cloud infrastructure. The provider's responsibilities and the customer's responsibilities depend on the service, so neither side should be assumed to cover everything.

A hosted platform can have strong infrastructure while a customer account has excessive privileges or an unsafe sharing setting. Conversely, a well-configured tenant still depends on the provider maintaining its service. Review both the supplier relationship and the controls the organisation can manage.

Our managed cloud services can support those operational responsibilities. Ask about configuration review, logging, integration access and recovery. Cloud security is not a one-time migration task; permissions, applications and business requirements change after the service goes live.

5. What is information security, and how is it different from protecting devices?

Information security focuses on the information itself: who can use it, whether it remains accurate and whether it is available when needed. Information may live in a database, a shared folder, a mailbox, an exported spreadsheet or a printed document. Protecting the laptop alone does not control every copy.

Start by identifying the information the business cannot operate without and the information whose disclosure would cause harm. Give it an owner, define appropriate access and decide how long it should be retained. Consider backups, sharing controls, encryption and practical rules for transferring sensitive material.

For organisations using Microsoft tools, Microsoft 365 support should connect information handling with permissions and configuration. An external sharing link may be technically valid but inappropriate for the document involved. The decision needs business context as well as a software setting.

6. What is identity and access management?

Identity and access management determines who or what can enter a system and what they can do afterwards. It includes staff accounts, administrator accounts, guests and application identities. Authentication establishes an identity; authorisation determines its permitted access. Both need attention.

Use multi-factor authentication where supported, restrict administrator access and remove unnecessary permissions. Review joiners, movers and leavers so that access reflects a person's current role. Changing department should trigger a review, not simply add a second collection of privileges to the first.

Application identities deserve the same ownership discipline. A background integration may use a certificate or secret rather than an employee's sign-in prompt. Record its purpose and effective permissions, and know how to stop it. User MFA does not replace controls over every non-human identity in the environment.

7. What is operational security, and how does it keep controls working?

Operational security is the way the organisation manages sensitive activities and information in everyday work. In this guide, it includes procedures, change control, incident preparation, supplier coordination and the habits that keep technical controls effective. It connects the security plan with what employees actually do.

Consider a request to change a supplier's bank details. A secure mailbox does not remove the need for a verification process. Or consider a security alert: the monitoring product is only part of the answer if nobody knows who can isolate a device or contact the customer.

Managed IT support can connect routine maintenance with incident escalation, but the business still needs clear decision-makers. Test procedures through realistic exercises, keep contact details current and ensure there is cover when the usual owner is unavailable.

How do the seven types work together during a real incident?

Imagine a hypothetical employee receiving a fraudulent invoice email. Identity controls may reduce account takeover risk. Endpoint controls may detect a malicious attachment. Network controls may restrict a connection. Information controls may limit what the employee can access, while an operational verification step can prevent a fraudulent payment.

If one control fails, another can still reduce the impact. That is the purpose of layered protection. It does not mean that every product must duplicate every other product. It means the business understands which risks are covered and where it is relying on a single decision or system.

After an exercise or incident, review the whole sequence. Ask how the message arrived, what access was available, which signal was noticed and how the response worked. Fixing only the last visible failure may leave the underlying route open.

Where do email, mobile, IoT and AI security fit?

Email security spans several categories: the hosted service, account access, filtering, information handling and staff procedures. Mobile security overlaps with endpoint management and identity. IoT security often combines network separation, device configuration and supplier maintenance. These are important subjects even though they do not appear as separate headings in this particular list.

AI security also crosses boundaries. An assistant may read business information, use an application identity and take an action through an integration. It therefore needs data controls, application safeguards, identity management and an operational owner. Creating an eighth heading does not remove those dependencies.

The useful question is not which label wins. It is whether the relevant asset, access route, failure mode and response owner have been considered. Use categories to improve the discussion, then follow the actual workflow to find gaps.

Which cyber security controls should a small UK business prioritise?

Start with the systems that support trading and the accounts that can cause the greatest harm if misused. Check supported software, updates, device protection, account security and backups. Then examine supplier access, sharing and the ability to detect and respond. Priorities should reflect your environment rather than a generic shopping list.

The NCSC small organisations guide provides accessible guidance on accounts, devices, backups, email and spotting attacks. It is a useful starting point for discussing practical improvements without assuming the business has a dedicated security team.

Cyber Essentials support can help establish a baseline around core technical controls. Treat certification as part of ongoing management, not as a guarantee against an incident. Continue checking the controls and addressing risks outside the certification's scope.

How can you assess gaps without buying seven separate services?

Create one inventory of important systems, information and suppliers. For each, record the owner, the access it permits, the protection in place and the evidence that protection works. Then use the seven categories to check whether anything has been missed.

Ask for evidence rather than a yes-or-no assurance. A backup schedule is different from a successful restore test. An alerting platform is different from a staffed response process. A written access policy is different from a recent permissions review.

Our managed security services can be discussed against those outcomes. Request a clear service boundary and identify any responsibilities retained by your own team. This makes it easier to compare proposals and prevents assumptions about coverage becoming an operational gap.

Why should recovery planning be included from the beginning?

Preventive controls cannot remove every possibility of disruption. Recovery planning asks which services must return first, what information is required and who will make decisions under pressure. It also tests whether the organisation can actually use the backups it has purchased.

For each critical workflow, agree the maximum tolerable interruption and acceptable data loss in business terms. Then compare those requirements with a demonstrated recovery process. Include dependencies such as administrator access, supplier availability and the ability to reach people if normal email is unavailable.

A proportionate exercise can be simple: assume a key account is compromised or a cloud service is unavailable, then walk through the response. Record unclear decisions and missing contact details. Fixing those issues before an incident is often more useful than adding another untested document.

What should you do after reading this guide?

Choose the three most important workflows in your organisation and trace the technology, accounts and information supporting them. Map their controls against the seven areas. Identify the most consequential gap, assign an owner and set a realistic completion date.

Review progress using evidence. Ask whether access was actually removed, whether updates reached all relevant devices and whether the restore test succeeded. A task marked complete should have a result that someone can explain.

If you need help prioritising, speak to NetMonkeys about your current systems and responsibilities. The objective is a coherent security programme that supports the business. Understanding seven types is a useful beginning; keeping the controls working together is the ongoing job.

What else do businesses ask?