Different paths of security, same field...So what are they? I want to know, here is a brief

Now I get asked this a lot: What are the fields of security and where do I start with them?

This is a totally fine question, which I hoped someone have told me or guide me earlier before I dive in the field, at least to be more aware of things.

Anyway.... Cyber Security or what other may say Computer security though this is a smaller analogy and let me explain. It is divided into two main categories, some may argue about this way of categorization but they all point to the same meaning. 1st: Network Security, 2nd Information Security.

1- Network Security:

This is considered some how the defensive side, this field you will be responsible for the security of the infrastructure of your network corporation or whatever. You will need to develop yourself in techniques of security using solutions like two-factor authentication, firewalls, IPS/IDS, antiviruses and hardening of the network which includes securing of routers and switches of your network and also controlling access to your network. You will also need to be familiar with security solutions from vendors like Cisco, RSA, McAfee, IBM...etc.

Some of the things you may hear: Cisco ASA firewall, RADIUS Server, McAfee Endpoint, Source-fire, F5 firewall, SIEM solution, Secure-ID...etc.

2- Information Security:

This is what you may see in a movie, some "hacker" with a laptop and some socially awkward person which believe me both of those are far from true. You can't crack a system with fast typing and no the security consultants are not fat or stay in the basements, as a matter of fact I met some consultants in the field and they are like sophisticated gentlemen or ladies.

Back to matter in hand, this side is concerned with offensive and defensive side of the infrastructure. In details: security of applications like secure coding like code reviews to check for vulnerable code, or reverse engineering which some call black box testing, meaning you don't have info of this software and this is more common in closed source applications. It also includes things like Penetration Testing or Pentesting for short, this is like full infrastructure testing, web Pentesting, for web applications, incident handling, forensics. Those people need to have good understanding of computer systems and programming knowledge.

The good guys here can be called white hat hackers or grey hat hackers, grey meaning black box testing like a black hat hacker but hired by a company. And yes the black hat is the one who steals your credit card info.

Some of those grey hatters who expose vulnerabilities for companies in return for money or recognition, those programs are called bug bounty programs, famous companies like Google and Facebook give out large bounties to encourage vulnerability researchers find and report those bugs before they get exploited by bad guys.

Those basically are the pillars of the field, apart of analogies and categorization, case you researched any of those terms or fields you will get a better understanding of what you want to do, or what to learn. 

PS: The bad guys are called crackers, a hacker is someone who finds a better way or new ways of doing things. So please use the correct analogy. :)