the distinction between application and infrastructure security: application security is designed to resist attacks. infrastructure security is the software configured to resist attacks.