This discussion paper - co-authored by Anja Kovacs from the Internet Democracy Project and Dixie Hawtin from Global Partners and Associates - was written on invitation for the Stockholm Internet Forum. The paper examines the main challenges that the cyber security arena currently poses for the promotion and protection of human rights - including a lack of definitional clarity; a consequent pervasive but often illegitimate sense of crisis; and costly yet frequently ineffective solutions. It then investigates what a human rights approach to cyber security entails, taking as its starting point a positive, rather than negative, approach to security that supports not only the right to privacy but, crucially, also the right to freedom of expression.