I think this question has no real answer as it stands and is even hard to answer if we would clearly define what we mean by "cryptography" and what we mean by "security" (Below I assume that you mean "information security" by security, because security is even harder to define).
Moreover, your definition of cryptography is quite outdated. That cryptography is all about encryption and decryption is the classic view of cryptography (lets say until the early 70ies).
Starting with the invention of public key cryptography and then when starting inventing tools what we call provable (reductionist) security today or concepts such as interactive proof systems (including zero-knowledge proofs), cryptography got far broader than just being concerned with the designing encryption schemes.
Today cryptography is a broad field (I think one could safely argue that it has grown to a science in its own right) relying on mathematics, (theoretical) computer science (complexity theory), engineering sciences such as computer engineering and covers many different fields going from purely theoretical cryptography to cryptographic engineering to purely applied cryptography. To given you an idea, theoretical cryptography covers the formal study of cryptographic primitives such as their security and their relationships, cryptographic engineering covers the efficient implementation of cryptographic algorithms in hard- and software as well as attacking such implementations (side-channels, etc.) and applied cryptography can be seen as a very broad field mainly devoted to bringing stuff into (complex) real world applications (i.e., designing protocols for secure communication, secure transactions, secure computation, digital cash, etc.). However, often these subfields cannot even be really kept apart.
Now @e-sushi in his answer already gave some ideas what information security is and how broad this field is. Thereby, you should also have in mind that although this field is very applied there are also many quite theoretical fields in information security such as information flow theory, access control theory, or code or program analysis (just to name a few random examples) which by themselves use tools from various different fields such as mathematics or computer science (e.g., from machine learning). Some of the subfields of information security use cryptography in the some way and these things are much related to purely applied cryptography, but there are also many fields in information security that are not related to cryptography.
It is true that information security uses concepts from (applied) cryptography to achieve some of its goals and that security is the ultimate justification to do cryptographic research. Anyways, I would rather say (and that is my personal opinion) it is really hard to put one of these fields as a subfield of the other and none of your statements is fully correct (but that is my view). When it comes to science, usually people do not like it to be treated as being a (small) subfield of some other discipline but like it to be considered as a discipline in its own right.
But if you want to have some "second opinion" from some other guys (such as the ACM), you could take a look at the ACM classification (1998) or the ACM classification (2012) where in the 1998 version the term "cryptography" does not really appear ("cryptographic controls" is under "Security and Protection") and in the 2012 version cryptoraphy can be found in the classes "Theory of computation" and "Security and privacy" (there are some minor appearances also in other classes). Not sure if that helps much ;)