OSI Model & Network Security Fundamentals
MΓ΄ hΓ¬nh OSI & BαΊ£o mαΊt MαΊ‘ng
OSI 7-Layer Model β Security Mapping
Every network attack targets a specific OSI layer. Every security control operates at a specific layer. The exam tests whether you can match attacks and controls to the correct layer.
| Layer | Name | Key Protocols | Attack Types | Controls |
|---|---|---|---|---|
| L1 | Physical | Cables, fiber, hubs | Wiretapping, eavesdropping, physical tampering | Cable shielding, physical access controls, locked comms rooms |
| L2 | Data Link | Ethernet, ARP, 802.11, VLANs | ARP poisoning, MAC spoofing, VLAN hopping, MAC flooding | 802.1X, DAI (Dynamic ARP Inspection), port security, VLAN segmentation |
| L3 | Network | IP, ICMP, routing protocols | IP spoofing, Smurf attack, routing hijack, ICMP flood | Firewalls, ACLs, anti-spoofing filters, BCP38 ingress filtering |
| L4 | Transport | TCP, UDP | SYN flood, port scanning, session hijacking, UDP flood | Stateful firewalls, SYN cookies, rate limiting, port filtering |
| L5 | Session | NetBIOS, RPC, SQL sessions | Session fixation, session replay | TLS session handling, secure session tokens, timeouts |
| L6 | Presentation | TLS/SSL, MIME, encoding formats | SSL stripping, encoding attacks, malformed data | Enforce HTTPS + HSTS, TLS 1.3, certificate validation |
| L7 | Application | HTTP, SMTP, DNS, FTP, SNMP | SQLi, XSS, CSRF, phishing, SSRF, DNS poisoning, API abuse | WAF, input validation, OWASP controls, application firewalls |
Memory aid: Please Do Not Throw Sausage Pizza Away (Physical β Data Link β Network β Transport β Session β Presentation β Application)
TCP/IP 4-Layer Model vs OSI
The TCP/IP model is what's actually implemented in real networks. The OSI model is the conceptual reference used by security certifications.
| TCP/IP Layer | Equivalent OSI Layers | Key Protocols |
|---|---|---|
| Application | L5 Session + L6 Presentation + L7 Application | HTTP, SMTP, DNS, SSH, FTP, TLS |
| Transport | L4 Transport | TCP, UDP |
| Internet | L3 Network | IP, ICMP, ARP (sometimes), routing |
| Network Access (Link) | L1 Physical + L2 Data Link | Ethernet, Wi-Fi, fiber, MAC addressing |
Network Topology Security
Key Terms
7-layer conceptual framework for network communication. Each layer has defined protocols and security responsibilities.
4-layer practical implementation of network protocols used in real internet communication.
Layer 2 attack β attacker sends fake ARP replies to associate their MAC with a legitimate IP, enabling MITM attacks on LAN.
Layer 2 attack β attacker escapes their VLAN to access traffic on another VLAN via double-tagging or DTP exploitation.
Layer 4 DoS β attacker sends massive TCP SYN packets without completing handshakes, exhausting server connection table.
Layer 3 attack β attacker sends packets with forged source IP address to impersonate another host or bypass IP-based controls.
Layer 6/7 MITM attack β intercepts HTTPS redirect and serves HTTP to the client, downgrading encrypted connection to plaintext.
Web Application Firewall β Layer 7 control that inspects HTTP content to block SQLi, XSS, CSRF, and other application attacks.
Layer 2 control on managed switches β validates ARP packets against DHCP binding table, dropping spoofed ARP replies.
Layer 2 switch feature β limits the number of MAC addresses allowed on a port, preventing MAC flooding and unauthorized devices.
- WAF = Layer 7 β inspects HTTP content (URL, headers, body). CloudFlare WAF, AWS WAF, ModSecurity all operate at Application layer.
- Stateful firewall = Layer 4 β tracks TCP connection state (SYN, SYN-ACK, ACK). Does not inspect content above Layer 4.
- ARP operates at Layer 2 (Data Link) β ARP poisoning is a Layer 2 attack; DAI is the Layer 2 mitigation. ARP is not routable (stays within a broadcast domain).
- TLS operates at Layer 5/6 (Session/Presentation) β TLS negotiates sessions and encrypts/decrypts data at Presentation layer.
- SSL stripping = downgrade HTTPS to HTTP β mitigated by HSTS (HTTP Strict Transport Security), which tells the browser to always use HTTPS regardless of redirect.
Map Platform C's attack surface to OSI layers:
- L7 β CloudFlare WAF: Blocks SQLi, XSS, OWASP Top 10 before requests reach GCP. Application-layer control on all Partner C (PH) and Platform C public endpoints.
- L4 β Rate limiting on public endpoints: SYN flood protection and OTP brute-force prevention (5 attempts/hr per phone number) operate at Transport layer.
- L3 β Kubernetes NetworkPolicies: GCP VPC firewall rules and K8s NetworkPolicies function as Layer 3 ACLs between namespaces and between the payment cluster and other services.
- L2 β GCP VPC managed: GCP handles the underlying network layer for GKE nodes. However, verify no ARP-based attacks are possible in GKE pod networking β GCP uses software-defined networking that prevents ARP spoofing within the VPC, but validate this assumption for any on-prem or hybrid nodes.
Gap: No explicit Layer 2 control visible in Platform C internal K8s pod-to-pod. GCP VPC handles this, but document the assumption and verify GKE network plugin (Dataplane V2 / Calico) enforces it.
Practice Quiz β OSI Model
Q1. A Web Application Firewall (WAF) operates at which OSI layer?
Q2. A SYN flood attack exploits which OSI layer?
Q3. ARP poisoning is an attack at which OSI layer?
Q4. SSL stripping is best mitigated by which control?
Q5. A stateful firewall primarily operates at which OSI layer?