OSI Model & TCP/IP Deep Dive

55 min

The OSI Model — Seven Layers of Networking

The Open Systems Interconnection (OSI) model is a conceptual framework that standardizes network communication into seven distinct layers. Security professionals must understand each layer to identify where attacks occur and where controls should be placed.

OSI SECURITY REFERENCE MODEL
══════════════════════════════════════════════════════
Layer 7  APPLICATION   HTTP, HTTPS, DNS, SMTP, FTP
         Threats: XSS, SQL Injection, Phishing
         Controls: WAF, Secure Coding, TLS

Layer 6  PRESENTATION  SSL/TLS, Encryption, Encoding
         Threats: SSL Stripping, Padding Oracle
         Controls: Enforce TLS 1.3, HSTS

Layer 5  SESSION       NetBIOS, RPC, Session tokens
         Threats: Session Hijacking
         Controls: Secure tokens, MFA

Layer 4  TRANSPORT     TCP, UDP, Port Numbers
         Threats: Port Scanning, SYN Flood
         Controls: Firewalls, Rate Limiting

Layer 3  NETWORK       IP, ICMP, Routing
         Threats: IP Spoofing, Routing attacks
         Controls: Firewall ACLs, DNSSEC

Layer 2  DATA LINK     Ethernet, MAC, ARP, VLANs
         Threats: ARP Poisoning, MAC Flooding
         Controls: 802.1X, Port Security

Layer 1  PHYSICAL      Cables, NICs, Wireless signals
         Threats: Physical tapping, RF interception
         Controls: Physical security, shielding
══════════════════════════════════════════════════════

Critical Protocols & Their Vulnerabilities

DNS — Translates domain names to IPs. Vulnerable to DNS poisoning, hijacking. Use DNSSEC.
ARP — Maps IP to MAC. No authentication — vulnerable to ARP spoofing/poisoning.
DHCP — Assigns IP addresses. DHCP starvation and rogue DHCP servers are common attacks.
ICMP — Network diagnostics (ping). Used in smurf attacks and ICMP tunneling.
BGP — Internet routing protocol. BGP hijacking can redirect global traffic.

Common Network Attacks

Man-in-the-Middle (MITM) — Intercept and potentially alter communications
DDoS — Overwhelm target with traffic from multiple sources (botnet)
Port Scanning — Enumerate open ports to identify services (Nmap)
Packet Sniffing — Capture unencrypted network traffic (Wireshark)
IP Spoofing — Forge source IP address in packets