The OSI (Open Systems Interconnection) and TCP/IP reference models are the conceptual frameworks that allow disparate computer hardware and operating systems to communicate reliably. For cybersecurity analysts, they serve as the foundational taxonomy for categorizing threats, vulnerabilities, and security controls.
1. The 7 Layers of the OSI Model
Developed by the International Organization for Standardization (ISO), the OSI 7-layer model divides network operations into modular tiers:
| Layer # & Name | PDU | Core Protocols & Technologies | Primary Function |
|---|---|---|---|
| 7. Application | Data | HTTP/S, DNS, SSH, SMTP, FTP, SNMP | Interface between user software and the network; interprets data formatting and services. |
| 6. Presentation | Data | TLS/SSL, ASCII, UTF-8, JPEG, JSON | Data formatting, encryption/decryption, serialization, and compression. |
| 5. Session | Data | RPC, NetBIOS, PPTP, SOCKS | Establishes, maintains, synchronizes, and terminates dialogues between applications. |
| 4. Transport | Segment (TCP) / Datagram (UDP) | TCP, UDP, SCTP, QUIC | End-to-end communication, port addressing, flow control, error recovery, and segmentation. |
| 3. Network | Packet | IPv4, IPv6, ICMP, IPsec, OSPF, BGP | Logical host addressing (IPs), routing across disparate networks, and path determination. |
| 2. Data Link | Frame | Ethernet (802.3), Wi-Fi (802.11), ARP, VLANs (802.1Q), PPP | Physical node-to-node frame delivery across local segment, MAC addressing, collision management. |
| 1. Physical | Bits | Cat6a, Fiber Optic, Radio Waves, RJ-45, SFP+ | Transmission and reception of unstructured raw bit streams over physical transmission media. |
While the OSI model is a 7-layer theoretical standard, the real-world Internet operates on the TCP/IP Protocol Suite (RFC 1122), which condenses the stack into 4 practical layers:
- Application Layer: Combines OSI Layers 5, 6, and 7 (HTTP, SSH, DNS).
- Transport Layer: Corresponds directly to OSI Layer 4 (TCP, UDP).
- Internet Layer: Corresponds directly to OSI Layer 3 (IP, ICMP, ARP).
- Network Access (Link) Layer: Combines OSI Layers 1 and 2 (Ethernet, Wi-Fi).
2. Encapsulation and Decapsulation
When an application sends data over the network, it undergoes Data Encapsulation (downward traversal of the stack) on the sender, and Decapsulation (upward traversal) on the recipient.
3. Defense-in-Depth Mapped to the OSI Layers
A resilient defensive security posture requires controls implemented across multiple distinct OSI layers:
Physical & Data Link
- Physical access control & locked server racks.
- 802.1X Port-Based Network Access Control (NAC).
- Dynamic ARP Inspection (DAI) & DHCP Snooping.
- VLAN Segmentation & MACsec (802.1AE).
Network & Transport
- Stateful Packet Inspection (SPI) Firewalls.
- IPsec VPN tunnels for end-to-end site encryption.
- SYN Flood protections (SYN Cookies).
- Ingress/Egress router Access Control Lists (ACLs).
Application Layer
- Web Application Firewalls (WAF) inspecting SQLi/XSS.
- Mutual TLS (mTLS) authentication.
- Secure DNS (DNSSEC, DNS over HTTPS).
- API Gateways with rate limiting and schema validation.
Attacker: Uses Layer 7 obfuscation or encryption (HTTPS/TLS) to conceal malicious payloads from legacy Layer 3/4 firewalls that only examine IP addresses and port numbers.
Defender: Deploys Next-Generation Firewalls (NGFW) with SSL/TLS Decryption Inspection, Deep Packet Inspection (DPI), and Intrusion Prevention Systems (IPS) capable of analyzing Layer 7 protocol behaviors.