Network models: OSI and TCP/IP for security professionals

Domain 4 of the CISSP, Communication and Network Security, carries about 13 % of the exam weight under the outline ISC2 has used since 15 April 2024 (checked October 2026; ISC2 reviews its outlines through a job task analysis roughly every three years, so confirm the current outline before you book). It has three sub-domains: 4.1, apply secure design principles in network architectures; 4.2, secure network components; and 4.3, implement secure communication channels according to design. This course is independent study material. It is not produced, endorsed or reviewed by ISC2, and none of its questions are taken from any real exam. Every scenario is original and written to train the judgement the exam rewards.

This first lesson builds the mental model that the rest of the course hangs on. Network models describe how communication is divided into layers, each with its own job, its own addresses and its own protocols. Security professionals use the models constantly: to describe where an attack happens, to decide which control can stop it, to read a vendor's claim that a firewall works "at layer 7", and to explain to managers why a single control is never enough. Lessons 2 and 3 then go deeper into addressing and the core protocols. If you want the physical and data centre side of networking, the course DCE-210 Networking and Telecommunications for Data Centres covers cabling, fabrics and carriers; here we stay with what a security manager needs.

Why layered models exist

A network is a stack of cooperating functions. Something must turn bits into signals on a wire or radio channel, something must deliver frames between neighbouring devices, something must route packets across many networks, something must make sure data arrives complete and in order, and something must present the data to an application in a form it understands. Layering separates these jobs so that each can change without breaking the others. A web browser does not care whether the user is on fibre, Wi-Fi or a 5G phone, because the lower layers hide those details. Layering also lets vendors build interoperable products, and it gives everyone a shared vocabulary.

Two models matter for the exam. The Open Systems Interconnection reference model, OSI, was published by the International Organization for Standardization as ISO/IEC 7498-1. It has seven layers and is a teaching and design model; almost no network runs pure OSI protocols today. The TCP/IP model, also called the internet model or the Department of Defense model, describes the protocol suite the internet actually uses. It is usually shown with four layers, sometimes five. Exam questions mostly use OSI layer numbers, so you must know them well, but you must also be able to map them to TCP/IP.

The seven OSI layers

Layer 1, the physical layer, moves raw bits as electrical, optical or radio signals. It defines connectors, voltages, wavelengths, cable types and signalling rates. Devices that work only at layer 1 include hubs, repeaters, media converters and the cables themselves. Security concerns here are physical: wiretapping, cable cuts, electromagnetic emanations, radio jamming and someone plugging an unauthorized device into an open wall jack.

Layer 2, the data link layer, delivers frames between devices on the same local network segment. It uses hardware addresses, the 48-bit media access control or MAC addresses burned into network interfaces, and it detects transmission errors with a frame check sequence. The IEEE splits it into the logical link control and media access control sublayers. Ethernet (IEEE 802.3) and Wi-Fi (IEEE 802.11) are layer 2 technologies, and switches and wireless access points are layer 2 devices. Attacks here include MAC flooding, MAC spoofing, ARP poisoning, VLAN hopping and rogue access points.

Layer 3, the network layer, moves packets between networks using logical addresses, today IPv4 and IPv6 addresses. It handles routing, fragmentation and, through ICMP, error reporting. Routers and layer 3 switches operate here, as do packet-filtering firewalls in their simplest form. IPsec also works at layer 3, which is why it can protect any traffic above it. Attacks include IP spoofing, route injection, ICMP abuse and denial of service floods.

Layer 4, the transport layer, provides end-to-end delivery between processes on hosts, identified by port numbers. TCP gives reliable, ordered, connection-oriented delivery with flow and congestion control; UDP gives fast, connectionless delivery with no guarantees. Stateful firewalls track layer 4 sessions. Attacks include SYN floods, port scanning, session hijacking and UDP reflection.

Layers 5, 6 and 7 are the session, presentation and application layers. The session layer sets up, manages and tears down dialogues between applications; examples often given are remote procedure calls, NetBIOS sessions and the control of sessions in protocols such as SQL connections. The presentation layer handles data formats, character encoding, compression and, in the classical teaching, encryption. The application layer provides network services to applications: HTTP, DNS, SMTP, SNMP, SSH and many more. In practice the TCP/IP model folds all three into one application layer, and TLS is hard to place: it sits above TCP and below HTTP, and different textbooks put it at layer 4, 5, 6 or 7. For the exam, accept that TLS protects application data and is commonly described as operating between the transport and application layers.

Two memory aids are common. From layer 1 upwards: Please Do Not Throw Sausage Pizza Away. From layer 7 downwards: All People Seem To Need Data Processing. Use whichever helps, but practise placing real protocols and devices, because exam questions rarely ask for a layer name alone. They describe a device or attack and ask which layer it targets, or which control works at the same layer.

The TCP/IP model

The TCP/IP model grew out of ARPANET research in the 1970s and is documented across many Requests for Comments published by the Internet Engineering Task Force, the IETF. In its common four-layer form the layers are: network access or link, covering OSI layers 1 and 2; internet, covering layer 3; transport, covering layer 4; and application, covering layers 5 to 7. Some textbooks split the bottom layer into physical and data link, giving five layers. The model is pragmatic: it describes protocols that work rather than an ideal design.

The mapping matters because vendors and exam writers mix vocabularies. A "layer 7 firewall" inspects application content. A "layer 3 switch" routes. A "layer 2 VPN" carries Ethernet frames across a wider network so that distant sites appear to share one segment. When a question uses TCP/IP layer names, translate them to OSI numbers before you reason about controls.

Encapsulation and decapsulation

As data moves down the stack on the sending host, each layer adds its own header, and sometimes a trailer, around the data it receives from the layer above. This is encapsulation. An application message becomes the payload of a TCP segment, the segment becomes the payload of an IP packet, and the packet becomes the payload of an Ethernet frame, which is finally sent as bits. On the receiving host each layer strips its header in turn, which is decapsulation, and hands the payload upwards. Intermediate devices only open the layers they need: a switch reads the frame header, a router reads the packet header and rewrites the frame, and a stateful firewall reads up to the transport header.

Encapsulation explains several security facts. First, a control can only act on what it can see. A packet filter that reads IP and port numbers cannot block a malicious command hidden inside an allowed HTTPS session, because it never opens the payload. Second, encryption at a given layer hides everything above it from devices in the path. IPsec in tunnel mode hides the inner IP addresses, ports and application data; TLS hides the application data but leaves IP addresses and ports visible. Third, attackers abuse encapsulation through tunnelling: carrying one protocol inside another to slip past filters, for example hiding command and control traffic inside DNS queries or HTTPS.

Bandwidth, latency and throughput

Security designs also have to respect performance, and three measures come up repeatedly. Bandwidth is the capacity of a link, in bits per second. Latency is the time a bit takes to travel from sender to receiver, made up of propagation delay set by distance and the speed of signals in the medium, plus serialization, queuing and processing delays. Throughput is the rate of useful data actually delivered, which is always less than bandwidth because of overhead, retransmissions and protocol behaviour. Jitter is the variation in latency, and it matters most for voice and video.

The bandwidth-delay product, bandwidth multiplied by round-trip time, gives the amount of data that can be in flight on a path at once. TCP must keep at least that much data unacknowledged to fill the pipe. When security devices such as inspection proxies or VPN concentrators add latency, they increase the bandwidth-delay product and can quietly cut throughput for long-distance transfers. Managers who place a cloud-based inspection service far from their users sometimes see this effect as complaints that file transfers have become slow.

# Bandwidth-delay product: how much data must be in flight to fill a link
links = [('Office LAN', 1e9, 0.001), ('Toronto to Vancouver WAN', 1e9, 0.060), ('Satellite (geostationary)', 50e6, 0.600), ('LEO satellite', 200e6, 0.040)]
for name, bps, rtt in links:
    bdp_bytes = bps * rtt / 8
    print(f"{name:28s} {bps/1e6:7.0f} Mb/s  RTT {rtt*1000:5.0f} ms  BDP {bdp_bytes/1e6:6.2f} MB")

Office LAN                      1000 Mb/s  RTT     1 ms  BDP   0.12 MB
Toronto to Vancouver WAN        1000 Mb/s  RTT    60 ms  BDP   7.50 MB
Satellite (geostationary)         50 Mb/s  RTT   600 ms  BDP   3.75 MB
LEO satellite                    200 Mb/s  RTT    40 ms  BDP   1.00 MB

Using the models to reason about controls

Defence in depth on a network means placing controls at several layers so that an attack that defeats one meets another. Physical security protects layer 1. Port security, 802.1X authentication and dynamic ARP inspection protect layer 2. Routing filters, anti-spoofing rules and IPsec protect layer 3. Stateful firewalls protect layer 4. Web application firewalls, secure email gateways and TLS inspection protect layer 7. When a question describes an attack, identify the layer, then choose the control that operates at that layer, or, if the question asks for the best overall answer, the control that addresses the root cause.

Remember also that the models describe flows, not organizations. Many exam scenarios hide the layer question inside business language. "A visitor connected a laptop to a conference room jack and reached the finance file server" is a layer 2 access control failure: the fix is network access control and segmentation, not a stronger password on the file server. "Users can reach a phishing site even though the firewall blocks known bad IP addresses" is a layer 7 problem: the fix is DNS filtering or a web proxy with reputation and content inspection.

Thinking like a manager

The exam is written for security leaders, not packet engineers. When a Domain 4 question offers a technical fix and a governance fix, read carefully: if the root problem is that no one owns the network design, or that there is no policy for segmentation, the governance answer is better. When the question asks what to do first, understanding the environment, through documentation, an inventory of assets and flows or a risk assessment, usually comes before buying or configuring anything. Use the layered models to communicate: a manager who can explain that a firewall sees addresses and ports but not intent will make better investment decisions than one who believes any single device makes the network safe.