What Is the OSI Model? Layer-by-Layer Security and How It Maps to TCP/IP
Stacking up security measures without paying attention to which layer they protect leaves unexpected gaps. Here's a breakdown of what each of the 7 OSI layers does, and the defenses that matter at each one.
What Is the OSI Model?
The OSI model (Open Systems Interconnection) is a conceptual model developed by the ISO (International Organization for Standardization) in the 1980s that organizes the functions of network communication into seven layers. Real-world protocol implementations don't always map cleanly onto these seven layers, but the model is still widely used today as a common language for discussing "what's happening at which stage of communication" and "where vulnerabilities can exist."
What Each of the 7 Layers Does, and the Security Measures That Apply
| Layer 7: Application | Protocols the user interacts with directly, such as HTTP, DNS, and SMTP. Main threats: SQL injection, XSS, phishing, and authentication flaws. Defenses: input validation, WAFs, multi-factor authentication, secure coding |
|---|---|
| Layer 6: Presentation | Handles data encoding, encryption, and compression (some functions of TLS are sometimes placed here as well). Defenses: choosing appropriate cipher suites, thorough certificate validation |
| Layer 5: Session | Manages establishing, maintaining, and terminating communication sessions. Threats: session hijacking, session fixation attacks. Defenses: session ID regeneration, timeout settings |
| Layer 4: Transport | End-to-end data transfer via TCP/UDP. Threats: SYN floods and other attacks that exploit TCP's structure. Defenses: TLS (which spans layers 4 through 6), SYN cookies, rate limiting |
| Layer 3: Network | Routing via IP. Main threats: IP spoofing, routing manipulation, DDoS. Defenses: firewalls, IPS, BCP38 (source address validation) |
| Layer 2: Data Link | Transmission between adjacent nodes, e.g. Ethernet and Wi-Fi. Threats: ARP spoofing, MAC address spoofing. Defenses: port security, 802.1X authentication, Dynamic ARP Inspection |
| Layer 1: Physical | The physical transmission medium — cables, radio waves. Threats: eavesdropping, unauthorized physical access to equipment. Defenses: physical access control, managing cable routing, protecting against signal leakage |
What matters here is that each layer can be its own independent attack surface. No matter how robust your authentication is at the application layer, if you allow ARP spoofing at the data link layer, the communication itself can still be intercepted and tampered with via a man-in-the-middle attack. Network diagnostic tools like ShieldGuard NET mainly target layers 3 and 4 (router vulnerabilities, open ports), but it's important to keep in mind that this alone doesn't cover every layer.
How This Compares to the TCP/IP 4-Layer Model
Most real-world internet communication isn't designed around the OSI 7-layer model, but around the more implementation-oriented TCP/IP 4-layer model (sometimes described as a 5-layer model). Here's how the two map to each other.
| TCP/IP 4-layer model | Corresponding OSI layer(s) / representative protocols |
|---|---|
| Application layer | OSI layers 5–7 / HTTP, DNS, SMTP, SSH |
| Transport layer | OSI layer 4 / TCP, UDP |
| Internet layer | OSI layer 3 / IP, ICMP |
| Network interface layer | OSI layers 1–2 / Ethernet, Wi-Fi |
The biggest difference is that the TCP/IP model bundles OSI layers 5 through 7 (session, presentation, and application) into a single "application layer." This is a historical artifact: when TCP/IP was first put into practical use, it wasn't designed around as strict a layer separation as the OSI model. In practice, security product catalogs and vulnerability advisories often use OSI-style terms like "layer 7 attack," while implementations and configuration files tend to lump things together as "application layer" in the TCP/IP style — knowing both models helps you avoid misreading documentation.
Summary
- The OSI model is a conceptual model that splits communication into 7 layers, useful as a common language for organizing threats and defenses layer by layer
- Each layer can be its own independent attack surface, so hardening only one layer doesn't guarantee overall safety
- The TCP/IP 4-layer model used in real implementations bundles OSI layers 5–7 into a single "application layer"
- Understanding which layer a given security product targets is the first step to avoiding gaps in coverage
Check Your Network Layer for Vulnerabilities
ShieldGuard NET is a tool that scans your home network for open ports and known vulnerabilities (CVEs).
See ShieldGuard NET