OSI Model Overview
| Layer # | Name | Function | Common Protocols |
|---|---|---|---|
| 7 | Application | User interfaces, apps | HTTP, FTP, SMTP, DNS |
| 6 | Presentation | Data formatting, encryption | SSL/TLS, JPEG, MPEG |
| 5 | Session | Connection management | NetBIOS, PPTP, RPC |
| 4 | Transport | End-to-end communication | TCP, UDP |
| 3 | Network | Routing, addressing | IP, ICMP, IPsec |
| 2 | Data Link | Node-to-node transfer | Ethernet, WiFi, ARP |
| 1 | Physical | Physical transmission | Cables, signals, hardware |
Application Layer 6
Presentation Layer 5
Session Layer 4
Transport Layer 3
Network Layer 2
Data Link Layer 1
Physical
Layer 7 - Application Layer Attacks
SQL Injection (SQLi)
Severity: Critical
Description: Attacker inserts malicious SQL queries through application inputs to manipulate database operations, potentially exposing, modifying, or deleting data.
Real-World Example: Attacker enters ' OR '1'='1 in login form, bypassing authentication.
Quick Fixes:
// BAD - Vulnerable
$query = "SELECT * FROM users WHERE username = '" . $username . "'";
// GOOD - Protected
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = ?");
$stmt->execute([$username]);
# Input validation
# Whitelist allowed characters
# Use ORM frameworks (Sequelize, SQLAlchemy, Hibernate)
# Least privilege database accounts
Prevention:
• Always use parameterized queries or prepared statements
• Input validation with whitelisting
• Use stored procedures
• Implement WAF (Web Application Firewall)
• Regular security testing
Key Takeaways
- Each OSI layer has unique vulnerabilities — defense in depth means protecting all 7 layers
- Layer 2 attacks (ARP spoofing, MAC flooding) are often overlooked but devastating on LANs
- Layer 3/4 attacks (IP spoofing, SYN floods) require firewall and IPS protections
- Layer 7 attacks (SQL injection, XSS, DDoS) target applications and are the most common
- Network segmentation and encryption address vulnerabilities across multiple layers
Cross-Site Scripting (XSS)
Severity: High
Description: Injection of malicious scripts into web pages viewed by other users, allowing attackers to steal session tokens, cookies, or sensitive information.
Quick Fixes:
// Input sanitization
import DOMPurify from 'dompurify';
const clean = DOMPurify.sanitize(userInput);
// Output encoding
const escaped = escapeHtml(userInput);
// Content Security Policy (CSP)
Content-Security-Policy: default-src 'self'; script-src 'self'
// HTTPOnly cookies
Set-Cookie: sessionid=abc123; HttpOnly; Secure
Cross-Site Request Forgery (CSRF)
Severity: High
Description: Forces authenticated users to execute unwanted actions on a web application in which they're currently authenticated.
Quick Fixes:
// Anti-CSRF tokens
// Verify token on server
if ($_POST['csrf_token'] !== $_SESSION['csrf_token']) {
die('CSRF token validation failed');
}
// SameSite cookies
Set-Cookie: session=value; SameSite=Strict
// Check Referer header
// Require re-authentication for sensitive actions
DNS Attacks (Spoofing, Cache Poisoning, Tunneling)
Severity: High
Description: Manipulation of DNS queries/responses to redirect traffic to malicious servers or exfiltrate data.
Quick Fixes:
# Enable DNSSEC
dnssec-enable yes;
dnssec-validation yes;
# Use trusted DNS servers (Cloudflare, Google)
# /etc/resolv.conf
nameserver 1.1.1.1
nameserver 8.8.8.8
# Monitor DNS traffic for anomalies
# Implement DNS filtering
# Use encrypted DNS (DNS over HTTPS/TLS)
HTTP Response Splitting/Smuggling
Severity: High
Description: Exploiting discrepancies in how different systems parse HTTP requests/responses.
Quick Fixes:
# Validate and sanitize HTTP headers
# Remove CRLF (\r\n) from user input
header = header.replace(/[\r\n]/g, '');
# Use latest HTTP/2 or HTTP/3
# Update web server software
# Implement strict HTTP parsing
Layer 6 - Presentation Layer Attacks
SSL/TLS Vulnerabilities (Heartbleed, POODLE, BEAST)
Severity: Critical
Description: Exploits in SSL/TLS implementations allowing attackers to decrypt encrypted traffic or steal sensitive data.
Real-World Example: Heartbleed (CVE-2014-0160) allowed reading server memory, exposing passwords and private keys.
Quick Fixes:
# Update OpenSSL immediately
sudo apt update && sudo apt upgrade openssl
# Disable vulnerable protocols
# Apache
SSLProtocol TLSv1.2 TLSv1.3
# Nginx
ssl_protocols TLSv1.2 TLSv1.3;
# Use strong ciphers
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
# Test configuration
openssl s_client -connect example.com:443 -tls1_2
Encryption Downgrade Attacks
Severity: High
Description: Force client-server communication to use weaker encryption that can be broken.
Quick Fixes:
# Enforce strong encryption only
# Disable SSLv2, SSLv3, TLS 1.0, TLS 1.1
# Enable HSTS
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
# Prefer server cipher order
SSLHonorCipherOrder on
Certificate Attacks (Spoofing, MITM)
Severity: High
Description: Using fraudulent certificates to impersonate legitimate sites.
Quick Fixes:
# Use Certificate Transparency
# Enable OCSP stapling
ssl_stapling on;
ssl_stapling_verify on;
# Certificate pinning (for mobile apps)
# Use reputable Certificate Authorities
# Monitor certificate logs
# Implement CAA DNS records
Layer 5 - Session Layer Attacks
Session Hijacking
Severity: Critical
Description: Stealing or predicting a valid session token to gain unauthorized access to a user's session.
Real-World Example: Attacker intercepts session cookie over unencrypted WiFi and uses it to access victim's account.
Quick Fixes:
# Use HTTPS only
# Set secure cookies
Set-Cookie: sessionid=abc123; Secure; HttpOnly; SameSite=Strict
# Regenerate session ID after login
session_regenerate_id(true);
# Session timeout
session.gc_maxlifetime = 1800 # 30 minutes
# Bind session to IP address (optional)
if ($_SESSION['ip'] !== $_SERVER['REMOTE_ADDR']) {
session_destroy();
}
# Use strong session IDs (random, unpredictable)
Session Fixation
Severity: High
Description: Forcing a user to use a known session ID, then hijacking that session after authentication.
Quick Fixes:
# Regenerate session ID on login
// Before authentication
session_start();
// After successful login
session_regenerate_id(true);
$_SESSION['authenticated'] = true;
# Don't accept session IDs from GET/POST parameters
# Use framework's built-in session management
Man-in-the-Middle (MITM)
Severity: Critical
Description: Intercepting communication between two parties to eavesdrop or manipulate data.
Quick Fixes:
# Enforce HTTPS everywhere
# Use HSTS
# Implement certificate pinning
# Use VPN for sensitive connections
# Enable encrypted DNS (DoH/DoT)
# Mutual TLS authentication for APIs
🔒 Protect Against MITM Attacks
VPNs encrypt your entire connection, preventing man-in-the-middle attacks on public WiFi and untrusted networks:
Military-grade encryption • Secure public WiFi • 30-day guarantee
Layer 4 - Transport Layer Attacks
SYN Flood Attack
Severity: High
Description: Overwhelming a server by sending many SYN requests without completing the TCP handshake, exhausting server resources.
Quick Fixes:
# Enable SYN cookies (Linux)
sudo sysctl -w net.ipv4.tcp_syncookies=1
echo "net.ipv4.tcp_syncookies=1" >> /etc/sysctl.conf
# Reduce SYN backlog timeout
sudo sysctl -w net.ipv4.tcp_synack_retries=2
# Increase backlog queue
sudo sysctl -w net.ipv4.tcp_max_syn_backlog=2048
# Use firewall rate limiting
iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 3 -j ACCEPT
iptables -A INPUT -p tcp --syn -j DROP
# Use DDoS protection service (Cloudflare, AWS Shield)
UDP Flood Attack
Severity: High
Description: Sending large volumes of UDP packets to random ports, consuming bandwidth and resources.
Quick Fixes:
# Rate limit UDP traffic
iptables -A INPUT -p udp -m limit --limit 10/s --limit-burst 20 -j ACCEPT
iptables -A INPUT -p udp -j DROP
# Filter unnecessary UDP ports
iptables -A INPUT -p udp --dport 53 -j ACCEPT # DNS
iptables -A INPUT -p udp -j DROP
# Use DDoS mitigation service
# Monitor network traffic for anomalies
Port Scanning
Severity: Medium
Description: Reconnaissance technique to discover open ports and services on a target system.
Quick Fixes:
# Close unnecessary ports
# Use minimal services principle
# Configure firewall to drop, not reject
iptables -A INPUT -p tcp --dport 1:1024 -j DROP
# Install port scan detection
sudo apt install portsentry
# Rate limit connection attempts
# Use fail2ban for repeated scan attempts
# Implement port knocking for sensitive services
TCP Reset Attack
Severity: Medium
Description: Injecting forged TCP RST packets to terminate legitimate connections.
Quick Fixes:
# Use IPsec or VPN for critical connections
# Enable TCP MD5 signatures (for BGP)
# Implement connection tracking
# Monitor for abnormal RST packets
Layer 3 - Network Layer Attacks
IP Spoofing
Severity: High
Description: Creating IP packets with a forged source address to impersonate another system or hide the attacker's identity.
Quick Fixes:
# Ingress filtering (Block spoofed IPs)
# Cisco router
access-list 100 deny ip 10.0.0.0 0.255.255.255 any
access-list 100 deny ip 172.16.0.0 0.15.255.255 any
access-list 100 deny ip 192.168.0.0 0.0.255.255 any
# Linux iptables
iptables -A INPUT -i eth0 -s 10.0.0.0/8 -j DROP
iptables -A INPUT -i eth0 -s 172.16.0.0/12 -j DROP
iptables -A INPUT -i eth0 -s 192.168.0.0/16 -j DROP
# Enable reverse path filtering
sysctl -w net.ipv4.conf.all.rp_filter=1
# Use BCP 38 (Best Current Practice) filtering
ICMP Flood (Ping Flood)
Severity: Medium
Description: Overwhelming target with ICMP echo requests, consuming bandwidth and resources.
Quick Fixes:
# Disable ICMP echo replies (if not needed)
sysctl -w net.ipv4.icmp_echo_ignore_all=1
# Rate limit ICMP
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
# Or completely block ICMP from external sources
iptables -A INPUT -i eth0 -p icmp -j DROP
# Allow ICMP only from trusted networks
iptables -A INPUT -s 192.168.1.0/24 -p icmp -j ACCEPT
Smurf Attack
Severity: Medium
Description: Amplification attack using spoofed ICMP packets sent to broadcast addresses.
Quick Fixes:
# Disable IP directed broadcasts
# Cisco
interface FastEthernet0/0
no ip directed-broadcast
# Linux
echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
# Block packets to broadcast addresses
iptables -A INPUT -m pkttype --pkt-type broadcast -j DROP
Routing Attacks (BGP Hijacking)
Severity: High
Description: Manipulating routing protocols to redirect network traffic through attacker-controlled systems.
Quick Fixes:
# Implement BGP security
# Use BGPsec or RPKI (Resource Public Key Infrastructure)
# Filter BGP announcements
# Accept only expected prefixes
# Implement BGP MD5 authentication
# Monitor for route changes
# Use IRR (Internet Routing Registry) validation
# For enterprises: Use static routes where possible
Layer 2 - Data Link Layer Attacks
ARP Spoofing (ARP Poisoning)
Severity: High
Description: Sending fake ARP messages to associate attacker's MAC address with legitimate IP addresses, enabling MITM attacks on local network.
Real-World Example: Attacker on same WiFi network intercepts traffic between victim and router by poisoning ARP cache.
Quick Fixes:
# Static ARP entries for critical systems
arp -s 192.168.1.1 00:11:22:33:44:55
# Enable Dynamic ARP Inspection (DAI)
# Cisco switch
ip arp inspection vlan 1
interface GigabitEthernet0/1
ip arp inspection trust
# Use arpwatch to monitor ARP changes
sudo apt install arpwatch
sudo systemctl start arpwatch
# Enable port security on switches
# Use encrypted protocols (HTTPS, SSH, VPN)
MAC Flooding
Severity: Medium
Description: Overwhelming switch's MAC address table with fake entries, causing it to operate as a hub and broadcast traffic.
Quick Fixes:
# Enable port security on switches
# Cisco
interface GigabitEthernet0/1
switchport port-security
switchport port-security maximum 2
switchport port-security violation shutdown
switchport port-security mac-address sticky
# Set MAC address table size limits
# Enable MAC address aging
VLAN Hopping
Severity: High
Description: Exploiting misconfigurations to gain access to traffic on other VLANs.
Quick Fixes:
# Disable DTP (Dynamic Trunking Protocol)
# Cisco
interface GigabitEthernet0/1
switchport mode access
switchport nonegotiate
# Don't use VLAN 1 for user traffic
# Explicitly configure trunk ports
interface GigabitEthernet0/24
switchport mode trunk
switchport trunk allowed vlan 10,20,30
# Enable VLAN access control lists
CAM Table Overflow
Severity: Medium
Description: Similar to MAC flooding, overflowing switch's Content Addressable Memory table.
Quick Fixes:
# Implement port security (same as MAC flooding)
# Monitor CAM table utilization
# Set MAC address learning limits per port
# Use private VLANs for isolation
Layer 1 - Physical Layer Attacks
Physical Access Attacks
Severity: Critical
Description: Direct physical access to hardware allowing installation of keyloggers, tampering, theft, or destruction.
Quick Fixes:
• Lock server rooms and network closets
• Use cable locks on laptops and equipment
• Install security cameras
• Badge/biometric access control
• Visitor logs and escort policies
• Encrypt hard drives (BitLocker, LUKS, FileVault)
• BIOS/UEFI passwords
• Disable unused USB ports physically or via policy
• Tamper-evident seals on equipment
• Regular physical security audits
Cable Tapping/Wiretapping
Severity: High
Description: Physical interception of data transmission through cables.
Quick Fixes:
• Use fiber optic cables (harder to tap)
• Run cables through secure conduits
• Encrypt all data in transit (TLS, IPsec, VPN)
• Physical inspection of cable routes
• Use tamper-detection systems
• Implement network segmentation
• Monitor for unusual network activity
Signal Jamming/Interference
Severity: Medium
Description: Disrupting wireless communications through electromagnetic interference.
Quick Fixes:
• Use wired connections for critical systems
• Implement redundant communication paths
• Use frequency hopping (FHSS)
• Monitor for unusual interference patterns
• Physical security to prevent placement of jamming devices
• Use directional antennas to reduce signal area
• Implement WIDS (Wireless Intrusion Detection Systems)
Hardware Tampering
Severity: Critical
Description: Physical modification of hardware to install backdoors, keyloggers, or malicious firmware.
Quick Fixes:
• Purchase equipment from trusted vendors only
• Verify hardware integrity upon receipt
• Use tamper-evident packaging/seals
• Implement supply chain security
• Regular hardware inspections
• Firmware verification and signing
• Use hardware security modules (HSMs) for sensitive operations
• Implement Trusted Platform Module (TPM)
Quick Reference Summary
| Layer | Key Attacks | Top Priority Fix | Severity |
|---|---|---|---|
| 7 - Application | SQLi, XSS, CSRF | Input validation, parameterized queries | Critical |
| 6 - Presentation | SSL/TLS exploits | Update OpenSSL, disable old protocols | Critical |
| 5 - Session | Session hijacking, MITM | HTTPS only, secure cookies, VPN | Critical |
| 4 - Transport | SYN flood, UDP flood | Enable SYN cookies, rate limiting | High |
| 3 - Network | IP spoofing, ICMP flood | Ingress filtering, disable ICMP | High |
| 2 - Data Link | ARP spoofing, VLAN hopping | DAI, port security, disable DTP | High |
| 1 - Physical | Physical access, tampering | Lock facilities, encrypt drives | Critical |
Defense in Depth Strategy
Layer-by-Layer Security Approach:
1. Physical: Lock server rooms, cable management, access control
2. Data Link: Port security, VLAN segmentation, DAI
3. Network: Firewalls, anti-spoofing, ICMP filtering
4. Transport: SYN cookies, rate limiting, DDoS protection
5. Session: Strong session management, HTTPS everywhere
6. Presentation: Strong encryption, updated SSL/TLS
7. Application: Input validation, WAF, security testing
Key Principle: If one layer fails, other layers provide backup protection. Never rely on a single security control.
🛡️ Advanced Threat Protection
Protect against sophisticated attacks across all OSI layers with professional-grade security tools:
Application layer protection
Network/transport layer encryption
Related Resources
Test Your Knowledge
FixTheVuln Store
Studying for CompTIA Network+? Get the Study Planner
Fillable PDF study planners with domain trackers, weekly schedules, and progress tracking. Available in Standard, ADHD-Friendly, Dark Mode, and 4-Format Bundle.
CompTIA Network+ Planner60+ certifications available — from $5.99