Certified: The CISSP Prepcast

Welcome to The Bare Metal Cyber CISSP Prepcast. This series helps you prepare for the ISC squared CISSP exam with focused explanations and practical context.
In this episode, we’re providing a focused refresher on the OSI and TCP slash I P models. These layered frameworks help us understand how network communication happens, how data flows from one device to another, and where security controls need to be applied. For CISSP candidates, a solid understanding of these models is essential—not just to pass the exam, but to design, defend, and troubleshoot modern enterprise networks.
Let’s begin by discussing why these models are important. Both the OSI model and the TCP slash I P model break down network functions into logical layers. This structure allows us to isolate where problems occur, identify where specific protocols operate, and assign appropriate security controls at each level. When we say “defense in depth,” we are referring to this kind of layered approach—addressing threats not only at the application level, but across all layers where vulnerabilities may exist.
Understanding these models enhances troubleshooting because it helps you isolate faults. It also supports effective planning of firewalls, intrusion detection systems, secure protocols, and encryption strategies. These models give security professionals a common language and a shared mental map for defending data in motion.
Let’s begin our deep dive with the OSI model. OSI stands for Open Systems Interconnection, and this model consists of seven layers. These layers are, from bottom to top: Physical, Data Link, Network, Transport, Session, Presentation, and Application.
The first layer, the Physical Layer, deals with the actual hardware—the cables, switches, connectors, and electrical signals that carry data. Security at this layer involves preventing physical access, protecting hardware from tampering, and ensuring reliable transmission media.
The second layer is the Data Link Layer. This is where frames are formed and where devices use Media Access Control addresses, also known as M A C addresses, to identify each other on a local network. Security controls here include filtering M A C addresses, detecting spoofed addresses, and preventing traffic flooding attacks.
The third layer is the Network Layer. This is where routing occurs, using I P addresses to move packets between networks. Common protocols at this layer include I P version four and I P version six. Security at this layer involves using firewalls, packet filters, and controls to detect and block spoofed addresses or route hijacking.
The fourth layer is the Transport Layer. It ensures end-to-end communication and reliability using protocols such as Transmission Control Protocol and User Datagram Protocol. Security risks at this layer include SYN flooding, port scanning, and unauthorized session hijacking. Tools like stateful firewalls and intrusion prevention systems operate here.
The fifth layer is the Session Layer. It establishes, manages, and terminates communication sessions between applications. This is where protocols like Remote Procedure Call and NetBIOS operate. Security in this layer is less frequently discussed but still relevant, especially for session timeout controls and secure reconnections.
The sixth layer is the Presentation Layer. It handles data translation, compression, and encryption. This is where readable data is encoded or decoded into formats such as J S O N or X M L. Encryption standards like Secure Socket Layer and Transport Layer Security often begin at this layer, depending on implementation.
Finally, the seventh layer is the Application Layer. This is where users interact with services like web browsing, email, and file transfers. Protocols like Hypertext Transfer Protocol, File Transfer Protocol, and Simple Mail Transfer Protocol operate here. Most application-layer attacks, such as cross-site scripting or injection attacks, occur at this level.
For each of these layers, specific security controls should be mapped. The OSI model makes it easier to ensure that no layer is overlooked when building a defense-in-depth strategy.
Now let’s turn to the TCP slash I P model. This is the protocol suite used on the Internet, and unlike the OSI model’s seven layers, it consists of only four layers. These are the Network Interface Layer, the Internet Layer, the Transport Layer, and the Application Layer.
The first layer, the Network Interface Layer, corresponds to both the Physical and Data Link layers of the OSI model. It deals with how data is physically sent across the network. Ethernet, Wi-Fi, and other link-layer protocols operate here.
The second layer is the Internet Layer. It aligns with the OSI’s Network Layer. The Internet Layer routes packets between devices using the I P protocol. Common threats at this layer include I P spoofing, fragmented packet attacks, and route manipulation.
The third layer is the Transport Layer, just like in the OSI model. This layer uses TCP and UDP to deliver messages reliably or quickly, depending on the use case. This is where security controls such as port filtering, session validation, and flow control are enforced.
The fourth and final layer is the Application Layer, which combines the responsibilities of the OSI model’s Session, Presentation, and Application layers. This simplification reflects the practical reality of how most applications communicate across networks. This is where secure web communication, encrypted email, and application-based access control occur.
It’s important to note that while the TCP slash I P model is what actually governs data flow on modern networks, the OSI model provides a more granular and conceptual way to think about layered communication and security.
For more cyber-related content and books, please visit cyberauthor dot me. You'll find best-selling books, training tools, and resources tailored specifically for cybersecurity professionals. You can also explore additional episodes and exam tools at Bare Metal Cyber dot com.
Let’s now turn to how these models inform real-world security practices. When implementing encryption, for example, you might apply it at the Application Layer using Transport Layer Security, or at the Network Layer using I P Security. The choice depends on your specific goals—whether you need end-to-end encryption, link encryption, or application-specific protection.
At the Transport Layer, you may use port filtering to block unused services, or implement access control lists on routers. At the Network Layer, firewalls evaluate I P headers and control traffic between trusted and untrusted zones. At the Data Link Layer, you may deploy secure switches that defend against M A C flooding and spoofing.
Even at the Physical Layer, there are security practices. Locking network cabinets, using cable shielding to prevent signal interception, and implementing tamper-evident hardware are all part of layered defense.
It’s also critical to use intrusion detection and prevention systems at multiple layers. A host-based I D S might analyze system calls and logins at the Application Layer, while a network-based I D S monitors packet headers at the Network and Transport layers.
Security assessments must consider every layer. Are there open ports at the Transport Layer that should be closed? Is the encryption at the Presentation Layer configured correctly? Is data validated properly before reaching the Application Layer?
Now let’s talk about continuous improvement. The OSI and TCP slash I P models are not static checklists. They are living frameworks that must adapt as networks, threats, and technologies evolve.
Conduct regular audits. Review firewall rules, analyze session logs, and assess protocol configurations. Validate that encryption algorithms are current, that session management is robust, and that authentication is enforced consistently across services.
Use incident data to refine your strategy. If attackers are bypassing controls at the Application Layer, consider more strict input validation and secure development practices. If denial-of-service attacks are common at the Transport Layer, enhance your load balancing and rate-limiting controls.
Foster cross-functional collaboration. Your network engineers, system administrators, and security analysts must all understand how their tools operate across different layers. Ensure that everyone speaks the same language when planning, diagnosing, or responding to issues.
Train your staff. Many breaches occur not because the technology is weak, but because the people managing it do not fully understand how it works. Regular training in the OSI and TCP slash I P models helps keep your team sharp and aligned.
And finally, be proactive. Monitor threat intelligence, join cybersecurity forums, and track developments in emerging protocols. Understand how new applications or services change your attack surface and how they map to the layered models we’ve discussed.
Thank you for joining the CISSP Prepcast by Bare Metal Cyber. Visit baremetalcyber.com for additional episodes, comprehensive CISSP study resources, and personalized certification support. Deepen your understanding of the OSI and TCP/IP Models, and we'll consistently support your journey toward CISSP certification success.