3.1 Network Architecture & The OSI/TCP-IP Models

3.1 Network Architecture & The OSI/TCP-IP Models

Quick Summary: Network security architecture relies on structured, layered design patterns to minimize attack surfaces and isolate critical assets. Essential architectural concepts include protocol stack layering (OSI 7-Layer vs. TCP/IP 4-Layer models), Protocol Data Unit (PDU) encapsulation mechanics, enterprise hierarchical topologies (Core, Distribution, and Access layers), physical network design patterns, and layer-specific security enforcement boundaries.

Building a resilient defensive posture requires a deep technical understanding of how networks format, encapsulate, route, and deliver data packets across interconnected systems. Security is not a single gateway or device; it is an architectural framework that enforces policy, controls traffic flow, and isolates failure domains across every layer of the network. When security analysts investigate alerts, configure firewall rules, or analyze raw packet captures in Wireshark, they evaluate network behavior relative to standard layering models.

1. Network Layering Models: OSI vs. TCP/IP

Network communications rely on standardized protocol stack models that define how data is formatted, addressed, transmitted, routed, and received across interconnected systems. Cybersecurity professionals analyze network traffic and deploy defensive controls relative to these architectural layers.

The OSI 7-Layer Reference Model

The Open Systems Interconnection (OSI) reference model, defined by ISO/IEC 7498-1, breaks network communication into seven distinct conceptual layers. As data moves down the stack on a sending system, each layer appends its own control header in a process called encapsulation. On the receiving system, the process is reversed via decapsulation as each layer strips its corresponding header.

The TCP/IP 4-Layer Model

While the OSI model serves as the primary theoretical framework, the TCP/IP model (RFC 1122) represents the practical architectural stack of the modern Internet. It condenses the top three OSI layers into a single Application layer and combines the bottom two layers into Network Access:

1. Application Layer (OSI Layers 5–7): Encompasses HTTP, HTTPS, SSH, Telnet, FTP, DNS, SNMP, and SMTP. Focuses on application processes and data formatting.
2. Transport Layer (OSI Layer 4): Features Transmission Control Protocol (TCP - connection-oriented, reliable, sequenced via 3-way SYN/SYN-ACK/ACK handshakes) and User Datagram Protocol (UDP - connectionless, lightweight, low-latency execution).
3. Internet Layer (OSI Layer 3): Handles Internet Protocol (IPv4/IPv6), ICMP (Control Message Protocol), ARP (Address Resolution Protocol), and routing protocols (OSPF, BGP, EIGRP).
4. Network Access Layer (OSI Layers 1–2): Manages physical media framing, Ethernet (IEEE 802.3), Wi-Fi (IEEE 802.11), and MAC hardware addressing.

2. Enterprise Network Topologies & Hierarchical Design

Network topology defines how nodes, devices, and links are arranged physically and logically. Modern enterprise security relies heavily on structured, multi-tier topologies to manage traffic flows and isolate compromise.

Physical and Logical Topologies

• Star Topology: Central switch connects all endpoints independently. Highly manageable; single cable or port failures affect only the connected node. Standard design for modern local area networks (LANs).
• Mesh Topology (Full vs. Partial): Nodes connect directly to multiple other nodes. Full mesh offers maximum redundancy requiring $N(N-1)/2$ physical links for $N$ devices. Essential for critical core routers and high-availability data center interconnects, but carries high infrastructure and cabling costs.
• Bus Topology: Legacy single cable backbone shared by all devices. Vulnerable to complete network collapse if the main trunk breaks; susceptible to packet sniffing.
• Ring Topology: Nodes connect in a closed loop (e.g., Token Ring, FDDI). Token passing eliminates collisions, but single node failures disrupt the entire ring unless dual-ring architecture is deployed.
• Hybrid Topology: Combines star, mesh, and tree structures to balance scalability, link redundancy, and infrastructure cost across large enterprise campuses.

The Cisco 3-Tier Hierarchical Model

To prevent network congestion, manage broadcast domains, and establish strict security enforcement zones, enterprise networks utilize Cisco's three-tier hierarchical architecture:

1. Core Layer (Backbone): Connects distribution-layer devices across campuses. Optimized strictly for high-speed, low-latency packet switching. Security controls at this layer are kept minimal (e.g., core routing protocols like OSPF with MD5/SHA authentication) to avoid processing bottlenecks.
2. Distribution Layer (Aggregation): Serves as the boundary between Access and Core layers. Performs inter-VLAN routing, quality of service (QoS), boundary filtering, and access control list (ACL) policy enforcement. This is a primary security boundary where network segmentation rules are applied.
3. Access Layer (Workstation Edge): Grants end-user devices, printers, and IP phones access to the network. Implements Layer 2 security controls including IEEE 802.1X port-based authentication, switch port security, DHCP snooping, and Dynamic ARP Inspection (DAI).

Note on Collapsed Core Architecture: In smaller networks, the Core and Distribution layers are merged into a single multi-layer switch framework to reduce hardware expenses while maintaining Access layer separation.

3. Layer-Specific Security Enforcement & Protocol Data Units

Understanding how PDUs transition across the protocol stack allows security technicians to place security controls precisely where threats manifest.

Encapsulation and Decapsulation Mechanics

When an application sends data (e.g., an HTTP web request), data travels down the OSI stack:

1. Application / Presentation / Session Layers: Raw user data is generated and formatted (Data PDU).
2. Transport Layer: TCP or UDP appends source and destination port numbers (Segment / Datagram PDU).
3. Network Layer: IP appends source and destination IP addresses (Packet PDU).
4. Data Link Layer: Ethernet appends source and destination MAC hardware addresses and a Frame Check Sequence (FCS) trailer (Frame PDU).
5. Physical Layer: The frame is converted into electrical voltages, optical light pulses, or RF radio waves (Bits).

Mapping Defensive Controls to OSI Layers

Security defense-in-depth requires enforcing controls across all layers:

• Layer 1 (Physical): Cable conduit armoring, locking server racks, port plugs, RF Faraday shielding.
• Layer 2 (Data Link): IEEE 802.1X port authentication, switch port security (Sticky MAC), VLAN tagging (802.1Q), DHCP Snooping, Dynamic ARP Inspection (DAI).
• Layer 3 (Network): Router Access Control Lists (ACLs), IPsec VPN encryption (AH/ESP), disablement of ICMP redirects.
• Layer 4 (Transport): Stateful inspection firewalls tracking TCP 3-way handshakes (SYN, SYN-ACK, ACK), port filtering.
• Layer 7 (Application): Web Application Firewalls (WAF), TLS 1.3 decryption, deep packet inspection, DNSSEC, email spam filtering.

Scenario Example: Defense-in-Depth in Action

Consider an external attacker attempting to exploit a database server behind an enterprise web application:

1. At Layer 3, perimeter router ACLs drop unauthorized ICMP scanning traffic.
2. At Layer 4, stateful firewalls permit incoming TCP connections strictly on port 443 (HTTPS), blocking all unapproved ports.
3. At Layer 7, a Web Application Firewall (WAF) inspects the decrypted HTTPS payload to intercept SQL injection payloads before reaching the web server.
4. At Layer 2, internal switch port security prevents the attacker from executing ARP poisoning to intercept server traffic if an edge web host becomes compromised.