The OSI Model and You Part 1: Stopping Threats on the OSI Physical Layer

What Is the OSI Seven-Layer Model?

Before we jump in, some basics for those who don’t know the model. The OSI model dates back to the mid-1970s. In a nutshell, its purpose is to serve as a common basis for system interconnection and networking, whether it is for a telecommunications or computing system. The OSI model is defined in the ISO/IEC 7498 standard. It is made up of seven layers of networking in two clusters: media (1-3) and host (4-7). The layers are:

1. Physical
2. Data Link
3. Network
4. Transport
5. Session
6. Presentation
7. Application

With that background, let’s get to the physical layer and see where the risk lays.

What Is the Physical Layer?

The OSI physical layer is where it all begins. Exactly as you’d think, it covers physical components. The physical layer covers transporting all those zeroes and ones to wherever they need to go. Therefore, the physical layer in the OSI model can include wires, cables, wireless connections, routers, endpoints, sockets, pins and all that other fun stuff. Everything you can think of in this layer often has some connected definition or standard. Those will include timing transmission distances, voltage changes, access methods and any other type of specification you could think of. Furthermore, if it is ubiquitous (think Bluetooth or USB) there is specification for it. If it’s a bit or byte and it needs to get somewhere, it’s going to be on the physical layer.

Cybersecurity Threats to the Physical Layer

Threats of all kinds can menace the physical layer: malicious insiders, malfunction or sabotage, degradation, overload, natural disaster and so on. Even the most seemingly insignificant component — like a cable — if compromised or attacked could bring down an entire system. Concurrently, the physical layer can also be your last line of defense. For example, you could be suffering a denial of service attack. In this case, your only hope to save the network is pulling the plug.

Therefore, in order to protect the physical layer, put your threat assessment and business impact analysis hats on. Find the possible trouble points. For example, check access to infrastructure, physical location to external or natural threats, recovery time and so on. Once you figure out what the business impact will be, time to shift over to risk tolerances and contingency planning. This means it is time to think about your business continuity, disaster recovery and even emergency response plans. Do you need to go offsite, for example? Do you have memorandums of understanding in place? Oh yeah, have you tested those plans? If you need some help on how to contingency plan for these threats, NIST Special Publication 800-34 Revision 1 is one of the best guides out there.

Don’t Forget the Physical Layer in OSI Model Checks

We breezed through the physical layer, as much of it should be obvious, but don’t underestimate its importance to your network and vulnerability to cyberattacks, regardless of the nature of the threat. Whether it is a disgruntled employee with some cable cutters or a bolt of lightning striking your facilities, without the physical layer, you have nothing.

We’re just getting started with the OSI layers. Next, we’ll look closer at the data link layer.

What Is the Data Link Layer in OSI Layers?

In this part of the OSI seven-layer framework, zeroes and ones can travel between physically connected points. To get technical for a moment: nodes. And for clarification here, a wireless connection — such as a computer to a router over Wi-Fi — counts as a physical connection for the purposes of the OSI layers model.

This part of the OSI data link layer governs how much data should be allowed to travel and how long it should take to travel over a certain distance. In addition, very importantly, it keeps an eye out for errors in data transmission. The data link layer is also made up of two sublayers: the Media Access Control (MAC) sublayer — the unique identifier of a device — and the Logical Link Control (LLC) sublayer — the interface between the device and the network layer, which comes next in the OSI model. Many of the specifications for this part of the OSI layers can be found in the Institute of Electrical and Electronics Engineers IEEE 802 Standard for Local and Metropolitan Area Networks. (If you ever wondered why the number 802.11 is in front of many Wi-Fi devices, now you know: it represents the device is compliant with IEEE 802, subpart 11.)

Cybersecurity Threats to the Data Link in OSI Layers

The data link layer is where malicious actors can begin to take advantage of the frame, a piece of information that is part of the transmission on this part of the OSI layers. Each frame has a header, body and trailer. If attackers can view or manipulate these frames, then they can compromise your data. This layer can also suffer from overload, degrading performance. The types of attacks you need to be concerned about here are MAC address spoofing, MAC address flooding, virtual local area network (LAN) circumvention and address resolution protocol poisoning.

Reducing Threats to the Seven Layers of Networking

To reduce vulnerability at this section of the OSI layers, have a ‘batten down the hatch’ type mentality, where you should expect a storm. And the best way to prepare for that storm is by limiting control and access wherever possible. There are a few ways to do that.

One of the best ways is encryption. Some protocols may be inherently insecure, so you fill that gap through encryption. If you are unsure of what encryption method is right for you, you cannot go wrong by spending some time reviewing NIST Special Publication 800-175B Revision 1.

Two other simple and effective techniques for securing the data link section of the OSI layers are disabling ports, therefore denying access, and enabling MAC address filtering. If you’re not on the guest list, sorry, you can’t join the party (or network). You also want to prevent virtual LAN (VLAN) hopping, a way an attacker sneaks their way into the party. This is a more sophisticated way to attack the data link layer, but it still can happen. Misconfigurations and poor VLAN implementation are normally the cause of this vulnerability.

Keeping these techniques in mind will help lock down this layer. In the next piece, we will talk about how to secure the next of the OSI layers, the network layer.

Now, the OSI network layer is where the rubber really starts to hit the road. The data packets now get traveling. Think of it like this: the data link layer is node-to-node, whereas the network layer is network-to-network, and even through networks. The key to making this layer work is the router.

What is the OSI Network Layer?

You can also think of the network layer as the guide and traffic operator. It tells all the data packets where to go. Once data comes into the OSI network layer, an internet protocol (IP) address is added. Now, the data packet knows where to go. And the routers are what keep track and manage all the traffic. There are different ways to manage the traffic, also known as protocols, such as IPv4 and IPv6.  Without the network layer, the zeroes and ones can’t get anywhere.

Cybersecurity Threats to the OSI Network Layer

Malicious actors can attack the network layer through overloading the network, spoofing and sniffing. Let’s begin with overloading a network. An attacker can do this through denial of service (DoS) attacks, such as a ping flood. When an attacker knows which IP addresses are associated with a target network, they will send an internet control message protocol ping — or echo — repeatedly to overload the part or the entire network. This means an attacker can attack a single endpoint or a router to disrupt all communication.

Another method of attack is IP spoofing. Often used for distributed DoS attacks (DDoS), an attacker will alter the source IP in the header. IP spoofing is pretty much standard now for DDoS malware kits.

Finally, attackers can impact the OSI network layer through IP and port sniffing. IP and port sniffing allows an attacker to perform reconnaissance and learn more about a user through packet analysis. If the connection is not secured (think encryption) a malicious actor can steal valuable information.

In other words, it is not all too uncommon to see man-in-the-middle attacks happen at the OSI network layer level.

Using Firewalls in the OSI Network Layer

To prevent against these attacks, use of firewalls is critical. Firewall usage these days is pretty much a given, though future use of firewalls is up for debate on account of new cloud security technologies. Also, do not be surprised if a firewall gets overloaded during these types of attacks.

Similarly, a firewall technique that can reduce risk is packet filtering. This technique only allows incoming packets to pass based on the source and destination IP addresses and protocols. Finally, take a look at another related technique called anti-spoofing. A firewall will block a packet if the IP address is wrong, falsified or otherwise spoofed. All of the above seems relatively straightforward, but configuration is critical to success.

The Next Stop on the Journey

Collectively, the first three OSI layers — physical, data link and network layers — make up the ‘media’ portion of the OSI model. In the next piece, we will look at the first of the ‘host’ layers, the transport layer.

What Is the OSI Transport Layer?

The Transport Layer outlines the functions and protocols for transferring variable-length data sequences between the source and the host. That means that since data has different sizes and is broken up into packets, some rules are in place on how to do that. Two types of protocols are often associated with the OSI model, the Transmission Control Protocol (TCP) and User Datagram Protocol (UDP). The quick distinction between the two is that TCP prioritizes data quality over speed. Meanwhile, UDP is a connectionless protocol that prioritizes speed over quality.

Cybersecurity Threats to the OSI Transport Layer

Despite being a ‘host’ layer, the transport layer is prone to some of the threats to the previous ‘media’ layers. This is another place to expect sniffing, specifically related to ports and protocols. Distributed denial of services (DDoS) attacks can also strike the transport layer. In particular, two types of attacks common to the OSI transport layer are SYN floods and Smurf attacks. In an SYN flood, an attacker initiates many connections to a server using a spoofed IP address, not waiting for a connection to finalize. Smurf attacks use malware to overload network resources. The attacker broadcasts Internet Control Message Protocol echoes, resulting in an infinite loop of requests.

Therefore, you really want to limit access on the OSI transport layer. Lock down your ports, configure your firewalls for only what is needed and gate access to your transmission protocols.

Attackers Scouting Layers

There is also another issue to consider in the transport layer. It is a great place for a malicious actor to do reconnaissance. They may not attack you directly on the transport layer unless they intend to inflict a DDoS attack on you. However, the actor can learn a lot about how to get into your environment, especially the commonly-targeted session layer.

Reliability on the OSI transport layer is crucial. There is a lot going on in this layer because all the packets move around. As a side note, we often refer to packets as segments or datagrams on the transport layer, based on protocol used. If this layer does not segment and reassemble the packets correctly, performance may suffer. That means the OSI transport layer needs to be as error-free as possible. This is also why it performs error control as well. If errors are happening here, communication between hosts will get messy.

In the next piece, we will look at the session layer, which introduces some different naming. What we’ve been calling segments or datagrams, we’ll now refer to simply as ‘data’ as they move through. With different layers seeing different threats, it’s important to cover all of them thoroughly.