Networking › Module 1 › Lesson 1
OSI 7 Layers Explained
Master the OSI model layers and why each one matters for security analysts
Opening
Every breach travels through layers
When you open a website, send an email, or get phished, data does not magically jump from your laptop to a server. It passes through seven logical layers called the OSI model. Security professionals use this model to pinpoint where attacks happen—wire taps at Layer 1, ARP spoofing at Layer 2, routing attacks at Layer 3, port scans at Layer 4, and malware downloads at Layer 7.
1. What Is the OSI Model?
The Open Systems Interconnection (OSI) model is a reference framework that breaks network communication into seven layers. Each layer has a specific job. Higher layers depend on lower layers, like building floors—you cannot have a roof without walls.
2. The 7 Layers (Bottom to Top)
Memorize them with: Please Do Not Throw Sausage Pizza Away
Layer 1 — Physical
Cables, Wi-Fi radio waves, fiber optics, and electrical signals. Security angle: tap the wire, swap a cable, or jam wireless signals. Physical access is king.
Layer 2 — Data Link
Frames move between devices on the same local network (MAC addresses, switches). Security angle: ARP spoofing, MAC flooding, and VLAN hopping target this layer.
Layer 3 — Network
Packets route across networks using IP addresses. Routers live here. Security angle: IP spoofing, ICMP attacks, and rogue routing changes.
Layer 4 — Transport
End-to-end delivery with TCP (reliable) or UDP (fast). Ports identify services. Security angle: port scanning, SYN floods, and session hijacking.
Layer 5 — Session
Manages conversations between applications—who talks when, and for how long. Security angle: session fixation and hijacking if tokens are weak.
Layer 6 — Presentation
Formats data: encryption, compression, encoding (like SSL/TLS handoff concepts). Security angle: weak encryption or improper certificate handling.
Layer 7 — Application
What users interact with: HTTP, DNS, email, FTP. Security angle: phishing, SQL injection, malware downloads—most headline attacks live here.
3. Why Security Teams Care
When an incident responder asks "where did this happen?", the OSI model gives a shared language. A firewall rule might block Layer 4 ports. An IDS watches Layer 3–7 traffic. A SOC analyst reading Wireshark needs to know whether suspicious activity is a frame problem (L2) or an application exploit (L7).
You do not need to be a network engineer
Focus on Layers 3, 4, and 7 first—they cover most day-to-day security work. Layers 5 and 6 are often folded into Layer 7 in real-world discussions, but exams still love all seven.
Knowledge Check
Which OSI layer handles IP addressing and routing between networks?
Multiple choice
Knowledge Check
Port scanning and SYN floods are primarily associated with which layer?
Multiple choice
Knowledge Check
True or False: Most user-facing attacks like phishing and web exploits target Layer 7.
True or False