OSI Model

Layers

Layer 1: Physical

This layer transmits raw bit streams (1s and 0s) over physical hardware like cables (fiber/copper), hubs, and repeaters. It does not read data; it simply moves electricity or light.

Security Focus: Risks here are physical, such as wiretapping, theft of devices, or cutting cables.

Layer 2: Data Link Layer

This layer organizes bits into frames and handles node-to-node transfer using MAC addresses and switches. It is responsible for error detection and local delivery on the same network segment.

Security Focus: Common attacks include MAC flooding, ARP poisoning, and VLAN hopping.

Layer 3: Network Layer

This layer uses logical addressing (IP addresses) to route packets across different networks using routers. It determines the best path for data to travel to its destination. Security Focus: This is where firewalls operate (packet filtering); attacks include IP spoofing and Ping of Death.

Layer 4: Transport Layer

This layer ensures reliable end-to-end delivery, flow control, and error correction using protocols like TCP (connection-oriented) and UDP (connectionless). It breaks data into segments.

Security Focus: Attacks here often target open ports, such as SYN floods or port scanning.

Layer 5: Session Layer

This layer establishes, maintains, and terminates connections (sessions) between applications on different devices. It acts as the "traffic cop" for the conversation, ensuring data is synced.

Security Focus: Vulnerable to Session Hijacking (Man-in-the-Middle) attacks where an attacker takes over an active connection.

Layer 6: Presentation Layer

This layer translates and formats data so the application layer can understand it, handling encryption, decryption, and compression (e.g., JPEG, ASCII). It ensures data is in a readable format.

Security Focus: Attacks here can involve injecting malicious code into file formats (like images) or SSL stripping.

Layer 7: Application Layer

This is the interface that users interact with directly, enabling network services like web browsing (HTTP), email (SMTP), and file transfer (FTP).

Security Focus: This is the most attacked layer; threats include SQL Injection, Cross-Site Scripting (XSS), and malware.