Communication and Network Security · Topic 1 of 3
Network Models and Secure Protocols
The OSI and TCP/IP models, IPv4 and IPv6, secure protocol choices, converged protocols and typical attacks at each layer for the CISSP exam.
- 3 min
- Map protocols and attacks to OSI layers.
- Prefer SSH, HTTPS, SFTP, SNMPv3, LDAPS and DNSSEC.
- AH: integrity only; ESP: encryption and integrity; tunnel mode for site VPNs.
What it is
Network models describe how communication is split into layers. They help you place a protocol, a device or an attack, and choose the control that works at the right layer. The exam expects you to map protocols and threats to layers and to pick secure protocols over insecure ones.
How it works
OSI and TCP/IP
| OSI layer | TCP/IP layer | Examples | Typical threats |
|---|---|---|---|
| 7 Application | Application | HTTP, DNS, SMTP | Injection, phishing |
| 6 Presentation | Application | Encoding, compression | Malformed data |
| 5 Session | Application | Session management | Session hijacking |
| 4 Transport | Transport | TCP, UDP | SYN floods, port scans |
| 3 Network | Internet | IP, ICMP, routing | IP spoofing, route manipulation |
| 2 Data link | Network access | Ethernet, MAC, switches, ARP | ARP poisoning, MAC flooding, VLAN hopping |
| 1 Physical | Network access | Cables, radio | Tapping, jamming |
TLS sits between transport and application. IPsec works at the network layer.
IPv4 and IPv6
| Topic | IPv4 | IPv6 |
|---|---|---|
| Address size | 32-bit | 128-bit |
| Address shortage handling | NAT and private ranges | Large address space, NAT not needed |
| IPsec | Optional add-on | Designed in, though use is still optional |
| Security considerations | Mature tooling | Dual-stack networks need equal controls; unmanaged tunnels can bypass filters |
If IPv6 is enabled but not monitored or filtered, attackers can use it to bypass IPv4-only controls. Manage both or disable what you do not use.
Secure protocol choices
| Insecure | Secure replacement |
|---|---|
| Telnet | SSH |
| FTP | SFTP or FTPS |
| HTTP | HTTPS (TLS) |
| SNMPv1 and v2c | SNMPv3 |
| LDAP | LDAPS or LDAP with StartTLS |
| DNS without validation | DNSSEC for integrity; DNS over HTTPS or TLS for privacy |
| Plain email transfer | SMTP with TLS; S/MIME or PGP for end-to-end protection |
IPsec
| Component | Function |
|---|---|
| AH (Authentication Header) | Integrity and origin authentication, no encryption |
| ESP (Encapsulating Security Payload) | Encryption plus integrity |
| IKE | Negotiates keys and security associations |
| Transport mode | Protects the payload; host to host |
| Tunnel mode | Protects the whole original packet; gateway to gateway (site VPNs) |
Converged protocols
Converged protocols carry specialized traffic over standard IP networks: iSCSI (storage over IP), Fibre Channel over Ethernet, VoIP, and industrial protocols carried over IP. Convergence saves cost but brings IP's threats to systems that were once isolated, so segment and protect them.
Common network attacks
| Attack | Description | Defense |
|---|---|---|
| ARP poisoning | Fake ARP replies redirect traffic | Dynamic ARP inspection, static entries for critical hosts |
| DNS poisoning | False DNS records | DNSSEC, secure resolvers |
| SYN flood | Half-open connections exhaust resources | SYN cookies, rate limiting, DDoS protection |
| VLAN hopping | Reach another VLAN via trunk tricks | Disable auto-trunking, change native VLAN |
| On-path (MITM) | Intercept traffic | Encryption with authentication |
How the exam asks about this
- "Replace Telnet for remote administration." SSH.
- "Which IPsec mode protects the entire original packet between gateways?" Tunnel mode.
- "At which OSI layer does ARP poisoning occur?" Layer 2.
What to remember for the exam
- Map protocols and attacks to OSI layers.
- Prefer SSH, HTTPS, SFTP, SNMPv3, LDAPS and DNSSEC.
- AH: integrity only; ESP: encryption and integrity; tunnel mode for site VPNs.
- Manage IPv6 as carefully as IPv4.
- Converged protocols need segmentation and protection.
AH does not encrypt. If confidentiality is required, ESP is needed.
Common mistakes
Choosing AH for confidentiality.
Leaving IPv6 enabled but unmonitored.
Putting storage protocols such as iSCSI on the general user network.
Check yourself
Which IPsec protocol provides encryption?
ESP (Encapsulating Security Payload).
What is the secure replacement for SNMPv2c?
SNMPv3.
At which OSI layer do routers and IP operate?
Layer 3, the network layer.
Topic 1 of 3 in Communication and Network Security
Test yourself on Communication and Network Security
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.