6.1Network architectures and TCP/IP

For a Registered Information Security Specialist, network mechanics are not mere facts to memorize—they are the foundation for judging how much a given segmentation and addressing design shrinks the attack surface. Whether an internal network houses every device in one flat segment, or is split into subnets per department/criticality with ACLs and firewalls controlling traffic between them, dramatically changes the blast radius (room for lateral movement) once a breach occurs. This section covers OSI/TCP-IP fundamentals, routing, and TCP/UDP through the lens of design and security judgment.

6.1.1The OSI reference model and the TCP/IP four-layer model

• The OSI reference model divides communication functions into seven layers (physical, data link, network, transport, session, presentation, application). Separating responsibilities by layer makes interoperability between devices/protocols and fault isolation easier.
• The TCP/IP four-layer model is the simplified model widely used in practice: it merges OSI's session, presentation, and application layers into a single application layer, and combines the physical and data-link layers into the network interface layer. OSI's transport layer maps to the TCP/IP transport layer, and OSI's network layer maps to the TCP/IP internet layer.
• The practical value of understanding the layered structure is in identifying which layer an attack or countermeasure operates at. For example, firewall packet filtering operates at the network/transport layer while a WAF operates at the application layer—the scope of a countermeasure's effectiveness is determined by its layer.