D4 — Secure Network Architecture & Protocols
The OSI model read as a security map, why segmentation exists beyond performance, the secure-protocol replacements for every legacy insecure one, and ARP poisoning as the canonical layer-2 attack — the domain where Nginx/Cloudflare experience maps almost directly onto CBK vocabulary.
Learning Objectives
- → Map common network attacks and controls to the correct OSI layer
- → Explain network segmentation's security purpose (blast-radius reduction), not just its performance benefit
- → Identify the secure protocol replacement for a given insecure legacy protocol
- → Apply the CISSP mindset to a network architecture decision, prioritizing exposure reduction over convenience
If you've tuned Nginx, configured Cloudflare rules, or triaged a DDoS attack, you already have strong intuition for this domain — this lesson maps that intuition onto the specific vocabulary and layer-by-layer reasoning CISSP expects.
The OSI model, read as a security map
CISSP doesn't test the OSI model as trivia — it tests whether you can place an attack or control at the correct layer, because the right defense usually lives at the same layer as the attack:
| Layer | What lives here | Representative attack | Representative control |
|---|---|---|---|
| 2 — Data Link | MAC addresses, switching, ARP | ARP poisoning, MAC flooding | Dynamic ARP Inspection, port security |
| 3 — Network | IP addressing, routing | IP spoofing, routing manipulation | Ingress/egress filtering, RPF checks |
| 4 — Transport | TCP/UDP, sessions | SYN flood, session hijacking | SYN cookies, stateful firewalls |
| 7 — Application | HTTP, DNS, actual application logic | SQL injection, DNS spoofing | WAF, input validation, DNSSEC |
The exam-relevant point: a Layer 7 control (a WAF) does nothing against a Layer 2 attack (ARP poisoning), and vice versa. A scenario question describing a specific attack is testing whether you reach for the control at the matching layer, not just any plausible-sounding security tool.
Worked example — ARP poisoning: an attacker on the same LAN sends unsolicited ARP replies mapping the default gateway's IP to their own MAC address. Traffic destined for the internet now flows through the attacker (a classic Layer 2 man-in-the-middle). DNSSEC does nothing here — it protects Layer 7 DNS resolution, not Layer 2 address mapping. The correct control is Dynamic ARP Inspection (DAI) combined with DHCP snooping: DHCP snooping builds a trusted binding table of legitimate IP-to-MAC-to-port mappings, and DAI validates incoming ARP traffic against that table, dropping forged replies.
Segmentation: a security purpose, not just a performance one
Network segmentation (VLANs, subnets, microsegmentation) is often introduced for performance or organizational tidiness, but its security purpose is blast-radius reduction: if an attacker compromises one host, segmentation limits how far they can move laterally before hitting a boundary that requires a fresh compromise to cross. A flat network — every host able to reach every other host — means a single compromised workstation is a stepping stone to everything. This is also the foundation of zero trust architecture: instead of trusting anything already "inside" a perimeter, every request is authenticated and authorized regardless of network location, treating the internal network as no more inherently trustworthy than the internet.
Secure protocol replacements
CISSP expects you to know the secure replacement for each common legacy insecure protocol:
| Insecure | Secure replacement | What's fixed |
|---|---|---|
| Telnet | SSH | Encrypted session instead of plaintext credentials/commands |
| FTP | SFTP / FTPS | Encrypted file transfer and authentication |
| HTTP | HTTPS (TLS) | Encrypted, integrity-protected transport |
| SNMP v1/v2c | SNMP v3 | Authentication and encryption for device management |
The CISSP mindset: manager vs technician
A team proposes flattening two previously segmented network zones to simplify a deployment pipeline and reduce latency between services.
The technician answer: approve it — fewer hops, simpler routing, faster deployments, and nothing in the immediate requirements is technically broken by removing the boundary.
The manager (CISSP) answer: evaluate what compromise scenario the segmentation boundary was containing before agreeing to remove it. If one zone handles less-trusted, internet-facing traffic and the other holds sensitive internal services, flattening them doesn't just simplify routing — it also removes a lateral-movement barrier, meaning a single compromised internet-facing host now has a direct path to sensitive internal systems. The convenience gain and the blast-radius increase are both real; the CISSP-correct response weighs that trade-off explicitly (echoing Lesson 2's cost-benefit framing) rather than approving based on deployment convenience alone.
A security team detects TCP SYN packets flooding a web server's connection queue from thousands of spoofed source IPs, exhausting the server's ability to accept legitimate connections. Which OSI layer does this attack target, and which control specifically addresses it?
Which OSI layer does this attack target, and which control addresses it?
A company's guest WiFi network and its internal engineering network currently share the same VLAN 'for simplicity.' Explain, in terms of blast radius, what specific risk this creates, and what change would address it.
What risk does sharing the VLAN create, and what change addresses it?
An internal audit finds that a legacy device management interface still uses Telnet and SNMP v1 for remote administration. What should each be replaced with, and what specific security property does each replacement add?
What should Telnet and SNMP v1 be replaced with, and what does each replacement add?