5.1. Network Architecture Fundamentals
💡 First Principle: Every network protocol exists at a specific layer of the OSI model, performing a defined function and handing off to the layers above and below it. Understanding which layer a protocol operates at immediately tells you what security properties it can and cannot provide — and which attacks target it. A Layer 3 control cannot protect against a Layer 2 attack; a Layer 4 firewall cannot inspect Layer 7 application content.
The OSI model is not just academic history — it is the mental framework that allows security architects to precisely locate vulnerabilities, controls, and attack vectors within a networking stack. Every penetration tester, every network analyst, and every security architect thinks in layers.
Why this matters: Protocol classification by OSI layer is directly tested. More importantly, exam questions about which control addresses which attack require understanding the layer relationship: "An attacker is performing ARP spoofing. At which OSI layer does this attack occur, and which control addresses it?"
⚠️ Common Misconception: "Air gaps prevent all remote attacks." Air gaps prevent direct network attacks. They do not prevent supply chain attacks (compromised hardware delivered with malware), removable media attacks (malicious USB), RF-based attacks (electromagnetic emanation interception via TEMPEST), or insider threats. Air gaps change the attack surface; they do not eliminate it.
