Security and Threats Across the 7 Layers of the OSI Model

Introduction

Most people learn the OSI model to pass networking exams. They memorize seven layers, recite protocols, and move on. But attackers don't see the OSI model as a classroom diagram, they see it as a map. Every layer performs a specific function, and every function introduces opportunities for exploitation. Understanding those opportunities is what makes someone who knows networking from someone who understands cybersecurity.Every communication on the internet passes through these seven layers. Attackers only need one weak layer to begin their attack.

Here's the part most teams get wrong: security budgets, tools, and attention are almost always poured into Layers 3 through 7; firewalls, WAFs, TLS certificates, MFA prompts. Meanwhile, Layers 1 and 2 sit quietly underneath, under-monitored and under-funded. But a network is only as strong as its weakest layer. Compromise any single one, even the "boring" ones at the bottom and everything built on top of it inherits that compromise.

Below is a breakdown of what each layer actually does, the threats it's known for, and how it's typically defended, followed by a short story showing how a single compromise at the bottom of the stack can flow all the way to the top.

The Seven OSI Model

Layer 7 (Application Layer): This is where users directly interact with the network through protocols operating on standardized ports such as HTTP (80) for unencrypted web traffic, HTTPS (443) which relies on digital certificates to encrypt sessions, DNS (53), and SSH (22). Because this layer bridges human interaction and network communications, choosing secure protocols is critical: legacy standards like Telnet (23) transmit unencrypted plain text, making modern encrypted alternatives like SSH essential, just as HTTPS is necessary for safe browsing. Meanwhile, common attacks including; phishing, SQL injection, XSS, and broken authentication to exploit human trust and software vulnerabilities. Defending Layer 7 requires a blend of encrypted protocol choices, technical controls like Web Application Firewalls (WAF), MFA, and secure coding, alongside email authentication standards like SPF, DKIM, and DMARC (ports 25/587 for SMTP).

Layer 6 (Presentation Layer): This layer handles data formatting, character encoding (ASCII, Unicode), file structures (JPEG, MPEG), compression, and encryption — ensuring that systems with different architectures can interpret transmitted information. It is where Transport Layer Security (TLS) operates to encrypt application data, transforming plain text like HTTP into encrypted HTTPS using keys managed through Public Key Infrastructure (PKI). Because legacy protocols (SSLv2/v3, TLS 1.0/1.1) contain known cryptographic flaws, modern networks must enforce TLS 1.2 or 1.3 to defend against threats like SSL stripping (which secretly downgrades HTTPS connections to unencrypted HTTP), weak cipher exploits, and malicious malformed files designed to crash parser applications. Securing this layer requires disabling outdated protocol versions and ciphers, managing certificates properly, and implementing HTTP Strict Transport Security (HSTS) to force browsers to maintain encrypted connections.

Layer 5 (the Session layer): establishes, manages, and terminates ongoing communications or "sessions" between endpoints, ensuring separate data exchanges remain distinct using mechanisms like session tokens and HTTP cookies (which store state in stateless web protocols). Because a session token acts as a temporary key that bypasses passwords and MFA once issued, this layer is heavily targeted by attackers through session hijacking (stealing valid tokens), session fixation (forcing known session IDs onto victims), and replay attacks (resending captured requests). Defending Layer 5 requires strict session management: setting short token expiration windows, enforcing secure and Httponly cookie flags to prevent script-based theft, binding sessions to device or IP attributes, and requiring re-authentication for high-risk operations.

Layer 4 (Transport Layer): manages end-to-end communication and traffic reliability using TCP (connection-oriented with a 3-way handshake) and UDP (stateless, connectionless) operating over distinct service ports like HTTP/HTTPS (80/443), DNS (53), and SSH (22). Because TCP reserves state table resources awaiting completion of its handshake, it is inherently vulnerable to SYN flood denial-of-service attacks; conversely, UDP's stateless nature allows attackers to launch reflection and amplification attacks (e.g., abusing DNS or NTP) alongside reconnaissance port scanning. Securing Layer 4 relies on stateful firewalls, rate limiting, disabling unnecessary external UDP services, and utilizing SYN cookies to mitigate flood attacks without prematurely allocating memory.

Layer 3 (Network Layer): It handles logical IP addressing, packet routing across distinct networks, and control diagnostics via protocols like ICMP (ping), BGP, and OSPF. Because routers inherently trust exchanged routing data and packet headers, attackers manipulate this layer through IP spoofing (forging source IPs to bypass ACL filters or mask origin), ICMP-based flood/reconnaissance attacks, and internet-scale BGP hijacking (falsely announcing IP prefixes to reroute global traffic). This layer serves as the primary enforcement boundary for Next-Generation Firewalls (NGFWs), which combine traditional Layer 3 IP filtering with deep packet inspection and intrusion prevention system (IPS) capabilities. Because routers and network boundaries inherently rely on clear routing trust, defenses require anti-spoofing filters (BCP 38), Route Public Key Infrastructure (RPKI) for BGP validation, strict Access Control Lists (ACLs), VPN tunnels for secure transport, and properly deployed NGFWs to inspect and block malicious traffic moving between distinct subnets.

Layer 2 (Data Link): Manages frame delivery within a local broadcast domain using MAC addresses and resolution protocols like ARP, but its reliance on implicit trust leaves it vulnerable to severe local exploits. Attackers target this layer through ARP spoofing (man-in-the-middle interception), DHCP poisoning (deploying rogue DHCP servers or exhausting legitimate IP pools), MAC address table poisoning (flooding the switch to force traffic broadcasting), VLAN hopping (exploiting Dynamic Trunking Protocol), and STP poisoning (injecting malicious Bridge Protocol Data Units to claim the Root Bridge and alter traffic paths). Protecting Layer 2 requires aggressive switch hardening: implementing Dynamic ARP Inspection (DAI), DHCP Snooping, Port Security, explicitly disabling Dynamic Trunking Protocol (DTP) on access ports, and deploying STP guard features like BPDU Guard paired with PortFast to immediately shut down unauthorized topology changes.

Layer 1 (Physical Layer): This layer consists of the physical transmission mediums; copper cables, fiber optics, radio waves, and Network Interface Cards (NICs), converting raw electrical or optical signals into binary bits. Lacking protocol-level logic, security threats at this layer are direct and absolute: physical signal tapping, unauthorized hardware rogue drops into exposed wall jacks, physical theft of storage/devices, or power interruption. Because logical encryption can be completely bypassed if the underlying physical hardware is compromised, Layer 1 defenses depend strictly on physical and environmental controls: strict badge/biometric access, locked server racks, CCTV surveillance, disabling unused physical ports, and Uninterruptible Power Supplies (UPS).

How One Compromise Flows From Layer 1 to Layer 7

So we will just take a scenairo of attack that flows from layer 1 to layer 7; An unfamiliar face finds an unused Ethernet socket under a desk and plugs in (Layer 1). From there, ARP spoofing quietly makes his laptop the trusted gateway for everyone nearby (Layer 2) — no alarm fires, because the traffic never leaves the building. He rides that position to intercept a login session further inside the network (Layer 3–4), captures an active session token while a stripped, unencrypted connection exposes it (Layer 5–6), and finally logs into a web application as someone else entirely, walking out with the data he came for (Layer 7).Nothing exotic happened here. One unlocked door and one unmonitored switch port was enough to make every layer above it meaningless.

Defense Indepth: The principle is simple: if one control fails, another should still be standing behind it. In the scenario above, Layer 2 was the crack that mattered most not because it was sophisticated, but because nothing above it was built to question it. Every layer trusts the one beneath it. That trust is exactly what a layered defense strategy exists to protect.

Conclusion

The OSI model was built to explain how networks communicate but it doubles as a blueprint for how they fail. Every layer we've covered performs a distinct job, and every one of those jobs comes with its own assumptions: that a session token wasn't stolen, that a switch port wasn't hijacked, that a badge was actually required at the door. Security breaks down exactly at the point where one of those assumptions turns out to be false.

That's why no single tool or control is ever "the" solution. A firewall doesn't stop phishing. Encryption doesn't stop a flooded switch. MFA doesn't stop a rogue device on an unmonitored port. Real security comes from treating each layer as its own perimeter, understanding what it trusts, and defending that trust deliberately especially at Layer 2, the floor most teams still overlook.

If there's one habit worth taking from this piece, it's this: the next time you hear about a breach, ask which layer it actually happened at. That question, more than any certification or tool, is what starts to separate someone who knows networking from someone who understands security.