hey everyone welcome back to cyber gray matter before we start I just want to thank everyone for helping me get to the 1000 subscriber Mark and I truly appreciate the support today we'll be doing a security Focus video with a fun Twist on the seven layers of the OSI model we'll be discussing the attacks that happen with each layer along with how to mitigate them and some common protocols associated with each layer networking has been called a cheat code when learning about cyber security and having a solid foundation is the best way to maneuver around
when picking up the basics of the field that's why the concept of explaining the OSI model in conjunction with these types of attacks will be more exciting than just being told what each layer means I'm not the first one to do this and others before me have made their own versions with examples online from places like Reddit which will be linked down below I hope to help you visualize each layer and have something meaningful and exciting Associated to help you remember let's get into it so what's the OSI model the OSI model stands for the
open systems interconnection model and at the most basic form it contains seven layers at which the framework describes and explains the functions of the network the layers starting from the bottom are physical data link Network transport session presentation and application two mnemonic devices to remember this are from the top down all people seem to need data processing and from the bottom up please do not throw sausage pizza away let's start with layer one the physical layer this layer deals with a bit level transmission between devices and is the foundation of all higher level functions of
the OSI model the Slayer can involve the transmission of data via cables and wires cards and antennas it's good to remember that this is not the cables themselves but rather the signals some protocols for the physical layer are Bluetooth USB and IEEE 802.11 which are the set of local area Network technical standards also known as LAN physical layer attacks will cause disruption such as a denial of service or dos attack threats include environmental issues that can occur whether this be a natural disaster or a server room fire along with humidity and temperature issues Access Control
such as having someone who is an authorized access making their way into a server room in this case an attacker could create a man in the middle attack and sniff the packets going across the wire or cause General destruction ways to mitigate these environmental issues can't be stopped but having backup plans during an emergency can help businesses get up and running quickly as for Access Control having locks on server rooms can prevent unauthorized access and prevent those man in the middle attacks next is layer 2 which is the data link layer which is the protocol
layer that can transfer data between adjacent Networks switches are physical devices that operate at this layer it's made up of two sub-layers which include the Mac or media Access Control sub-layer in The Logical link control or LLC sublayer its main functions are to handle problems that occur as a result of bit transmission errors ensure data Flows at a pace that doesn't overwhelm sending and receiving devices and permits the transmission of data to the layer 3 Network layer where it will be addressed and routed common Protocols are address resolution protocol Eeps which is used to create
fault tolerance when configuring a primary and secondary path for each VLAN and IEEE 802.11 which is wireless LAN like in the layer 1 physical layer some threats and attacks are ARP spoofing which allows the attacker to masquerade as a legitimate host and then intercept the data on the network these will affect upper layer security and can be a starting point for other attacks such as man in the middle session hijacking or denial of service Mac flooding is also an attack which is directed at the switch and it's when the Mac table of the switch reaches
its capacity and then floods attackers use this by using forged art packets configurations can be done to prevent the Mac flooding with Port security an ARP spoofing can be prevented by using a static ARP an IDs or intrusion detection system that detects high amounts of ARP traffic and lastly Dynamic ARP inspection layer 3 is the network layer layer 3 uses common protocols and performs routing on the network once the data comes on and the IP address is added it's the layer that tells the data where to go on the network common Protocols are icmp ipv4
and IPv6 in the security protocol ipsec IP spoofing is one attack and it's used to complete a Dos or a DDOS attack where the IP in the header is spoofed due to the source IP being altered one way to mitigate this is through packet filtering with the use of a firewall that will block a packet when the IP address is wrong or spoofed layer 4 is the transport layer this layer involves end-to-end control and transporting data between the source and the host the two most important protocols on this layer are TCP and UDP an attack
on the transport layer is a type of DDOS attack known as a syn flood or half open attack this exploits the TCP handshake where an attacker will make many connection attempts with a spoofed IP address without allowing the connection to finalize mitigating sinful attacks can be done by enabling firewall filtering and sin cookies which can help drop the unnecessary requests that aren't legitimate layer 5 is a session layer the sessions layer's responsibility is to sync up everything for Action in order to view a web page the user has to establish a connection to the web
server this layer creates manages accepts opens and closes these sessions both security and performance is important for this layer common Protocols are net bios Pap or password Authentication Protocol and smpp which is short message peer-to-peer attacks for the session layer include things like session hijacking and this is where there's an attack on a user session an attacker will hijack and compromise the token by taking a guess on what the authentic token session will be this can be done through cross-site scripting cookie theft and Brute Force attempts ways to mitigate this are through https that ensures
encryption preventing access to cookies from client-side scripts and key regeneration after authentication has been established the presentation layer is the sixth layer of the OSI model and it's also known as the translation layer it serves as a data translator for the network a way to better understand this is that this is the layer where the machine readable code gets translated into something that the end user can use for the application layer in the presentation layer formatting conversion and encryption can happen some protocols found at the presentation layer include SSL which is secure socket layer protocol
AFP which is the Apple filing protocol and NCP or network core protocol some attacks for the presentation layer are things like SSL hijacking where the threat actor takes advantage of encryption flaws and exploits them in the case of malware already being present on the machine a threat actor will start a man-in-the-middle attack where a proxy could be used as a fraudulent certificate Authority the browser would then trust the certificate and the threat actor will read all of the messages in order to mitigate this make sure your antivirus is up to date and use the more
secure version of HTTP which is https the last layer is layer 7 or the application layer the application layer is what the end user interacts with and sees this includes mail web browser software and anything that the user sees on their screen now the applications themselves may not be part of this layer but the services are some of the main Protocols are BitTorrent which is peer-to-peer file sharing mime and also s mime which is multi-purpose internet mail extensions in Secure mime and SMB or server message block there are many threats to the application layer with
the attack surface being so big including various types of malware such as worms key loggers Trojans and viruses one of the most prevalent attacks are various DDOS attacks and one being a low and slow DDOS attack often used with the slow lorus tool some signs of this can be identified by performing a network behavioral analysis to get a Baseline and then comparing it to a time when the attack may be occurring these are hard to detect since they appear to be legitimate traffic and they can also be launched from a single computer mitigation of these
attacks can be done with DDOS mitigation systems or idms that run the key applications that need to be protected and tune this to protect other applications or servers running behind them now that we've gone through each layer and the associated attacks I hope you have a better understanding of the OSI model and can visualize it a little better now thanks for watching please leave a like and any questions or suggestions down in the comment section below thanks
