Network Security Basics: OSI Model, TCP/IP, Firewalls, and VPNs

The Open Systems Interconnection (OSI) model is a conceptual framework that divides network communication into seven layers. Each layer has one job and hands its work to the layer above or below it. The model is a teaching and troubleshooting tool, not a product: real networks are built on TCP/IP, but security professionals still describe problems and controls by OSI layer, which is why the CC exam expects you to recognize all seven.

A popular memory aid from bottom to top is Please Do Not Throw Sausage Pizza Away. For the exam, anchor a few layer-to-technology pairs: IP addresses and routers live at Layer 3, MAC addresses and switches at Layer 2, TCP and UDP at Layer 4, and the protocols users touch directly, such as HTTP, at Layer 7. If a question says routing, think Network layer; if it says frames or MAC address, think Data Link.

The TCP/IP model is the four-layer model that real networks actually implement. It covers the same ground as OSI but groups the layers more coarsely. The CC exam expects you to know that OSI has seven layers, TCP/IP has four, and to match one model's layers to the other's.

Two mappings do the most exam work. First, the TCP/IP Application layer absorbs the top three OSI layers, so any question about session management or data formatting still lands in the TCP/IP Application layer. Second, the Internet layer is the direct equivalent of the OSI Network layer: both mean IP addresses and routing.

At the Transport layer, remember the character of the two protocols. TCP is connection-oriented: it establishes a connection with a three-way handshake, numbers its segments, and retransmits anything lost, which suits web pages and file transfers. UDP is connectionless: it sends datagrams with no delivery guarantee, which suits speed-sensitive traffic such as DNS lookups, streaming, and voice. If a question emphasizes reliability, the answer involves TCP; if it emphasizes speed with tolerance for loss, the answer involves UDP.

Every device on an IP network needs an address so traffic can reach it. IPv4 and IPv6 are the two versions of the Internet Protocol in use today, and the exam tests the contrast between them at recognition depth.

The single most important fact is the reason IPv6 exists: the world ran out of IPv4 addresses. A 32-bit address allows only about 4.3 billion combinations, which is far fewer than the number of phones, laptops, servers, and sensors now online. IPv6's 128-bit addresses remove that ceiling permanently. Along the way, IPv6 was also designed with improvements such as built-in support for the IPsec security protocol suite and simpler address configuration, but exhaustion is the driving cause to remember.

Organizations stretched IPv4's life with Network Address Translation (NAT), which lets many internal devices share one public address by using private internal ranges. NAT is a workaround, not a fix, and both protocols now run side by side during a long transition. For the exam, lock in the numbers: IPv4 is 32-bit dotted decimal, IPv6 is 128-bit hexadecimal with colons.

An IP address gets traffic to the right device; a port number gets it to the right service on that device. Ports are 16-bit numbers carried by TCP and UDP at the Transport layer. Ports 0 through 1023 are the well-known ports, reserved for common services, and the CC exam expects you to recognize the most important ones on sight.

Notice the insecure and secure pairs, because the exam loves them: Telnet on 23 is replaced by SSH on 22, and HTTP on 80 is replaced by HTTPS on 443. A question that describes an administrator connecting to a server over an encrypted command-line session is pointing at SSH on port 22; a question about encrypted web browsing is pointing at HTTPS on 443.

Firewall rules are written in these terms. A rule such as allow TCP 443 inbound to the web server, deny everything else expresses policy as addresses plus ports. That is why port recognition matters: to read a firewall question, you must know what service each number represents.

A firewall is a security control that sits between networks and filters traffic according to a set of rules. Each rule matches attributes of the traffic, typically source and destination address, port, and protocol, and either permits or denies it. Good practice is default deny: block everything, then explicitly allow only the traffic the business needs, such as web traffic to the public web server and DNS lookups outbound.

The exam distinguishes two filtering approaches at an introductory level. A stateless firewall (a simple packet filter) examines each packet in isolation against its rule list. It has no memory: it cannot tell whether an inbound packet is a reply to a conversation your side started or an unsolicited probe, so its rules must clumsily allow broad categories of return traffic. A stateful firewall keeps a state table of active connections. When an inside host opens a session to a website, the firewall records it, automatically allows the matching return traffic, and drops inbound packets that belong to no known connection. Stateful inspection is the norm in modern firewalls because it makes filtering both tighter and simpler.

Firewalls have also moved up the stack. Next-generation firewalls can identify the actual application inside the traffic rather than trusting the port number alone, so they can block a forbidden application even when it hides on port 443. For CC purposes you only need the concept: basic firewalls filter on addresses and ports, stateful firewalls track connections, and application-aware firewalls look deeper into what the traffic really is.

A virtual private network (VPN) creates an encrypted tunnel between two points across an untrusted network, most often the internet. Everything inside the tunnel is encrypted, so anyone intercepting the traffic along the path sees only ciphertext. The primary security service a VPN provides is confidentiality for data in transit; depending on the protocols used, it also authenticates the endpoints and protects traffic integrity. Common building blocks you should recognize by name are IPsec and TLS.

The exam distinguishes two deployment patterns. A remote access VPN connects an individual user's device to the organization's network: the laptop runs VPN client software, authenticates, and behaves as if it were plugged in at the office. A site-to-site VPN connects two entire networks, such as a branch office and headquarters, through a permanent tunnel between two gateways. Individual users behind those gateways do not run any client software and may not even know the tunnel exists.

A concrete scenario ties it together. An accountant works from a coffee shop on open Wi-Fi, where anyone nearby can capture wireless traffic. Before opening the finance system, she starts the company VPN client. Her laptop now sends all traffic through an encrypted tunnel to the office gateway, so the captured packets are unreadable, and the finance system sees her connection arriving from the corporate network. That is a remote access VPN doing its job: confidentiality over an untrusted network. If her firm later links its two offices with a permanent tunnel between their firewalls, that second arrangement is a site-to-site VPN.

Wireless traffic is broadcast through the air, so anyone in radio range can attempt to capture it. That makes encryption non-negotiable on Wi-Fi, and the exam expects you to recognize the security standards by generation. WEP, the original standard, is cryptographically broken and must never be used. WPA improved on it, and WPA2 became the long-standing baseline using strong AES-based encryption. WPA3 is the current standard and strengthens protection further, including better defenses against attackers who capture traffic and try to guess the password offline. The recognition-depth rule: prefer WPA3, accept WPA2, and treat WEP or an open network with no encryption as a finding.

Beyond encryption, basic wireless hygiene appears in scenario questions: change the access point's default administrator password, use a strong Wi-Fi passphrase, and put visitors on a separate guest network so their devices cannot reach internal systems. An open network in a cafe provides no encryption at all, which is exactly the situation where a VPN restores confidentiality.

Bluetooth carries its own short-range risks. Devices left in discoverable mode advertise themselves to everyone nearby, and weak or default pairing codes let attackers connect. Classic attack names you may see are bluejacking, sending unsolicited messages to a device, and bluesnarfing, stealing data from one. The mitigations are simple and testable: keep Bluetooth off when unused, disable discoverable mode, reject unexpected pairing requests, and keep device firmware updated.

Not every networked device is a computer with a keyboard. An embedded system is a computer built into a larger device to do one job: the controller inside a medical infusion pump, a smart TV, or a car. Industrial control systems (ICS) are the specialized embedded systems that run physical processes such as power grids, water treatment, and factory lines; you may see the related term SCADA for the systems that supervise them. The Internet of Things (IoT) is the broad category of everyday network-connected objects: cameras, thermostats, door locks, sensors, printers.

These devices share weaknesses that the exam expects you to recognize. They receive limited patching: vendors ship updates rarely or not at all, and an ICS running a production line may never get a maintenance window. They have long service lives, so a controller installed fifteen years ago may still run an operating system that stopped receiving security fixes long ago. They ship with weak defaults, such as well-known administrator passwords and unnecessary open services that owners never change. And they often lack the processing power to run the endpoint security agents a laptop would carry. For ICS there is an extra twist: availability and physical safety dominate, so defenders cannot simply reboot or take a plant controller offline to patch it.

Because you usually cannot fix the device itself, the practical control is the network around it: change every default credential, disable services you do not need, keep firmware as current as the vendor allows, and above all isolate these devices on their own network segment so a compromised camera cannot reach your file servers. Segmentation as a compensating control is the exam's favorite answer here.