Where CISOTK Lands On The OSI Model

Our CTEM leverages risk inference as a pre-exploitation intelligence layer above traditional security controls.

It uses external threat intelligence, historical attack data, and analytics to identify and assess risk before it becomes an active exploit. Rather than reacting to alerts from systems like SIEM or XDR, it helps shape what those systems should prioritise in the first place.

In the context of Continuous Threat Exposure Management, risk inference plays a key role in continuously evaluating external exposures, understanding which weaknesses are truly exploitable, and prioritising remediation based on real-world attacker behaviour.

Instead of operating within network or application layers, it works across them — correlating signals from the entire attack surface and translating them into actionable risk context. 

In short, it enables security teams to focus on what matters most before an attacker ever reaches a technical control layer.

Hardware and physical connections (e.g., cables, switches, physical access to network devices, etc.).

• Physical Security Controls:

  • Access Control Systems (ACS): Secures physical access to network infrastructure (e.g., biometrics, smart cards).

  • Environmental Monitoring (EM): Monitors for temperature, humidity, or unauthorized entry in server rooms.

• USB Protection:

  • Port Control: Systems that disable unused USB ports on devices to prevent unauthorized hardware attacks.

  • USB Device Security: Solutions that restrict the use of external devices like USB drives to prevent data theft or malware introduction.

• Network Access Control (NAC):

  • 802.1X Authentication: Validates devices attempting to connect to a network.

  • NAC Systems (e.g., Cisco ISE, Aruba ClearPass): Detects rogue devices or improper network access attempts.

Segmentation Solutions:

• Air-Gapped Networks: Systems completely separated from the internet for ultra-sensitive data.

Media Access Control (MAC) addressing, packet forwarding, and error detection.

• VLANs (Virtual Local Area Networks):

  • Segmentation: Helps segment network traffic to reduce exposure between different network sections (e.g., server, admin, guest networks).

• MAC Address Filtering:

  • 802.1X Authentication: Further validates devices trying to access the network at the link layer.

• Data Link Layer Attacks:

  • ARP Spoofing Protection: Solutions that detect and block ARP poisoning.

  • MAC Spoofing Detection: Identifying and blocking rogue devices impersonating others.

• Wireless Network Security (Wi-Fi):

• WPA3 Security Protocol: Ensures secure Wi-Fi communications.

• WIPS (Wireless Intrusion Prevention System): Detects and blocks attacks targeting wireless networks.

Routing of data packets using IP addresses, subnets, and routing tables.

• Firewalls:

  • Next-Gen Firewalls (NGFW): Includes features like deep packet inspection (DPI), intrusion prevention (IPS), application-level filtering, and more (e.g., Palo Alto, Fortinet).

  • Firewall-as-a-Service (FWaaS): Cloud-based firewall services that provide the same protections as traditional firewalls but are scalable.

• NDR (Network Detection and Response):

  • Anomaly Detection: Detects and responds to suspicious network traffic and unusual behavior at the network layer (e.g., Darktrace, Vectra).

• IDS/IPS (Intrusion Detection/Prevention Systems):

  • Signature-Based IDS/IPS: Detects attacks based on known attack signatures.

  • Anomaly-Based IDS/IPS: Detects traffic that deviates from established baselines (e.g., Snort, Suricata).

• SD-WAN (Software-Defined Wide Area Network):

  • Network Traffic Optimization: SD-WAN ensures the reliable and secure transfer of data across wide-area networks.

• DDoS Protection:

  • On-Premise DDoS Mitigation (e.g., Arbor Networks): Detects and mitigates distributed denial-of-service attacks targeting the network.

  • DDoS Protection as a Service: Services like Cloudflare, AWS Shield, or Akamai Kona Site Defender defend against DDoS at the network layer.

• VPNs (Virtual Private Networks):

  • IPsec, SSL VPNs: Provide encrypted communication over insecure networks (e.g., OpenVPN, Cisco AnyConnect).

• BGP Protection:

• BGP Monitoring (e.g., BGPmon): Detects and alerts on suspicious Border Gateway Protocol anomalies like BGP hijacking.

Layer 4: Transport Layer

End-to-end communication and data flow control through ports and protocols (TCP, UDP).

• Firewalls (Continued):

  • Port Filtering: Blocks unauthorized ports from accessing systems, preventing unwanted traffic.

• Load Balancers:

  • TCP/UDP Load Balancing: Balances traffic efficiently between servers to prevent overload and maintain service availability.

• WAFs (Web Application Firewalls):

  • Protection Against Application Layer Attacks: WAFs such as AWS WAF or Cloudflare WAF often integrate with Layer 4 to inspect and filter malicious traffic before it hits the application.

• SSL/TLS Offload:

  • Decryption of SSL Traffic: Offloading SSL decryption to specialized devices or services for better performance (e.g., F5 BIG-IP).

• DoS Protection (Denial of Service):

• Rate-Limiting: Controls traffic rates and throttles connections to prevent resource exhaustion.

• Application Layer Protection: Blocking of abnormal requests such as SYN flood or other DoS/DDoS attacks.

Manages sessions, keeps track of connections, and ensures reliable communication between applications.

• Session Border Controllers (SBCs):

  • Voice & Video Traffic Protection: Protects VoIP communications and video conferencing from attacks like toll fraud, eavesdropping, or hijacking.

• Web Application Security:

  • Application Session Management: Manages secure sessions in web applications, enforcing things like session timeouts and re-authentication.

• Zero Trust Architecture:

• Session Authentication & Authorization: Zero Trust solutions verify every session or transaction, even for internal users, ensuring continuous monitoring and authentication at every session (e.g., Zscaler, Okta).

Data encoding, encryption, and decryption, translating the data into a format that is readable by the application.

• Encryption Solutions:

  • TLS/SSL Encryption: Encrypts data transmitted between the client and the server (e.g., Let's Encrypt, DigiCert).

  • IPsec Encryption: Used in VPNs for encrypted data transfer.

• DLP (Data Loss Prevention):

  • Content Inspection: Prevents unauthorized data exfiltration by inspecting files, emails, or messages for sensitive information (e.g., Forcepoint, Digital Guardian).

• Cryptographic Key Management:

• KMS (Key Management Systems): Centralized management of cryptographic keys to ensure secure data encryption (e.g., AWS KMS, HashiCorp Vault).

Interaction with user-facing applications, such as web services, email, and file transfers.

• Web Application Firewalls (WAFs):

  • Protects Web Applications: Defends against OWASP top 10 attacks like SQL Injection, XSS, and CSRF (e.g., Cloudflare, AWS WAF, Imperva).

• CDNs (Content Delivery Networks):

  • DDoS Mitigation and Caching: CDNs provide DDoS protection, improve load times, and distribute content globally (e.g., Cloudflare, Akamai, Fastly).

• SaaS Security:

  • CASB (Cloud Access Security Broker): Monitors user activities on cloud services and prevents the exfiltration of data from SaaS applications (e.g., Netskope, McAfee MVISION).

• API Security:

  • API Gateways: Protects APIs from attacks like SQL injections, DoS, and rate-limiting (e.g., Kong, Apigee).

• RASP (Runtime Application Self-Protection):

  • Application Runtime Security: Protects applications during execution, detecting and blocking attacks in real-time (e.g., Contrast Security).

• Identity and Access Management (IAM):

• Authentication & Authorization: Managing user identities and access to sensitive applications via SSO, MFA, and RBAC (e.g., Okta, Ping Identity).

• XDR (Extended Detection and Response):

  • Cross-Layer Threat Detection: XDR provides integrated threat detection and response capabilities across multiple layers, spanning network, endpoint, server, and cloud (e.g., Palo Alto Cortex XDR, Trend Micro XDR).

• SIEM (Security Information and Event Management):

  • Centralized Logging & Analysis: SIEMs collect logs from across layers to provide a unified view of security events and incidents (e.g., Splunk, IBM QRadar).

• SOAR (Security Orchestration, Automation,

and Response):

• Automated Incident Response: SOAR platforms automate responses to detected threats, integrate multiple security solutions, and manage workflows (e.g., Palo Alto Demisto, Splunk Phantom).

Each layer of the OSI model has different tools, protocols, and security solutions that interact with it. This broad overview highlights the fact that network security, endpoint protection, application security, cloud security, and identity management all play crucial roles in securing a network and mitigating potential attack surfaces at every level. However, risk inference comes first, as it provides insights into emerging threats and vulnerabilities, allowing organizations to proactively assess and prioritize risks before they can exploit any layer of the OSI model.

These solutions span both traditional network defense systems (e.g., IDS/IPS, NDR, firewalls) and more modern architectures. They all help defend against a wide range of threats by focusing on different OSI layers and ensuring that the entire network environment is as secure as possible.