The Abstraction Layers
of the OSI Model
The PCF builds on the Open Systems
Interconnection model (OSI) stack fa-
miliar to most computer scientists. It
treats the stack primarily as a concep-
tual framework for organizing how we
understand computing systems, par-
ticularly in the security domain. The
OSI model describes abstraction layers
that enable the student or practitioner
to focus on where a problem may ex-
ist, such as the physical, network, or
application layer. While retaining the
abstraction layers from the OSI model,
the PCF does not emphasize the role
of the OSI model as a standardizing
model. Instead, it broadens students’
understanding by focusing attention
on the critical domains that introduce
well-documented and well-understood
risks from management, government,
and international affairs. I provide
supplemental materials online that
further discuss the relationship of the
PCF to the OSI model and expand other
points made in this column.c
As a conceptual framework for un-
derstanding computer systems, the
seven traditional layers apply intuitive-
ly to cybersecurity risks, as discussed
by Glenn Surman in his 2002 article
“Understanding Security Using the OSI
Model.” 2 Surman concluded: “The most
critical thing you should take from this
paper is that for every layer there are at-
tacks being created, or attacks awaiting
activation as a result of poor defence.”
Bob Blakley from Citicorp assisted with
these illustrations of vulnerabilities
that exist at each of the seven layers,
and I have added vulnerabilities exist-
ing at layers 8, 9, and 10.
As a way to introduce layers 8 through
10, each horizontal layer highlights important types of cybersecurity vulnerabilities. At layer 8, organizations face
a wide range of cyber-risks, and take
many actions to mitigate such risks. At
layer 9, governments enact and enforce
laws—good laws can reduce cybersecurity risks, while bad laws can make
them worse. At layer 10, the international realm, no one nation can impose
its laws, but treaties or discussions with
Russia and China, for instance, may improve cybersecurity. As shown in Table
c Supplementary materials on the framework
are available at https://bit.ly/2MJCrZq
Table 1. Vulnerabilities at each layer of the expanded OSI stack.
Layer Vulnerability
1. Physical Cut the wire; stress equipment; wiretap
2. Data link Add noise or delay (threatens availability)
3. Network DNS and BGP attacks; false certificates
4. Transport Man in the middle
5. Session Session splicing (Firesheep); MS SMB
6. Presentation Attacks on encryption; ASN- 1 parser attack
7. Application Malware; manual exploitation of vulnerabilities; SQL injection; buffer overflow
8. Organization A: Insider attacks; poor training or policies
B: Sub-contractors with weak cybersecurity; lack of information sharing
C: Weak technical or organizational standards
9. Government A: Laws prohibiting effective cybersecurity (for example, limits on encryption);
weak laws for Io T or other security
B: Badly drafted cybercrime laws (for example, prohibiting security research)
C: Excessive government surveillance
10. International A: Nation-state cyberattacks
B: Lack of workable international agreements to limit cyberattacks
C: Supranational legal rules that weaken cybersecurity
(for example, some International Telecommunications Union proposals)
As discussed in the column, for layers 8–10, “A” refers to vulnerabilities
and risk mitigation arising within the organization or nation; “B” refers
to vulnerability and risk mitigation in relation with other actors at that
level; and “C” refers to other limits created by actors at that level.
Table 2. The pedagogic cybersecurity framework.
Layer of the
Expanded OSI
Stack
A: Risk Mitigation
Within an
Organization or
Nation
B: Relations with
Other Actors
C: Other Limits
from This Level
Protocol
Data Unit
8: Organization 8A: Internal
policies or plans
of action to reduce
risk within an
organization (for
example, incident
response plans).
8B: Vulnerability
management in
contracts with
other entities,
like vendors (for
example, cyber-insurance).
8C: Standards and
limits originating
from the private
sector (for
example, PCI DSS
standard, led by
the PCI Cyber
Security Standards
Council).
Contracts
9: Government 9A: Laws that
govern what an
individual or
organization can
or must do (for
example, HIPAA
Security Rule).
9B: Laws that
govern how
organizations
and individuals
interact (for
example,
Computer Fraud
and Abuse Act).
9C: Government
limits on its
own actions (for
example, Fourth
Amendment,
limits on illegal
searches).
Laws
10: International 10A: Unilateral
actions by one
government
directed at one
or more other
nations (for
example, U.S.
Cyber Command
launching a
cyberattack on a
hostile nation).
10B: Formal
and informal
relationship
management with
other nations
(for example,
the Budapest
Convention’s
provisions about
cybercrime and
Mutual Legal
Assistance).
10C: Limits on
nations that
come from
other nations
(for example, the
United Nations and
international law).
Diplomacy