Can you explain the difference between the OSI model and the TCP/IP model? As a SOC analyst, why is it important to understand these networking models when investigating security incidents?

Question

Accepted Answer

The OSI model and the TCP/IP model are both conceptual frameworks that describe how data travels across a network, but they differ in structure and practical application. Understanding these models is essential for SOC analysts because they provide a systematic way to analyze network traffic and pinpoint where security issues occur.

The OSI model has seven layers: Physical, Data Link, Network, Transport, Session, Presentation, and Application. Each layer handles a specific aspect of network communication. For example, the Network layer deals with IP addressing and routing, while the Transport layer manages end-to-end communication through protocols like TCP and UDP. The OSI model is primarily used as a teaching and troubleshooting framework.

The TCP/IP model is more practical and is the actual foundation of the internet. It condenses networking into four layers: Network Access (or Link), Internet, Transport, and Application. The Network Access layer combines the OSI Physical and Data Link layers, while the Application layer encompasses the OSI Session, Presentation, and Application layers. This model maps directly to real-world protocols you will encounter daily as a SOC analyst.

For SOC analysts, understanding these models is critical for several reasons. When you are analyzing alerts in your SIEM, knowing which layer a protocol operates at helps you understand the nature of an attack. For instance, an ARP spoofing attack targets Layer 2 of the OSI model, while a SQL injection targets the Application layer. This knowledge helps you classify and prioritize incidents correctly.

When examining packet captures in tools like Wireshark, the layered model helps you navigate through headers systematically. You can trace communication from Ethernet frames at the bottom up through IP headers, TCP segments, and finally the application data. This layered approach makes it much easier to identify anomalies.

In your day-to-day triage work, you will reference these layers constantly. A firewall operates primarily at Layers 3 and 4, filtering by IP addresses and ports. A web application firewall works at Layer 7. Knowing this helps you understand which security controls are relevant to a particular alert and where to look for evidence when investigating suspicious activity.