Cybersecurity & digital forensics — OSI explorer
Maurice Nzioki holds a BSc in Computer Security & Forensics. These conceptual layers connect networking with security and investigation context.
Layer 7: Application
Where applications provide network services, such as web requests and DNS lookups.
Review authentication, access controls, input handling and application configuration.
Application, web-server and DNS logs can help reconstruct requests. Correlate timestamps and retain the original records.
Layer 6: Presentation
A conceptual layer for representing, encoding and transforming data between systems.
Consider encryption, certificate configuration and safe parsing of data formats. Real protocol stacks do not map perfectly to OSI layers.
File formats, metadata and available encryption context may inform analysis. Encrypted content is not automatically recoverable.
Layer 5: Session
The model describes how communication sessions are established, coordinated and ended.
Review session expiry, reauthentication and how applications manage session state. These controls often span several layers.
Session identifiers and connection history can provide context when compared with authenticated activity.
Layer 4: Transport
TCP and UDP carry data between endpoints using ports; TCP also provides ordered, reliable delivery.
Review exposed services, firewall rules and connection behaviour against the intended access policy.
Connection records and authorised packet captures may show endpoints, ports and timing, but not necessarily the person behind an action.
Layer 3: Network
IP addressing and routing move packets between networks.
Consider segmentation, routing boundaries and permitted traffic between systems.
IP addresses, routing information and flow records help build a network timeline. Shared addresses and NAT can limit attribution.
Layer 2: Data Link
Frames move across a local link, using technologies such as Ethernet and Wi-Fi.
Review local network access, switch configuration and wireless security settings.
Switch logs, MAC addresses and local captures can provide context. MAC addresses alone do not establish identity.
Layer 1: Physical
Cables, radio signals and hardware carry the underlying bits.
Control physical access to network equipment and protect devices, cabling and power.
Device condition, access records and documented handling support an investigation. Preserve evidence and record who handled it.