Skip to main content

Network and Protocol Security

Premium

Understanding the TCP/IP model is foundational for any security engineer. It helps you reason about how data travels, where vulnerabilities exist, and how to defend each layer of a system’s communication stack. Interviewers often test whether you can connect theory to practice: explaining where a risk occurs and how to secure it.

What to expect

Typical interview questions include:

  • “Explain the difference between HTTP and HTTPS.”
  • “How does TLS protect network traffic?”
  • “Which layer would you secure first when designing a new API?”

The majority of questions on network and protocol security are quiz-style.

In each case, focus on three things:

  • Describing function and purpose.
  • Explaining where risk appears.
  • Stating how to mitigate that risk.

Prompt: “Explain the difference between HTTP and HTTPS.”

Answer: “HTTP transmits data in clear text, which allows interception. HTTPS uses TLS to encrypt and authenticate both parties, preventing eavesdropping and tampering.”

OSI & TCP/IP in practice

In interviews, you can ignore the OSI model. The four-layer TCP/IP model is enough. It maps directly to real systems: Application (apps/protocols), Transport (TCP/UDP), Internet (IP/routing), and Network Access (Ethernet/Wi-Fi).

Instead, focus on reasoning about where attacks and defenses belong. For example, TLS encrypts at the transport layer, and firewalls filter packets at the network layer.

Application layer

This is where user-facing protocols operate (e.g. HTTP, DNS, or SMTP).

It’s also where most input and authentication logic lives, so attacks here are common and often critical.

Common protocols: HTTP, HTTPS, DNS, SMTP, FTP

Typical threats: Injection, spoofing, misconfiguration, cross-site scripting (XSS), SQL injection

How to defend:

  • Enforce authentication and authorization at all entry points.
  • Use TLS for encryption in transit.
  • Apply rate limiting to prevent brute-force and abuse.
  • Perform input validation and output encoding to block injection and XSS.
  • Deploy a Web Application Firewall (WAF) for additional protection.

Transport layer

The transport layer (TCP/UDP) manages connections and reliable delivery.

This is where you’ll encounter issues like connection hijacking or denial-of-service attacks.

Common protocols: TCP, UDP

Typical threats: SYN floods, connection hijacking, TLS downgrade attacks

How to defend:

  • Use TLS to encrypt data and authenticate endpoints.
  • Apply SYN cookies to protect against SYN floods.
  • Implement rate limiting and DDoS mitigation at the edge.

Internet layer

The internet layer handles addressing and routing i.e. how packets move across networks.

Attacks here often involve spoofing or manipulating routing information.

Common protocols: IP, ICMP

Typical threats: IP spoofing, routing manipulation, BGP hijacking

How to defend:

  • Apply firewall rules to control ingress and egress traffic.
  • Use VPNs to create encrypted tunnels between networks.
  • Implement ingress/egress filtering to prevent spoofed packets.
  • Apply BGP route validation and monitoring.

The link layer manages communication within local networks (switches, ARP, Ethernet).

Although often overlooked, attacks here can compromise entire segments.

Common protocols: Ethernet, ARP, Wi-Fi (802.11)

Typical threats: ARP spoofing, MAC flooding, packet sniffing

How to defend:

  • Enable VLAN separation to isolate traffic.
  • Use Dynamic ARP Inspection and port security to prevent spoofing.
  • Encrypt local traffic where possible (e.g., WPA3 for Wi-Fi).
  • Monitor for anomalous MAC addresses or traffic spikes.
Next Lesson